Access Azure Storage in VNET via Private Endpoint Not resolving to Private IP using Custom DNS

Question

I have 2 VNETS configured.

1 is my aadds-vnet that uses my custom domain, and has the 2 custom DNS Servers IP Address (10.2.0.5, 10.2.0.4). In here I have 2 Subnets (aadds-subnet, and workloads).

My other VNET is a VM VNET, that uses the same DNS Server IP Addresses as the aadds-vnet

The 2 VNETs are peered together bi-directionally

I set up a VM in the VM VNET using the article here and joined my custom domain. (This works fine): https://learn.microsoft.com/en-us/entra/identity/domain-services/join-windows-vm

in the VM VNET I have an Azure Storage Account, and created a Private Endpoint, and also setup the Private DNS Zone. So that there is a Private IP associated with the Azure Storage Account.

When I RDP to the VM, and do an NSLOOKUP to the Private Endpoint of the Azure Storage Account, it does NOT resolve to the Private IP.

If I change the VM VNETs DNS Server to use Microsoft Provided, and do the same NSLOOKUP (After restarting the VM), it correctly resolves to the Azure Storage Private Endpoint Private IP.

So the question: How do I configure it so that if I am using the Custom DNS Server IP Addresses, so that I can join the VM to my custom domain (Hosted in Azure), how can I have the Private Endpoints resolve properly to the Private IP?

All of my resources are in the cloud.

I don't have any DNS Server or Software or anything, I just specified 2 IP Addresses, as specified in the article above.

Do I need to setup a Resolver, Forwarder, etc.?

In this article: https://learn.microsoft.com/en-us/azure/private-link/troubleshoot-private-endpoint-connectivity it says: If you use custom DNS: (Which does not seem to apply to me, as I do not have on-premise infrastructure)

• Review your custom DNS settings, and validate that the DNS configuration is correct. For guidance, see Private endpoint overview: DNS configuration.

Thanks, in advanced.

Answer 1

Hi Tom,

You need to add a Virtual Network Link to your Private DNS Zone. To do this, please navigate to your private DNS zone for your storage account and click on DNS Management -- Virtual Network Links blade. Next click Add:

Enter a name for the link and select your aadds-vnet and Create it:

Wait a minute or so for the virtual network link to finish creating, then check in your VM that it resolves storage account to correct private IP using nslookup.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP