An enterprise organization manages backend database workloads on Azure PaaS services, including Azure SQL Database and Azure Storage. According to corporate compliance and security requirements, virtual machines inside an Azure Virtual Network (VNet) must connect to these services privately without exposing network traffic to the public internet. Which networking feature should the organization deploy to assign a private IP address within their virtual network to these services?

Private endpoint: ### What a Private Endpoint Is A **private endpoint** is a network interface that utilizes a **private IP address** from an **Azure Virtual Network (VNet)** subnet to connect securely and privately to a service powered by **Azure Private Link**. ### How It Meets the Requirements - **Keeps traffic off the internet**: By projecting the target PaaS service (such as Azure Storage or Azure SQL) directly into the virtual network, communication travels over the Microsoft backbone network rather than traversing the public internet. - **Assigns a private IP**: The private endpoint allocates a specific private IP address from your subnet's address range to the destination resource. - **Enhances compliance**: Secures sensitive data exchange and meets stringent regulatory isolation standards by eliminating the need for public IP addresses or public internet gateways. ### Key Advantages and Capabilities - **Data exfiltration protection**: Restricts traffic specifically to the mapped resource instance rather than opening broad access to the entire multi-tenant service. - **Seamless DNS integration**: Integrates smoothly with **Azure Private DNS zones** to resolve standard fully qualified domain names (FQDNs) to the assigned private IP address. - **Hybrid connectivity**: Allows on-premises workloads connected via VPN or ExpressRoute to securely reach Azure PaaS resources using internal routing. - **Granular access control**: Can be governed with approval workflows across different subscriptions and Microsoft Entra tenants. ### Why This Is Optimal A private endpoint is specifically architected to provide private, non-internet-exposed network connectivity for Azure PaaS resources into a virtual network, making it the standard and optimal architecture for strict corporate security policies.