Status: IN
Azure offers two complementary PaaS connectivity models with distinct tradeoff profiles: service endpoints are subnet-scoped, ARM-only, require no DNS changes, but cannot reach from on-premises; Private Link is instance-scoped, routes over the Microsoft backbone, requires private DNS zones, and supports on-premises access via ExpressRoute private peering — service endpoints are simpler to deploy but fundamentally less isolated and less flexible.