Private endpoint DNS problems

1Network, VM and a storage account

Create the VNet with an app subnet and an endpoint subnet, a VM with a managed identity, and a storage account with one blob:

$sfx = Get-Random -Minimum 10000 -Maximum 99999
$st = "stl65$sfx"
az group create --name rg-saat-l65 --location centralindia --tags course=saatvedha-azure lesson=65 -o none
az network vnet create --resource-group rg-saat-l65 --name vnet-l65 --address-prefixes 10.65.0.0/16 --subnet-name snet-app --subnet-prefixes 10.65.1.0/24 -o none
az network vnet subnet create --resource-group rg-saat-l65 --vnet-name vnet-l65 --name snet-pe --address-prefixes 10.65.2.0/24 -o none
az vm create --resource-group rg-saat-l65 --name vm-app --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B1s --vnet-name vnet-l65 --subnet snet-app --public-ip-sku Standard --nsg-rule NONE --assign-identity --admin-username azureuser --generate-ssh-keys --tags course=saatvedha-azure lesson=65 -o none
az storage account create --resource-group rg-saat-l65 --name $st --sku Standard_LRS --min-tls-version TLS1_2 --allow-blob-public-access false -o none
$stId = az storage account show --resource-group rg-saat-l65 --name $st --query id -o tsv
$me = az ad signed-in-user show --query id -o tsv
az role assignment create --assignee-object-id $me --assignee-principal-type User --role "Storage Blob Data Contributor" --scope $stId -o none
$vmPid = az vm show --resource-group rg-saat-l65 --name vm-app --query identity.principalId -o tsv
az role assignment create --assignee-object-id $vmPid --assignee-principal-type ServicePrincipal --role "Storage Blob Data Reader" --scope $stId -o none

Wait two minutes for the roles, upload a blob from your laptop, then close the public door:

az storage container create --account-name $st --name lab --auth-mode login -o none
az storage blob upload --account-name $st --container-name lab --name hello.txt --data "hello through the back door" --auth-mode login -o none
az storage account update --resource-group rg-saat-l65 --name $st --public-network-access Disabled -o none

2The private endpoint and its DNS

Create the endpoint, the private zone, the VNet link and the zone group that writes the A record:

az network private-endpoint create --resource-group rg-saat-l65 --name pe-blob --vnet-name vnet-l65 --subnet snet-pe --private-connection-resource-id $stId --group-id blob --connection-name pe-blob-conn -o none
az network private-dns zone create --resource-group rg-saat-l65 --name privatelink.blob.core.windows.net -o none
az network private-dns link vnet create --resource-group rg-saat-l65 --zone-name privatelink.blob.core.windows.net --name link-l65 --virtual-network vnet-l65 --registration-enabled false -o none
az network private-endpoint dns-zone-group create --resource-group rg-saat-l65 --endpoint-name pe-blob --name default --private-dns-zone privatelink.blob.core.windows.net --zone-name blob -o none
az network private-dns record-set a list --resource-group rg-saat-l65 --zone-name privatelink.blob.core.windows.net --query "[].{name:name, ip:aRecords[0].ipv4Address}" -o table

You should see something like this:

Name        Ip
----------  ---------
stl6512345  10.65.2.4

3Prove it from the VM

Save this as C:\azure-lab\pe\check-blob.sh. STNAME is replaced before each run:

#!/bin/bash
# Resolve the blob endpoint and list the lab container with the VM's managed identity
ST=STNAME
getent hosts $ST.blob.core.windows.net
TOKEN=$(curl -s -H Metadata:true 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://storage.azure.com/' | python3 -c 'import sys,json; print(json.load(sys.stdin)["access_token"])')
curl -s -H "Authorization: Bearer $TOKEN" -H 'x-ms-version: 2021-08-06' "https://$ST.blob.core.windows.net/lab?restype=container&comp=list" | grep -o -E '<Name>[^<]+|<Code>[^<]+'

Run it:

(Get-Content C:\azure-lab\pe\check-blob.sh -Raw) -replace 'STNAME', $st | Set-Content C:\azure-lab\pe\check-now.sh
az vm run-command invoke --resource-group rg-saat-l65 --name vm-app --command-id RunShellScript --scripts '@C:\azure-lab\pe\check-now.sh' --query "value[0].message" -o tsv

You should see something like this:

[stdout]
10.65.2.4       stl6512345.privatelink.blob.core.windows.net stl6512345.blob.core.windows.net
<Name>hello.txt

The normal blob name resolves to 10.65.2.4 through the privatelink CNAME, and the VM lists the container with its managed identity, even though public access is disabled.

✅ Checkpoint: vm-app resolves the storage name to the private endpoint and reads the container; public network access is disabled.