Question

Contoso deploys an Azure SQL Database and creates a private endpoint for it in a hub virtual network. On-premises servers connect to Azure over an ExpressRoute private peering. When on-premises applications resolve the database FQDN (contoso-db.database.windows.net), they still receive the public IP address instead of the private endpoint's private IP. A Private DNS zone named privatelink.database.windows.net exists and is linked to the hub VNet with A records for the private endpoint. What must you configure so that on-premises clients resolve the FQDN to the private endpoint's private IP?

Accepted Answer

Configure conditional forwarding on the on-premises DNS servers to forward queries for database.windows.net to an Azure DNS Private Resolver inbound endpoint (or DNS forwarder VM) in the VNet.

Answer

Add an A record for contoso-db.database.windows.net directly in the on-premises DNS zone pointing to the public IP address of the database.

Answer

Link the privatelink.database.windows.net Private DNS zone directly to the on-premises Active Directory DNS servers.

Answer

Enable auto-registration on the privatelink.database.windows.net Private DNS zone and re-create the private endpoint.