How can a Microsoft-hosted Azure DevOps agent deploy to an Azure Database for PostgreSQL Flexible Server using Private Link?

Question

I need to deploy database updates from an Azure DevOps Pipeline to an Azure Database for PostgreSQL Flexible Server. The pipeline runs on a Microsoft-hosted agent, and the PostgreSQL Flexible Server has been configured to use Networking with Private Link as per Microsoft's recommendation.

I have reviewed the Microsoft documentation for the Azure Pipelines PostgreSQL task. However, I am unclear on how a Microsoft-hosted agent can connect to a PostgreSQL Flexible Server that is only accessible through a private endpoint.

My understanding is that Microsoft-hosted agents run outside of my virtual network, so they would not have direct connectivity to the private endpoint. Could someone please clarify:

1. Whether the deployment from a Microsoft-hosted agent to a Private Link-enabled PostgreSQL Flexible Server is supported.
2. If so, what networking configuration is required.
3. Whether a self-hosted agent running within the VNet (or a peered network) is the recommended approach.

I have been unable to find documentation specifically covering this scenario.
Any guidance would be greatly appreciated.

Thanks,
John

Answer 1

Hello @JohnSmith-4373

Your understanding is correct. A Microsoft-hosted Azure DevOps agent cannot directly reach an Azure Database for PostgreSQL Flexible Server that is only exposed through a Private Endpoint, because the agent runs outside your VNet and cannot resolve or route to the private IP.

The recommended approach is to use a self-hosted Azure DevOps agent deployed in the same VNet (or a peered VNet) as the PostgreSQL Flexible Server. Ensure:

• The agent has network connectivity to the Private Endpoint.
• Private DNS (privatelink.postgres.database.azure.com) resolves correctly.
• NSGs, firewalls, and routing allow TCP 5432.

If you must use a Microsoft-hosted agent, the database would need to be reachable over a public endpoint (with appropriate firewall restrictions), which defeats the purpose of a Private Link-only deployment.

Microsoft documents that Private Link is intended for clients within connected VNets, making a self-hosted agent the recommended pattern for CI/CD deployments targeting private databases.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.