Public vs Private Endpoint Architecture

Configuring endpoints requires aligning network settings with your security goals. A public endpoint relies on a public IP address and properly configured Domain Name System (DNS) settings so users across the globe can resolve the address. Security for public endpoints is maintained externally by applying access controls through Network Security Groups (NSGs) and Azure Firewall.

In contrast, configuring a private endpoint integrates the target resource directly into an Azure Virtual Network (VNet). This setup assigns the resource a private IP address within the VNet, requiring local DNS updates to resolve the name internally. Access is strictly controlled within the network using Azure's role-based access control (RBAC) and NSGs to ensure only authorized users and services can communicate with the endpoint.