services / Azure / Private endpoint

A private endpoint is a network interface, assigned a private IP from a VNet/subnet, that connects privately to a specific PaaS resource (e.g. a storage account or Key Vault) via Azure Private Link, keeping that resource's traffic off the public internet.

A private endpoint is a perimeter/segmentation control that determines how a sensitive backend resource is reached; misconfiguring one changes the network exposure of whatever resource it fronts. Rated consistent with the other network-segmentation resources documented alongside it.

Microsoft.​Network/​privateEndpoints/​delete

Deleting a private endpoint removes private connectivity to the backend PaaS resource it fronts; if the resource still allows public access, this can force traffic back over a public path, and if it does not, it denies service to legitimate consumers.

Risks

1. Denial-of-service (HIGH)
2. Network destruction (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links