Synapse and De-identification Services private link issue

Question

Synapse and De-identification Services private link issue

Srikanth Ravipati 0 Microsoft Employee

Hi team, I’m trying to create a managed private endpoint between our Synapse workspace and the De-identification service. However, I don’t see an Azure Health/De-identification resource option in Synapse’s managed private endpoints list. For security reasons, we must keep public access to the De-identification resource turned off. Because of this, we’re getting the error: “message”: “Access Denied: Private Link validation failed.” Could you please advise how to set this up using Private Link? Also, is there any official documentation we can share to confirm whether enabling public access on the De-identification resource is considered safe?

Saraswathi Devadula 15,685 Reputation points Microsoft External Staff Moderator

2026-03-29T03:21:32.4666667+00:00

Hello **Srikanth Ravipati

**It looks like Synapse’s built-in managed private endpoints list doesn’t currently include the Azure Health Data Services de-identification service, so you’ll need to set up a “standard” Private Endpoint for your de-identification resource and surface it to your Synapse virtual network. Here’s how you can do it:

Create a Private Endpoint on the De-identification service • In the Azure portal, navigate to your De-identification service → Networking → + Private endpoint. • Choose the same VNet (or Managed VNet) and subnet that your Synapse workspace (or your integration runtime) uses. • Finish provisioning.

Approve the connection • Still under your De-identification service → Networking → Private endpoint connections, you’ll see a “Pending” request. • Select it, click Approve, and confirm. The provisioning state should move to Approved.

Hook up DNS • When you created the endpoint you can integrate with a private DNS zone. Make sure you have a zone for: privatelink.azurehealthcareapis.com • Link that zone to your VNet so that <your-service>.privatelink.azurehealthcareapis.com resolves to the private IP.

Point Synapse at the private FQDN • In your Synapse Linked Service or notebook, use the private URL (e.g. https://.privatelink.azurehealthcareapis.com) instead of the public endpoint. • If you’re on a Managed VNet, ensure your Integration Runtime is in that VNet so that traffic flows through the Private Endpoint.

Once that’s done, public access on the De-identification service can remain Disabled (you’ll call it entirely over the Microsoft backbone via your Private Endpoint).

https://learn.microsoft.com/en-us/azure/healthcare-apis/deidentification/overview
Praveen Kumar Gudipudi 2,280 Reputation points Microsoft External Staff Moderator

2026-03-30T15:42:39.0433333+00:00

Hello **Srikanth Ravipati,We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Srikanth Ravipati 0 Reputation points Microsoft Employee

2026-03-30T17:00:39.1866667+00:00

Hi Praveen, no resolution yet, was going through synapse managed private endpoint resource called Private Link Service. checking is there any possibility we can establish a link between synapse and De-id using that Private Link.
Praveen Kumar Gudipudi 2,280 Reputation points Microsoft External Staff Moderator

2026-03-30T18:36:50.4533333+00:00
Hello **Srikanth Ravipati,

Azure Health Data Services – De‑identification service does not support integration with Azure Synapse Managed Private Endpoints. Because of this limitation, the De‑identification resource does not appear in Synapse’s managed private endpoint resource list, and Synapse cannot establish a managed private endpoint to the service.

The Private Link Service option in Synapse cannot be used as a workaround in this scenario. Private Link Service is intended for customer‑owned, load balancer–backed services and cannot be used to front or proxy Microsoft‑managed PaaS services such as the De‑identification service.

As a result, when public network access is disabled on the De‑identification resource, requests coming directly from Synapse will fail with “Access Denied: Private Link validation failed”, since Synapse has no supported private link surface to bind to.

Supported options today

If the De‑identification service must be called directly from Synapse, public network access must be enabled on the De‑identification resource. This is currently the only supported configuration.

Enabling public access does not imply unauthenticated or anonymous access. The service is protected by Azure AD authentication, Azure RBAC, and tenant isolation, and it is designed so that customer data remains within the customer’s tenant.

If a private‑endpoint‑only architecture is mandatory, the recommended approach is to call the De‑identification service from a customer‑managed VNet workload (such as an Azure Function, AKS, or VM) where standard Azure Private Endpoints are supported, and have Synapse interact indirectly (for example, via storage or APIs).

For reference, the official documentation confirms Private Endpoint support for the De‑identification service in general, but does not indicate support for Synapse Managed Private Endpoints:

Overview of the De‑identification service https://learn.microsoft.com/en-us/azure/healthcare-apis/deidentification/overview
Praveen Kumar Gudipudi 2,280 Reputation points Microsoft External Staff Moderator

2026-04-02T15:30:02.9933333+00:00

Hello **Srikanth Ravipati,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

Saraswathi Devadula 15,685 Reputation points Microsoft External Staff Moderator

2026-03-29T03:21:32.4666667+00:00

Hello **Srikanth Ravipati

**It looks like Synapse’s built-in managed private endpoints list doesn’t currently include the Azure Health Data Services de-identification service, so you’ll need to set up a “standard” Private Endpoint for your de-identification resource and surface it to your Synapse virtual network. Here’s how you can do it:

Create a Private Endpoint on the De-identification service • In the Azure portal, navigate to your De-identification service → Networking → + Private endpoint. • Choose the same VNet (or Managed VNet) and subnet that your Synapse workspace (or your integration runtime) uses. • Finish provisioning.

Approve the connection • Still under your De-identification service → Networking → Private endpoint connections, you’ll see a “Pending” request. • Select it, click Approve, and confirm. The provisioning state should move to Approved.

Hook up DNS • When you created the endpoint you can integrate with a private DNS zone. Make sure you have a zone for: privatelink.azurehealthcareapis.com • Link that zone to your VNet so that <your-service>.privatelink.azurehealthcareapis.com resolves to the private IP.

Point Synapse at the private FQDN • In your Synapse Linked Service or notebook, use the private URL (e.g. https://.privatelink.azurehealthcareapis.com) instead of the public endpoint. • If you’re on a Managed VNet, ensure your Integration Runtime is in that VNet so that traffic flows through the Private Endpoint.

Once that’s done, public access on the De-identification service can remain Disabled (you’ll call it entirely over the Microsoft backbone via your Private Endpoint).

https://learn.microsoft.com/en-us/azure/healthcare-apis/deidentification/overview
Praveen Kumar Gudipudi 2,280 Reputation points Microsoft External Staff Moderator

2026-03-30T15:42:39.0433333+00:00

Hello **Srikanth Ravipati,We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Srikanth Ravipati 0 Reputation points Microsoft Employee

2026-03-30T17:00:39.1866667+00:00

Hi Praveen, no resolution yet, was going through synapse managed private endpoint resource called Private Link Service. checking is there any possibility we can establish a link between synapse and De-id using that Private Link.
Praveen Kumar Gudipudi 2,280 Reputation points Microsoft External Staff Moderator

2026-04-02T15:30:02.9933333+00:00

Hello **Srikanth Ravipati,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

Yutaka_K_JP 1,655

I think the de‑id svc just has no private‑link surface… so synapse simply has nothing to bind to. u can only turn public access on and call it directly; if it still fails, just check for any deny rules in the network blade.

0 comments

Share via

Synapse and De-identification Services private link issue

Supported options today

1 answer

Your answer