Azure Private Endpoints and virtual network security for ADLS Gen2

The enterprise architecture solution is combining Azure Private Endpoints with disabled public network access.

Corporate Virtual Network (VNet)
+-------------------------------------------------------+
| Azure Databricks / Synapse Cluster                    |
| Resolves storage via Azure Private DNS Zone           |
|                                                       |
| Private Endpoint Interface (Private IP: 10.0.1.5)      |
+-------------------------------------------------------+
                           |
                           v Azure Backbone (Encrypted)
+-------------------------------------------------------+
| Azure Data Lake Storage Gen2 Account                  |
| Public Network Access: [ DISABLED ]                   |
+-------------------------------------------------------+

Implementing Private Endpoints

• Create the Private Endpoint: Deploy a network interface card inside a dedicated private subnet of your Virtual Network (VNet). This interface receives a private IP address from your subnet address range (for example, 10.0.1.5).
• Configure Azure Private DNS Zones: Configure a private DNS zone for privatelink.dfs.core.windows.net. When Databricks, Synapse, or Azure Data Factory initiates a query to mystorage.dfs.core.windows.net, the DNS resolver resolves the query to the private internal IP 10.0.1.5.
• Disable Public Access: Set public network access to 'Disabled' on the storage account firewall.

All traffic between compute engines and storage files traverses Microsoft's dedicated fiber backbone, completely eliminating internet attack surfaces and complying with financial banking security standards.

Defense in depth

Combining private endpoints with storage firewall rules guarantees that even if an access key or connection token is leaked externally, no requests can reach the storage cluster from outside authorized virtual network subnets.