With Private Link enabled - I get 403 (Forbidden). Why I am not getting 404 (when accessed from outside)

Question

Hi Everyone -

We have an internal application for a large enterprise and we have used App services and enabled Private endpoints. Things looked good as we are able to access from Inside and when accessed from outside we got 403 Forbidden access.

Although we thought this was fine, our security team indicated that with a 403 Forbidden, still one is able to hit from outside (public) although the page is not served. And they are looking for some thing 404 or page not found kind of error if hit from outside.

Any thoughts on how to completely Secure this ?

Or - with 403 Forbidden, is it completely secure ?

We are planning for Azure Front door with Premium and if required App gateway etc. But a direct hit to App service URL is the issue.

Any thoughts ?? Appreciate your help.

Thanks && Regards
-Mathew James