Service endpoints vs service endpoint policies vs private endpoints vs NSG service tags
Verdict: Service endpoint gives a subnet backbone routing to a whole service. Endpoint policy allowlists specific accounts. Private endpoint scopes reachability to one resource instance. NSG service tag is a coarse allow or deny, with no backbone identity change.
| Criterion | Service endpoint | Service endpoint policy | Private endpoint | NSG service tag |
|---|---|---|---|---|
| What it secures | Whole service, any account in it | Named accounts on an already-endpointed subnet | One PaaS resource instance | Coarse allow or deny by service |
| Configured at | Subnet, one Azure service per entry | Subnet, requires the matching service endpoint first | The PaaS resource itself | NSG rule, destination = service tag |
| Backbone routing | Yes, private VNet source address to the service | Inherits the endpoint's routing | Yes, private IP into the resource | No routing change, filter only |
| On-premises reach | No, ExpressRoute Microsoft peering needs the NAT IPs allow-listed separately | No, same restriction as the underlying endpoint | Yes, if DNS resolves to the private IP | N/A, applies inside the VNet |
| Exfiltration protection | None, any account in the service is reachable | Strong, only listed resource IDs reachable | Strong, only the one mapped instance reachable | Weak, any account behind the tag's IP ranges is reachable |
| Choose when | Lock a PaaS service to a subnet, no on-prem access needed | Allowlist specific accounts on a subnet already using endpoints | One storage account or SQL DB must be unreachable from other tenants/subs | Block internet but keep optimised routing to named Azure services, no new infra |
Rules
- Service endpoints are enabled per subnet, one Microsoft.* service at a time; a subnet needing Key Vault and Service Bus takes two separate endpoint entries.
- Enabling a service endpoint switches the subnet's source address for that traffic from public to private, so any storage IP-firewall rule keyed to the old public address stops matching.
- A service endpoint policy can only be attached to a subnet where the matching service endpoint already exists; once applied, only the listed resource IDs stay reachable.
- A private endpoint maps to one specific PaaS resource instance, so reachability is scoped to that instance and not to the wider service or tenant.
- NSG rules can use Azure service tags as the destination, allowing outbound to Sql and Storage while denying general internet traffic, with no extra appliance.
- Overriding the 0.0.0.0/0 route to a firewall next hop also redirects Azure service traffic unless a service endpoint creates a more specific route for that service.
Traps
- Service endpoints do not by themselves reach on-premises networks - ExpressRoute Microsoft peering traffic still needs its NAT public IPs added to the resource's IP firewall.
- A service-tag NSG rule permits traffic to any account behind that tag's IP ranges, not just specific accounts - it is not a substitute for a service endpoint policy.
- There is no combined or auto-covering endpoint - each supported service (Key Vault, Service Bus, Storage) needs its own separate service endpoint entry on the subnet.
- A resolvable public privatelink CNAME for a private-endpoint resource only confirms the name exists in the global namespace; it does not mean public network access is open.