In one sentence. Three different "private access" problems. Bastion: how an admin reaches a server's desktop without opening it to the internet. Endpoints: how servers reach a storage account or database without the traffic going over the public internet. VPN and ExpressRoute: how the whole office network plugs into the Azure network.
Azure Bastion
You, the admin: deploy Bastion once per VNet
- VNet1 › Subnets › + Subnet, name exactly
AzureBastionSubnet, size /26 or larger. - Bastions › + Create: VNet1, SKU Basic (Standard adds native RDP client, file copy and scaling; Premium adds session recording; Developer is a free limited tier), new Standard public IP.
- About 10 minutes later: VM › Connect › Bastion, enter the VM's credentials, the desktop opens in the browser. Works for VMs in VNet1 and in VNets peered to it.
Service endpoints vs private endpoints
Option 1 · Service endpoint: a trusted shortcut, service keeps its public address
Subnet App10.1.1.0/24
→never touches the open internet
Microsoft backbonetraffic tagged with the subnet identity
→firewall checks the tag
Storage accountstill has public IP 20.x.x.x; firewall allows only this subnet
Cheap and simple
- Free
- One tick box on the subnet, one line in the storage firewall
- No DNS changes
- Does NOT work from the office over VPN
- Service is still visible on the internet, just locked
Option 2 · Private endpoint: the service gets a private address inside your network
Subnet App10.1.1.0/24
→private IP, needs private DNS zone
Private endpoint NIC10.1.1.9, lives in your subnet
→Private Link
Storage accountpublic access switched OFF
Fully private
- Works from the office over VPN or ExpressRoute
- Public access can be disabled completely
- One endpoint per service instance
- Costs per hour plus data
- Needs the privatelink DNS zone linked to the VNet
Which is better?
"Only from this subnet, lowest cost" = service endpoint. "Must not be reachable from the internet at all" or "also from on-premises" = private endpoint.
You, the admin: storage reachable only from VNet1 and from the office
- Storage account › Networking › Private endpoint connections › + Private endpoint. Target sub-resource blob, VNet1 / subnet Data.
- On the DNS tab keep Integrate with private DNS zone = Yes; Azure creates
privatelink.blob.core.windows.net, links it to VNet1 and adds the A record for the NIC's IP 10.10.2.9. - Back on Networking › Firewalls and virtual networks set public access to Disabled.
- From a VM,
nslookup contosoinvoices01.blob.core.windows.netmust now answer 10.10.2.9. If it still shows a public IP, the DNS zone is not linked to that VNet. The office reaches it over the VPN because it is just a private IP.
A service endpoint is simpler: on VNet1 › Subnets › Data tick Microsoft.Storage under Service endpoints, then add that subnet in the storage firewall. Free, no DNS changes, but the service keeps its public address and the office cannot use the path.
VPN and ExpressRoute (lightly tested)
| Option | What it is | What you create |
|---|---|---|
| Site-to-site VPN | Encrypted tunnel over the internet from your office router | GatewaySubnet (/27); a virtual network gateway (type VPN, SKU sets speed, 30 to 45 min to build; Basic has no BGP); a local network gateway holding the office public IP and address ranges; a connection with a shared key |
| Point-to-site | One laptop at a time | Same gateway plus a client address pool; auth by certificate, Entra ID or RADIUS |
| VNet-to-VNet | Tunnel between two VNets | When peering is not possible (rare) |
| ExpressRoute | A private leased line through a carrier, not the internet | Circuit from the provider + ExpressRoute gateway |
Trap wording. "Admins must RDP without a public IP" = Bastion in AzureBastionSubnet. "Not reachable from the internet" or "also from on-prem" = private endpoint + private DNS zone. "Only from this subnet, lowest cost" = service endpoint. "Still resolves to a public IP" = link the private DNS zone.