Private Endpoint DNS Zones
Pick the Azure services you use and get every privatelink DNS zone your private endpoints need — plus the public zones on-prem DNS must forward. The Microsoft Learn table, as a tool.
✓ runs 100% in your browser — no data leaves this pageStorage
| Service | Sub-resource | Private DNS zone(s) | |
|---|---|---|---|
| Blob Storage | blob | privatelink.blob.core.windows.net | |
| File shares | file | privatelink.file.core.windows.net | |
| Queues | queue | privatelink.queue.core.windows.net | |
| Tables | table | privatelink.table.core.windows.net | |
| Static website | web | privatelink.web.core.windows.net | |
| Data Lake Gen2 | dfs | privatelink.dfs.core.windows.net |
Databases
| Service | Sub-resource | Private DNS zone(s) | |
|---|---|---|---|
| SQL Database / Managed Instance | sqlServer | privatelink.database.windows.net | |
| PostgreSQL Flexible Server | postgresqlServer | privatelink.postgres.database.azure.com | |
| MySQL Flexible Server | mysqlServer | privatelink.mysql.database.azure.com | |
| Cosmos DB (NoSQL) | Sql | privatelink.documents.azure.com | |
| Cosmos DB (MongoDB) | MongoDB | privatelink.mongo.cosmos.azure.com | |
| Cosmos DB (Cassandra) | Cassandra | privatelink.cassandra.cosmos.azure.com | |
| Cosmos DB (Gremlin) | Gremlin | privatelink.gremlin.cosmos.azure.com | |
| Cosmos DB (Table) | Table | privatelink.table.cosmos.azure.com | |
| Cache for Redis | redisCache | privatelink.redis.cache.windows.net |
Security
| Service | Sub-resource | Private DNS zone(s) | |
|---|---|---|---|
| Key Vault | vault | privatelink.vaultcore.azure.net | |
| Key Vault Managed HSM | managedhsm | privatelink.managedhsm.azure.net |
Compute & containers
| Service | Sub-resource | Private DNS zone(s) | |
|---|---|---|---|
| AKS (private cluster API server) | management | privatelink.{region}.azmk8s.io Replace {region} with the cluster's region, e.g. privatelink.westeurope.azmk8s.io. | |
| Container Registry | registry | privatelink.azurecr.io Data-endpoint records ({region}.data) live in the same privatelink zone. | |
| App Service / Functions | sites | privatelink.azurewebsites.net Also add the scm.* record for Kudu/deployments — same zone. | |
| Azure Databricks | databricks_ui_api | privatelink.azuredatabricks.net |
Integration
| Service | Sub-resource | Private DNS zone(s) | |
|---|---|---|---|
| Service Bus | namespace | privatelink.servicebus.windows.net | |
| Event Hubs | namespace | privatelink.servicebus.windows.net Event Hubs shares the Service Bus zone. | |
| Event Grid (topics/domains) | topic | privatelink.eventgrid.azure.net | |
| IoT Hub | iotHub | privatelink.azure-devices.net, privatelink.servicebus.windows.net The built-in Event Hubs-compatible endpoint needs the servicebus zone too. | |
| SignalR Service | signalr | privatelink.service.signalr.net | |
| Data Factory | dataFactory | privatelink.datafactory.azure.net | |
| Data Factory (portal) | portal | privatelink.adf.azure.com |
Management & monitoring
| Service | Sub-resource | Private DNS zone(s) | |
|---|---|---|---|
| Azure Monitor / Log Analytics / App Insights | azuremonitor | privatelink.monitor.azure.com, privatelink.oms.opinsights.azure.com, privatelink.ods.opinsights.azure.com, privatelink.agentsvc.azure-automation.net, privatelink.blob.core.windows.net Azure Monitor Private Link Scope (AMPLS) needs all five zones. | |
| Automation | Webhook / DSCAndHybridWorker | privatelink.azure-automation.net | |
| Backup (Recovery Services) | AzureBackup | privatelink.{geo}.backup.windowsazure.com, privatelink.blob.core.windows.net, privatelink.queue.core.windows.net Replace {geo} with the vault's geo code, e.g. weu for West Europe. | |
| App Configuration | configurationStores | privatelink.azconfig.io |
AI & analytics
| Service | Sub-resource | Private DNS zone(s) | |
|---|---|---|---|
| Azure OpenAI | account | privatelink.openai.azure.com | |
| AI Services (Cognitive Services) | account | privatelink.cognitiveservices.azure.com | |
| AI Search | searchService | privatelink.search.windows.net | |
| Machine Learning workspace | amlworkspace | privatelink.api.azureml.ms, privatelink.notebooks.azure.net | |
| Synapse (SQL pools) | Sql / SqlOnDemand | privatelink.sql.azuresynapse.net | |
| Synapse (workspace dev) | Dev | privatelink.dev.azuresynapse.net |
Curated from Microsoft Learn's private-endpoint DNS documentation, last reviewed 2026-07-21. This runs entirely in your browser. For services not listed here, check the official zone table.
Frequently asked
Is anything sent to a server?
No — this is a curated, static reference that runs entirely in your browser.
Where does the list come from?
Curated from Microsoft Learn's private-endpoint DNS documentation and reviewed by the Just Software engineering team. Services with unstable or partitioned zone schemes are deliberately omitted — verify anything exotic against the official table (linked below the tool).
Why do some zones contain {region} or {geo}?
A few services use regionalized zones: AKS private clusters use privatelink.<region>.azmk8s.io and Recovery Services vaults use a geo code like weu. Substitute your resource's region before creating the zone.