Multiple Private Endpoints for same resource type in the same VNet

Question

Hi everyone,

following situation:
I got 2 Key Vaults in the same VNet but in different Subnets. Also I got already one Private Endpoint with a Private DNS zone for 1 of the 2 Key Vaults.
Now I want to connect to the second Key Vault as well via Private Endpoint.

Microsoft is saying this:

Existing Private DNS Zones tied to a single service should not be associated with two different Private Endpoints as it will not be possible to properly resolve two different A-Records that point to the same service.

So is there a solution for my problem?

Thank's in advance!

Answer 1

Hi @simon ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are looking forward to adding two Keyvaults' private IP in a single private DNS Zone as A record.

In a private DNS Zone, you can have only one A record with a particular name.

• This is important as if we were to have multiple A records, the resolver will not know which IP to return
• The point you have highlighted talks about the above only

You can definitely have multiple A records as long as they have different names.
For e.g,
keyvault1.privatelink.vault.azure.net and keyvault2.privatelink.vault.azure.net can co-exist in a single Private Zone.

Refer: https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns

I hope this answers your query. Please feel free to let me know should there be any follow-up queries.
If this answer was helpful, kindly consider accepting the same as it may be beneficial to other community members

Cheers,
Kapil