Checking DNS when Azure private endpoints fail

A private endpoint can be provisioned successfully while an application still cannot reach the service. DNS is an important part of the connection and should be checked alongside routing and access controls.

Test from the workload's perspective

Check that the service name resolves to the intended private address from the network where the application runs. A result from an administrator's laptop may follow a different DNS path.

Microsoft's private endpoint DNS guidance sets out the required names and configuration options.

Review the wider design

Check the relevant DNS zones, records, virtual network links and forwarding arrangements. Hybrid and hub-and-spoke environments need a consistent resolution path across their connected networks.

Document who owns the DNS configuration and how changes are deployed. If the same issue affects several workloads, reviewing the shared network and landing-zone design can help address the underlying cause.