azure-private-link

Azure Private Link Skill

This skill provides expert guidance for Azure Private Link. Covers best practices, decision making, architecture & design patterns, limits & quotas, security, and configuration. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Best Practices	L34-L38	DNS design and configuration guidance for private endpoints, including zone setup, name resolution patterns, split-horizon DNS, and avoiding common DNS misconfigurations with Private Link
Decision Making	L39-L44	Guidance on choosing perimeter access modes and designing Azure Private Link setups, focusing on security tradeoffs, cost optimization, and migration/transition considerations.
Architecture & Design Patterns	L45-L49	Designing DNS architectures for Private Endpoints using Azure Private Resolver, including name resolution patterns, forwarding rules, and integration with on-premises or hybrid networks
Limits & Quotas	L50-L56	Limits, quotas, and behaviors for Private Link/Endpoints, how to check service availability per resource, and how to request increases to VNet Private Endpoint limits.
Security	L57-L64	RBAC setup for Private Link and Network Security Perimeters, security best practices, and inspecting/controlling Private Endpoint traffic with Azure Firewall.
Configuration	L65-L83	Configuring Private Link, endpoints, DNS, IPv6, SNAT, and network security perimeters (NSPs) using portal, CLI, PowerShell, Terraform, plus monitoring and diagnostic logging setup.

Best Practices

Topic	URL
Apply DNS integration best practices for Azure Private Endpoints	https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns-integration

Decision Making

Topic	URL
Choose and transition Azure network security perimeter access modes	https://learn.microsoft.com/en-us/azure/private-link/network-security-perimeter-transition
Optimize Azure Private Link design for cost and security	https://learn.microsoft.com/en-us/azure/private-link/private-link-cost-optimization

Architecture & Design Patterns

Topic	URL
Design DNS infrastructure for Private Endpoints with Azure Private Resolver	https://learn.microsoft.com/en-us/azure/private-link/tutorial-dns-on-premises-private-resolver

Limits & Quotas

Topic	URL
Check Azure Private Link service availability by resource	https://learn.microsoft.com/en-us/azure/private-link/availability
Increase Azure Private Endpoint VNet limits	https://learn.microsoft.com/en-us/azure/private-link/increase-private-endpoint-vnet-limits
Azure Private Link limits, behaviors, and FAQs	https://learn.microsoft.com/en-us/azure/private-link/private-link-faq

Security

Topic	URL
Configure RBAC permissions for Azure Network Security Perimeter operations	https://learn.microsoft.com/en-us/azure/private-link/network-security-perimeter-role-based-access-control-requirements
Configure RBAC permissions for Azure Private Link	https://learn.microsoft.com/en-us/azure/private-link/rbac-permissions
Apply security best practices to Azure Private Link	https://learn.microsoft.com/en-us/azure/private-link/secure-private-link
Inspect and control Private Endpoint traffic using Azure Firewall	https://learn.microsoft.com/en-us/azure/private-link/tutorial-inspect-traffic-azure-firewall

Configuration

Topic	URL
Configure cross-perimeter links for Azure NSPs	https://learn.microsoft.com/en-us/azure/private-link/configure-perimeter-link
Configure Azure Private Link service Direct Connect	https://learn.microsoft.com/en-us/azure/private-link/configure-private-link-service-direct-connect
Configure standard service endpoints using Azure CLI	https://learn.microsoft.com/en-us/azure/private-link/configure-service-endpoint-standard-cli
Configure standard service endpoints in Azure portal	https://learn.microsoft.com/en-us/azure/private-link/configure-service-endpoint-standard-portal
Configure standard service endpoints with PowerShell	https://learn.microsoft.com/en-us/azure/private-link/configure-service-endpoint-standard-powershell
Configure Azure Private Link service endpoint with Terraform	https://learn.microsoft.com/en-us/azure/private-link/configure-service-endpoint-standard-terraform
Create and manage network security perimeters with Azure CLI	https://learn.microsoft.com/en-us/azure/private-link/create-network-security-perimeter-cli
Create and manage a network security perimeter in portal	https://learn.microsoft.com/en-us/azure/private-link/create-network-security-perimeter-portal
Configure subnet network policies for private endpoints	https://learn.microsoft.com/en-us/azure/private-link/disable-private-endpoint-network-policy
Configure privateLinkServiceNetworkPolicies for Private Link	https://learn.microsoft.com/en-us/azure/private-link/disable-private-link-service-network-policy
Configure and manage Azure Private Endpoint properties	https://learn.microsoft.com/en-us/azure/private-link/manage-private-endpoint
Reference for Azure Private Link monitoring data	https://learn.microsoft.com/en-us/azure/private-link/monitor-private-link-reference
Enable and store Network Security Perimeter diagnostic logs	https://learn.microsoft.com/en-us/azure/private-link/network-security-perimeter-diagnostic-logs
Configure DNS zones for Azure Private Endpoints	https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns
Configure SNAT bypass tags for Private Endpoint traffic via NVA	https://learn.microsoft.com/en-us/azure/private-link/private-link-disable-snat
Configure Azure Private Link over IPv6 connectivity	https://learn.microsoft.com/en-us/azure/private-link/private-link-ipv6