An enterprise hosts an internal database in Azure that contains sensitive financial data. Applications running on Azure Virtual Machines inside a Virtual Network (VNet) need to query this database securely. Corporate security policies require that: The database is not accessible via a public IP address. All network traffic between the virtual machines and the database remains entirely within the private Azure network. The database is assigned a private IP address from the virtual network subnet. Which feature should the enterprise implement to satisfy these requirements?

Private endpoint: ### What an Azure Private Endpoint is An **Azure Private Endpoint** is a network interface that connects a virtual machine or other resource privately and securely to a service powered by **Azure Private Link**. The private endpoint uses a private IP address from your **Azure Virtual Network (VNet)** address space, effectively bringing the targeted Azure PaaS service directly into your private network. ### How it meets the requirements * **Eliminates public internet exposure**: By using a private endpoint, the database does not need to expose a public endpoint or route traffic over the public internet. * **Keeps traffic on the Microsoft backbone**: Traffic between the virtual machines in the VNet and the database travels exclusively over the secure **Microsoft global network backbone**. * **Assigns a private VNet IP**: The private endpoint assigns a specific private IP address from the VNet's subnet directly to the service resource. ### Key advantages and capabilities * **Granular resource access**: Secures connectivity to a specific resource instance rather than the entire multi-tenant service. * **Built-in data exfiltration protection**: Restricts network access strictly to the mapped resource, preventing unauthorized data transfers to unintended external destinations. * **Integration with private DNS**: Seamlessly resolves Azure service Fully Qualified Domain Names (FQDNs) to private IP addresses using **Azure Private DNS zones**. * **Cross-premises connectivity**: Enables secure connectivity from on-premises networks across **VPN Gateways** or **Azure ExpressRoute** without public routing. ### Why this is optimal A private endpoint is the ideal architectural choice when organizations must comply with strict isolation standards, eliminating public endpoints and keeping all database transactions confined within private IP boundaries.