1

I guess I'm missing something, but I just don't get Service Endpoints.

Let's say I have Azure SQL, and I want to secure it as much as possible. Now, I can use the Firewall IP rules to protect from unauthorized access from the public web.

This, if I get it right, has nothing do to with Service Endpoint.

So I can set an endpoint to connect, say, a VM in my subscription to the Azure SQL. But what's the difference if I do or don't have a service endpoint? From what I gathered, the service endpoint makes my resources access the SQL via Azure backbone instead of via the public IP. So that means that service endpoints has nothing to do with outside access, which is still protected using the Firewall's IP rules.

Is that correct?

Does service endpoint protect against Azure resources accessing using public IP?

I really feel I miss something...

Thanks!

2 Answers 2

1

A Service Endpoint makes an Azure resources directly accessibile whithin a virtual network.

The SEP will expose a private IP address in the virtual network, and all virtual machines connected to that network will be able to reach the resource directly via this private IP address, without having to exit the network and go through the Internet.

4
  • And what do we achieve by that? Performance? Security? I understand this is relevant only for Azure resources in my subscription, right?
    – ml123
    Jun 8, 2020 at 11:56
  • It's only relevant for VMs connected to the virtual network where you create the service endpoint. It lets them access the service without exposing it on the Internet at all.
    – Massimo
    Jun 8, 2020 at 15:42
  • I envision an Azure VPN as a network on a remote island where only people/objects on the island have access. If there is both an SQL Server machine and an ML/Datamining machine on this island, why would the ML/Datamining machine need a Service Endpoint to talk to the SQL Server Machine?
    – Shawn Eary
    Jan 30 at 22:51
  • 1
    @ShawnEary service endpoints are used to connect PaaS services to a virtual network; virtual machines are already connected to a virtual network, they can talk to each other without any additional configuration.
    – Massimo
    Feb 21 at 16:45
0

From my knowledge, service end point are used for most managed resources like sql server, storage accounts, keg vault etc. On white listing particular subnet, you are setting a service end points at the host. Post this all traffic from the source to the whitelisted destination is via the microsoft backbone network.

On the contrary if you set public network, the traffic will flow into the public network.

Likewise there arw private end points which is for 1-1 traffic flow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .