Troubleshoot Azure Private Endpoint connectivity failures by validating DNS, approval state, routing, NSGs, firewalls and end-to-end reachability.
Start with Check DNS resolution and work through the six diagnostic checks in order.
Record results before changing configuration and validate the original symptom after each controlled change.
Quick checks
Start with the basic checks in this runbook before moving to deeper troubleshooting.
- Confirm the affected service or component is available.
- Check recent configuration or connectivity changes.
- Run the relevant commands and compare the result with the expected state.
Check DNS resolution
Resolve the service FQDN and confirm it returns the expected private endpoint address rather than a public address.
Check private endpoint state
Confirm the private endpoint connection is approved and provisioning has completed successfully.
Check routing
Review effective routes, VNet peering and any Azure Firewall or NVA path between the source and private endpoint subnet.
Check network security
Check subnet and NIC NSGs and security appliances for rules affecting the required destination port.
Test private IP connectivity
Test the private endpoint IP from the affected source network to separate DNS problems from network problems.
Validate application access
Retest the application path and confirm the workload is using the intended private connectivity path.
Useful commands
Run these checks from an appropriate administrative session and replace example values with your environment.
DNS resolution
Resolve-DnsName <service-fqdn>TCP reachability
Test-NetConnection <private-ip> -Port <port>Quick troubleshooting path
Use this sequence to isolate the failing dependency before changing production configuration.
- Check DNS resolution → Resolve the service FQDN and confirm it returns the expected private endpoint address rather than a public address.
- Check private endpoint state → Confirm the private endpoint connection is approved and provisioning has completed successfully.
- Check routing → Review effective routes, VNet peering and any Azure Firewall or NVA path between the source and private endpoint subnet.
- Check network security → Check subnet and NIC NSGs and security appliances for rules affecting the required destination port.
- Test private IP connectivity → Test the private endpoint IP from the affected source network to separate DNS problems from network problems.
- Validate application access → Retest the application path and confirm the workload is using the intended private connectivity path.
What good troubleshooting looks like
Good infrastructure troubleshooting is evidence-driven. Capture the original state, test the dependency that can prove or disprove your hypothesis, make the smallest safe change and repeat the original test.
Symptom → hypothesis → direct test → result → controlled change → validation → documentation