Microsoft Azure Private Link Deep Dive

[@femibello2587]

Best teacher ever. No seriously, thank you. Saves me a lot of reading Microsoft documentation that are sometimes not so straightforward and sometimes can be very confusing. We all struggle with it. Yes Microsoft needs to hire you as the official trainer on all of their Azure documentation and pay for all these videos. Seriously.

[@NTFAQGuy]

Haha glad it helps. I don’t want my day job to be a trainer. I like doing this as my hobby :)

[@monsterpuss]

Once again you have acted as a babelfish, making the official documentation more comprehensible. Looking back now, I wonder why this seemed so hard for me to grasp! Many thanks for putting your inimitable spin on things. I'm increasing thinking that the official documentation could be enhanced by linking to the "Jon Savill deep dive" for each service!

[@NTFAQGuy]

Thanks 🤙

[@goon8000]

So very true...!

[@SmallvilleJW]

John, thank you so much for making your hobby something that greatly benefits others. You are a blessing! 😎

[@NTFAQGuy]

I appreciate that!

[@lltagged]

Uploaded 2 years ago - still very helpful! Thanks for taking the time to record the vid! Had a request to implement private link and needed some pointers. This was a true pleasure to watch.

[@ColinGroothius]

John, I can't thank you enough for your work. You have an uncommon ability to remove the fog from these sometimes difficult to grasp concepts. I have my team use your content all the time. Excellent!

[@ColinGroothius]

One question, when using Azure Private Zones does that still preclude us from using Bastion Service? Thanks.

[@NTFAQGuy]

Glad you like them!

[@NTFAQGuy]

You just have to watch a couple of zone names, it is not you can't use private zones at all.

[@NTFAQGuy]

Hey everyone, welcome to a deep dive look at Private Link! Please make sure to read the description for the chapters and key information about this video and others. ⚠️ P L E A S E N O T E ⚠️ 🔎 If you are looking for content on a particular topic search the channel. If I have something it will be there! 🕰️ I don't discuss future content nor take requests for future content so please don't ask 😇 Thanks for watching! ☁️🤙💪

[@Aussified]

Been scratching my head about private links and endpoints for a while. Not I have gained a bit of confidence when I speak to our networking guys to ask for what I need when they provision our services. Thanks John!

[@michalfajta4508]

Thanks John, last week i was searching your channel about Private Enpoint and I don't know how you do it but everytime I search for something I will find it on your channel or it will be released soon after. Again, BIG THANK YOU. :)

[@NTFAQGuy]

Happy to help!

[@Dechkaon]

Have to watch multiple times to wrap my head around all this. One of the best video out there on PLS. Thanks John for your hard work.

[@Dechkaon]

@2:29 you mentioned a subnet can be broken down into a subnet. How do you do that? haha i know you meant a vnet can be broken down into subnets... :)

[@TheMesmerizingCollective]

So you’re basically making the host or service accessible only on the internal network if you will? Just came across your channel as I look to study for some Azure exams. Excellent quality

[@henriquealexandreh]

Fantastic lecture! Never seen anything so nice and clear out there on the internet. Thanks a mil again John!

[@virescon]

I spent somewhere in the realm of 10 hours reading various documentation on this subject and it just wasn't clicking for me. In 10m I was able to understand where I was going wrong. I was looking at it way too traditionally. I wanted to conceptualize that private links lived in their own subnet and route their private traffic. But NO! Endpoints can be assigned to any subnet and accessed by regular means since it's just an IP address. What a unique technology. Thank you John!

[@oliversmith6348]

Honestly, I use your detailed videos as a guide. At times i would come back and watch a particular segment of the video to confirm my configurations or to better understand a concept. I appreciate you taking the time to create these incredibly useful videos.

[@vikingpea]

You make the confusing so clear. I am a visual learner and this video paired with your DNS videos really cleared a lot of murky concepts in my brain. Thank you so much!

[@okeychimeh977]

Such a lifesaver John, you rock.. Without you, we'd be stuck with having to read long pages of microsoft docs, then grapple with understanding

[@henkvantol550]

Just a few weeks a go I figured out the way how to use you own DNS and Azure private zones. It's great to see you're on the same track! Also thanks for the info on Private Link that could be very useful!

[@NTFAQGuy]

Glad I could help!

[@CrossedChaos]

This was a great video. I love the amount of detail. It took me a little bit to understand the private link service discussion and I had to read up a bit more using the microsoft docs, but now everything clicks.

[@ayanSaha13291]

A very big thanks to you! Explanation of Private link was quite exhaustive and lucid. Perfect!

[@NTFAQGuy]

Glad it was helpful!

[@abtinrefahi]

amazing video ... saved me 2 weeks of documentation reading, blog reading, ....

[@pushrelationshipgroup]

Wow! Just Wow! This is one of the best Azure videos I have ever watched in my entire career!! Thank you. I really appreciate your great work in making this subject look so easy.

[@NTFAQGuy]

Very welcome 🤙

[@OlivierWithoff]

Excellent! Answered all the questions I had going in. Well-worth the 1-hour investment of time. Thanks John!

[@sheaerickson537]

Really in depth. I so appreciate all your videos! Big help to constantly be learning all of Azure and it's so huge. Thanks John.

[@NTFAQGuy]

My pleasure!

[@lj7894]

Thxs John! Wish I saw this vid last year! I tried this a year ago from onprem via ER to connect to PE / PL, had some issues resolving the PL fqdn (Az SQL ) from onprem. Sorting out the DNS issue was key.

[@NTFAQGuy]

Yep, DNS is everything!

[@shriramhegde7424]

This is the best video to understand the Private Link services.

[@NTFAQGuy]

Very kind, thank you.

[@charleshobbs9034]

At around 08:20 when creating private endpoints and attaching to a stg acct service kind of reminds me of configuring say an equallogic san to allow ESXi hosts to connect to LUNS on the san.

[@NTFAQGuy]

cool :-)

[@peterodufona2558]

Thanks John... Once again, a great deep dive!!!

[@NTFAQGuy]

Thanks

[@JD-du3qe]

Great timing. Appreciate this deep dive, right when I'm troubleshooting private link. Thanks John!

[@NTFAQGuy]

Welcome

[@KarelCarboch]

Great great, many thanks to the author for the accurate and clear description of the topic, again many thanks !

[@UnclePhilsCellar]

You are a master communicator. What a fantastic explanation!

[@NTFAQGuy]

Wow, thanks! Appreciate that

[@bigr2904]

Awesome lesson John! I really needed to understand this fully for an implementation at work and I am filled with much more confidence now. Thank you!

[@alexgraham3529]

Must re-iterate Richard's comments below - had a loose understanding of PLS and this did help the understanding from MS Learn. Great content as per usual JS. 🙂

[@NTFAQGuy]

Glad to help!

[@rknaik76]

The best channel to learn some of the hard Azure concepts. Subscribed to it now. In a couple of places on this video, I have to zoom out as the giant bicep muscle was occupying the screen. Along with Azure exercise, I need to do gym exercise as well ..

[@NTFAQGuy]

Lol

[@erichosseini3832]

Oh man, your explanation is end to end, easy to unbderstand, direct to the point and sweet to watch. Thatnk a lot for all the effort you put into these awesome videos and lift up others' knowledge for free. You are a True legend! 🤙

[@peterdolina9124]

Very good methodology. A lot of time required yet that time with this instructor is well spent.

[@NTFAQGuy]

Many thanks!

[@expertnerd]

All I can say is, where is the tip jar? Your videos have saved me so much time and energy. After watching your videos, I also feel I have a solid understanding of how some of the Azure services work! Keep up the great work!

[@NTFAQGuy]

Glad can help 🤙

[@mikeisreal4734]

Wow! I am pretty new to Azure and this was incredibly informative. Will be tuning back in for more. Thank you and well done!

[@NTFAQGuy]

Awesome, welcome to the channel!

[@wolkwijs324]

Great video! love those deep dives.

[@NTFAQGuy]

Thanks 👍

[@c.4800]

Once again John, your master clases are awesome. Super well explained, straight to the point and covering end to end the topic. Thank you John 👏🏻👏🏻👏🏻👏🏻

[@emmanuelmotsi]

Much respect for you John!

[@mauriciozaragoza3709]

Thanks for the video. And for the great work you do for the community. Looking forward for your upcoming materials.

[@NTFAQGuy]

Welcome

[@jeroentrimbach]

Thanks a lot John! This is a great deep dive session 👍

[@NTFAQGuy]

Glad you enjoyed it!

[@embacktall]

I can't thank you enough for these lessons

[@NTFAQGuy]

You're very welcome!

[@MaartenVanDamme81]

Very useful video John. thanks for all the efforts that goes into making these videos. You rock!

[@keithsexton8962]

Great Explanation John.

[@andyschild5565]

Wow. Nice job. Love it!

[@Cyrulos]

John you def have skills and ease with explaining all of that. Appreciate your work here. Using that MS Whiteboard on a large touch screen is absolute hit - we also have them in the office! Keep it up, I'm going to return to this materials as often as I can. Working as CSA on a fin institution - I def find your lecture about PL + PLS as great value.

[@FrostSpike]

This was a **really** useful presentation!

[@NTFAQGuy]

Glad to hear that!

[@shamzudevices8794]

Thanks a lot JS.. helped alot to catch up from fundamentals.

[@BeautifulIndiaRoadTrips]

Great Session

[@olebo5867]

Thanks John! Awesome deep dive, really good explanation

[@NTFAQGuy]

Glad you enjoyed it!

[@blkh2040]

Thanks for putting the deep dive together.

[@NTFAQGuy]

Welcome.

[@mp40fan]

Thanks a lot for this explanation! It cleared up a lot for me.

[@pratyashapattanayak9943]

it's super awesome explanation of the concepts :). thank you

[@ahmedw5]

Very helpful! Thanks John.

You Rock! (or pebble if in the context of tattoos ;) ) One thing, you mentioned the pricing at the end just as peering & in/out. That is correct. But there is an additional one tiny little thing to be aware :) You pay €0.009/$0.01 per private endpoint per hour. Which basically menas €6.57/$7.3 per month. Multiply it by the number of different services and different endpoints (like blob,dfs,web etc.) and it can reach something significant to someone. But that is the price to stay 'private' or 'NATed' anyway :}

[@NTFAQGuy]

lol :-D John "The Pebble" Savill :-D and yes re PE pricing.

[@andriysokalchuk9210]

Awesome clarification.

[@manojpillai2687]

Thank You so much. Great work. Very helpful!

[@juanpabloguerra9512]

Thanks for this great video. As far as PLS, why the NAT’ing just don’t use the FE IP of the LB instead of manually allocating IPs from a subnet?

[@NTFAQGuy]

It’s a separate service that you may want to see if it came via pls and why limit to only one ip.

[@nazimmatoub9564]

Thanks a lot ! Very useful concepts !! I don't know if you have the possibility to explaining subtleties that concerns app services and Azure function integration with private endpoints ? Thanks again ;)

[@NTFAQGuy]

there is a different video on app service vnet integration

[@vinaymiddha4781]

Great lesson taught . thanks sir John

[@haotan2460]

Thanks to God , we have john to help summary and explain the Azure tech.. that is really really really helpful.John, you saved our life , MS should pay for you.

[@christianibiri]

Excellent explained!!

[@lctsi]

Another good video. Keep up the good work.

[@NTFAQGuy]

Thanks 👍

[@dirkl9652]

Much appreciated John.

[@NTFAQGuy]

Welcome!

[@josecarlosbenitez9415]

great explanation. Thank you so much !!

[@ohassairi]

ما شاء الله عليك يعطيك القوة

[@bmstalker]

Great content, thanks John.

[@yulaw3289]

super cool video, thanks a lot!

[@Nice-up6zs]

great job!! helped me a lot! :)

[@Respawngg]

Thank You, Very well Explained

[@guiladfuks1160]

You are the best!!!

[@AndreasGutowski]

Thanks for this great overview 🙏

[@NTFAQGuy]

Glad it was helpful!

[@va55ag0]

Another great video! Your deep dives are always great. Quick qn: If I wanted traffic to my Private Link service to go through a firewall, could I do that? E.g. could I point the Private Link Service to the Front End IP Configuration of an App Gateway instead of a LB?

[@NTFAQGuy]

App gateway already has an ip in a vnet. Pls only supports slb. You would need app gateway to support PE if it’s existing ip in vnet was not enough

[@va55ag0]

@@NTFAQGuy Thanks. I was thinking about that example you gave about a vendor wanting to offer services to untrusted clients. That vendor would like to offer their clients the ability to connect to the service via a private endpoint... But still want their traffic to go through a firewall on their side.

[@va55ag0]

I suppose I could create an SLB with a backend that points to the private IP address of my Application Gateway... 🤔

[@mayankparihar1988]

You have amazing knowledge respect ❤❤❤

[@NTFAQGuy]

Thank you!

[@tamimthaher2405]

thanks for making it easy :)

[@artisticcheese]

What is 'dfs' (alongside with blob etc) listed as subresources under storage account when you create private endpoint

[@NTFAQGuy]

Adlsgen2

[@jayq7357]

Amazing video! So if NSGs and UDRs are not functional (other than preview) for services using Private Links, you're limited to IAM permissions to enable/block access to the resources like Key Vault, Azure SQL, Azure Storage, etc, correct?

[@NTFAQGuy]

or control the target PE address at source but thats painful normally

[@jayq7357]

@@NTFAQGuy once you change "allow access from" to "selected networks" that is only applicable to service endpoints, correct?

[@NTFAQGuy]

@@jayq7357 will not restrict pe as I said in the video

[@marcusaurelius3796]

Great tutorial! Thank you. Is it possible to make a storage account only private but have an azure automation account runbook still be able to access it? I checked in resources and trusted services, but could not find it.

[@NTFAQGuy]

Hybrid worker in vnet would work I guess

[@marcusaurelius3796]

@@NTFAQGuy agreed, that will. I was trying to avoid that step/hop, by utilizing all the "built-in" stuff. I would have hoped MS would allow me trust my own automation account resource on the vnet (or something like that to avoid the hybrid step). Thank you for getting back and for all the effort you put for these sessions. Very helpful.

[@richardgmale2913]

Great video again John - you need to use youtube "thanks" so we can at least buy you a coffee!

[@NTFAQGuy]

hehe, very kind but not required. There are others far more deserving! I do appreciate the thought.

[@elprofesornet8897]

Amazing, thanks!

[@NTFAQGuy]

Glad you like it!

[@frankiem2942]

Great content 👌

[@NTFAQGuy]

Thank you 🙌

[@amjds1341]

I am using azure events hub service bus private link and it resolves to azure private dns but I cannot send event due to ssl handshake/dns resolution issue as I am leveraging azure private dns. Is there a way to have a new private dns for private link?

[@NTFAQGuy]

I’m not following your problem I’m afraid. I would post more detail to Reddit for more help

[@amjds1341]

Sorry for the confusion. We are using custom domain and leveraging Azure private dns for Paas service events hub. We are able to resolve the events hub service bus IP from on prem same but unable to use private dns name from on prem as it points back to original paas IP. Private dns entry is unable to resolve the cname entry i.e. authoritative entry for service bus somehow. Since we get SSL error message and our private dns entry doesn't match with service bus hostname, even though it points to same via private endpoint I would post on reddit for more detail :). Thanks for your response

[@Depstha]

Legend!!!

[@amjds1341]

Love it

[@imadbensisaid8016]

Thank’s a lot John

[@NTFAQGuy]

Very welcome

[@Rosepoision]

Nice video

[@NTFAQGuy]

Thanks

[@danjianu3011]

Comment for engagement !