Mutiple Private endpoints to a single private link service

Question

Mutiple Private endpoints to a single private link service

C.J. Vieleers 106

Hello
I would like to know if it's possible to have multiple private endpoints to a single private link service.
Here is our situation. A third party that is offering a cloud service in Azure and supports Azure private link. We already created a private endpoint to their service in our hub-spoke architecture.
Now if another vendor wants to make a connection to the same third-party service in a secure way as well. Can they simply setup a private endpoint (in the vendor environment) to the private link service too without interfering our private endpoint in the hub-spoke architecture?
Are there any drawbacks in having multiple private endpoints to a single private link service?

Kick

Accepted answer

1 additional answer

Your answer

Answer 1

Hello @C.J. Vieleers ,

I understand that you would like to know if you can have multiple private endpoints to a single private link service.

Yes, multiple private endpoints can be created with the same private-link resource. You can have upto 1000 private endpoints on the same private link service.
Refer : https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#private-link-limits

A single Private Link Service can be accessed from multiple Private Endpoints belonging to different VNets, subscriptions and/or Active Directory tenants.

Some considerations on this setup:

Existing Private DNS Zones tied to a single service should not be associated with two different Private Endpoints as it will not be possible to properly resolve two different A-Records that point to the same service. However, Private DNS Zones tied to multiple services would not face this resolution constraint.
Adding multiple DNS zone groups to a single Private Endpoint is not supported.

Refer : https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview
https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview
https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

JimmySalian-2011 42,511

Hi @C.J. Vieleers ,

AFAIK, it should be okay to have multiple private endpoints just need to take care of the duplicate and conflicts with the name resolution issues. private-endpoint-overview

Check the limits as well, if Premium should be covered - azure-subscription-service-limits

Hope this helps.

==
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

C.J. Vieleers 106 Reputation points

2022-10-11T12:01:59.98+00:00

Hello
Thanks for the quick response. Yes, you are correct, we need to be careful with the DNS resolving.
You talk about a single network or different subnets in a virtual network. Is creating a private endpoint in different vnet's possible?
And if possible and we both have separate private DNS zones, we would be able to use different ip addresses, correct?
If i understand things correctly, Microsoft wil always create a public DNS registration for a service. When a privatelink is created, MS will create a CNAME for the privatelink (but will not register the private ip address). When resolving a private url (directly or through public DNS, where the CNAME is) we will use our private DNS zone in order to get an ip address and the vendor will use their private DNS zone. That can result in different ip addresses resulting in a different ip address on their site, but that sounds perfectly fine. Am i correct?

Kick
JimmySalian-2011 42,511 Reputation points

2022-10-11T13:50:31.05+00:00

Hi,

Multiple private endpoints can be created on the same or different subnets within the same virtual network. For DNS configuration and settings please refer to this page and it will help you CJ - private-endpoint-dns

Hope this helps and clear your doubts and Please do not forget to accept the answer..
C.J. Vieleers 106 Reputation points

2022-10-11T16:40:02+00:00

Ehhh.....no i am still not clear.
Does your answer mean that you cannot have a private endpoint in 2 separate vnets pointing to 1 private link service?

Share via

Mutiple Private endpoints to a single private link service

1 additional answer

Your answer