azureblog.co.uk
← cd ~/tools
// tools/private-dns

Private endpoint DNS zones

Search for a service to get its private endpoint sub-resource, the private DNS zone to create and link, and the public zone to forward from on-premises DNS.

  1. blobStorage (Blob)

    Private DNS zone: privatelink.blob.core.windows.net

    Forward from on-premises: blob.core.windows.net to your DNS Private Resolver inbound endpoint.

  2. fileStorage (Files)

    Private DNS zone: privatelink.file.core.windows.net

    Forward from on-premises: file.core.windows.net to your DNS Private Resolver inbound endpoint.

  3. queueStorage (Queue)

    Private DNS zone: privatelink.queue.core.windows.net

    Forward from on-premises: queue.core.windows.net to your DNS Private Resolver inbound endpoint.

  4. tableStorage (Table)

    Private DNS zone: privatelink.table.core.windows.net

    Forward from on-premises: table.core.windows.net to your DNS Private Resolver inbound endpoint.

  5. dfsStorage (Data Lake Gen2)

    Private DNS zone: privatelink.dfs.core.windows.net

    Forward from on-premises: dfs.core.windows.net to your DNS Private Resolver inbound endpoint.

  6. vaultKey Vault

    Private DNS zone: privatelink.vaultcore.azure.net

    Forward from on-premises: vault.azure.net and vaultcore.azure.net to your DNS Private Resolver inbound endpoint. The public name is under vault.azure.net but the private zone is under vaultcore.azure.net, so on-premises DNS needs a forwarder for both.

  7. sqlServerAzure SQL Database

    Private DNS zone: privatelink.database.windows.net

    Forward from on-premises: database.windows.net to your DNS Private Resolver inbound endpoint.

  8. postgresqlServerAzure Database for PostgreSQL flexible server

    Private DNS zone: privatelink.postgres.database.azure.com

    Forward from on-premises: postgres.database.azure.com to your DNS Private Resolver inbound endpoint.

  9. SqlCosmos DB (NoSQL)

    Private DNS zone: privatelink.documents.azure.com

    Forward from on-premises: documents.azure.com to your DNS Private Resolver inbound endpoint.

  10. sitesApp Service and Functions

    Private DNS zone: privatelink.azurewebsites.net

    Forward from on-premises: azurewebsites.net to your DNS Private Resolver inbound endpoint.

  11. registryContainer Registry

    Private DNS zone: privatelink.azurecr.io

    Forward from on-premises: azurecr.io to your DNS Private Resolver inbound endpoint.

  12. namespaceEvent Hubs and Service Bus

    Private DNS zone: privatelink.servicebus.windows.net

    Forward from on-premises: servicebus.windows.net to your DNS Private Resolver inbound endpoint.

  13. accountAzure OpenAI

    Private DNS zone: privatelink.openai.azure.com

    Forward from on-premises: openai.azure.com to your DNS Private Resolver inbound endpoint. AI services may also need privatelink.cognitiveservices.azure.com and privatelink.services.ai.azure.com for the endpoints your workload uses.

  14. azuremonitorAzure Monitor (private link scope)

    Private DNS zone: privatelink.monitor.azure.com

    Forward from on-premises: monitor.azure.com to your DNS Private Resolver inbound endpoint. Also needs privatelink.oms.opinsights.azure.com, privatelink.ods.opinsights.azure.com, privatelink.agentsvc.azure-automation.net and privatelink.blob.core.windows.net (agent solution packs).

From Microsoft's private endpoint DNS zone values. Read why private endpoints don't resolve for the full troubleshooting guide, or print the cheat sheet.