Azure Network Infrastructure Tips

To allow on-premises services access to Azure storage account, without exposing the storage account to the internet, you can:

• Set up a VPN from on-premises to Azure
• Configure a storage account private endpoint.

VPN -> Azure Cloud + access public Azure services (without traversing the internet) = Private endpoint.

Resolve a FQDN to an IPv6 address with AAAA DNS record. 

To ensure that only certain VMs in your Azure environment can resolve FQDNs to IPs in Azure-hosted DNS zone:

• Deploy the VMs in a single virtual network and allow the virtual network access to the private DNS zone
• Create a private DNS zone