The following diagram shows how the resolution works when using a private DNS zone to resolve these modified service FQDNs. First, ensure that your private endpoint connections are enabled and configured. The hostname is stored as a setting to the Azure Function with name 'ADT_ENDPOINT'. By default, service-managed storage accounts are used. When configured, a private endpoint will be placed into a defined virtual network's subnet, providing a private IP address for clients looking to communicate to the gateway. Substitute your generated value for {uniqueid}. The private IP mappings for the storage account are listed in the private endpoint blade for the storage account ion the portal. More info about Internet Explorer and Microsoft Edge, connect Azure Front Door Premium to a App Service origin with Private Link, connect Azure Front Door Premium to a storage account origin with Private Link, connect Azure Front Door Premium to an internal load balancer origin with Private Link. Private members are accessible only within the body of the class or the struct in which they are declared, as in this example: class Employee { private int _i; double _d; // private access by default } Nested types in the same body can also access those private members. If your networks are peered, create the Private Link connection on the shared (or hub) VNet. If it has the permissions to add DNS entries in these zones, theyll be created by the vault, otherwise you must create them manually by the user in their custom DNS or in private DNS zone linked with the VNet. In addition to these connections when the workload extension or MARS agent is installed for recovery services vault without private endpoints, connectivity to the following domains are also required: When the workload extension or MARS agent is installed for Recovery Services vault with private endpoint, the following endpoints are hit: In the above text,