Governance Policies Azure Networking Private Endpoints

Private Endpoints

Governance policies for Private Endpoints

Domain: azure-networking

Patterns

Name	Description
Private Endpoint with DNS Zone and VNet Link	Complete private endpoint deployment with all four required components: PE, DNS Zone, VNet Link, DNS Zone Group

Anti-Patterns

Description	Instead
Do not create a private endpoint without DNS configuration	Always create DNS Zone + VNet Link + DNS Zone Group alongside every private endpoint
Do not use custom DNS zone names	Use the exact Azure-defined privatelink.*.* zone name for each service
Do not place private endpoints in delegated subnets	Use a dedicated PE subnet (snet-pe) without delegations

References

• Private endpoint DNS integration
• Private DNS zone values
• Private endpoint overview

---

Checks (4)

Check	Severity	Description
AZ-PE-001	Required	Every private endpoint must have a Private DNS Zone, VNet Link, and DNS Zone Group
AZ-PE-002	Required	Use correct Private DNS Zone names for each Azure service
AZ-PE-003	Required	Use standard naming convention: pe-{resource-name} for private endpoints
AZ-PE-004	Recommended	Centralize Private DNS Zones in a shared resource group for multi-resource architectures

---

AZ-PE-001

Every private endpoint must have a Private DNS Zone, VNet Link, and DNS Zone Group

Severity: Required
Rationale: Without all three components, private endpoint DNS resolution fails and connections fall back to public endpoints
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.Network/privateEndpoints
• Microsoft.Network/privateDnsZones
• Microsoft.Network/privateDnsZones/virtualNetworkLinks
• Microsoft.Network/privateEndpoints/privateDnsZoneGroups

---

AZ-PE-002

Use correct Private DNS Zone names for each Azure service

Severity: Required
Rationale: Each Azure service has a specific private DNS zone name; using the wrong name causes resolution failures
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.Network/privateEndpoints

---

AZ-PE-003

Use standard naming convention: pe-{resource-name} for private endpoints

Severity: Required
Rationale: Consistent naming enables automation and troubleshooting
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.Network/privateEndpoints

---

AZ-PE-004

Centralize Private DNS Zones in a shared resource group for multi-resource architectures

Severity: Recommended
Rationale: Avoids DNS zone sprawl and simplifies management; all PEs share the same zone per service type
Agents: cloud-architect

Targets

• Microsoft.Network/privateEndpoints

---