Question

Your company hosts a multi-tenant SaaS application behind a Standard internal load balancer and exposes it through an Azure Private Link service. Several customers in other Azure AD tenants will connect to this service using private endpoints. You want private endpoint connection requests from three specific, trusted customer subscriptions to be established immediately without any manual action from your operations team, while all other subscriptions must still require manual approval. What should you configure on the Private Link service?

Accepted Answer

Add the three subscription IDs to the auto-approval list, and leave the visibility (restrict-by-subscription) list broad enough to include additional subscriptions.

Answer

Add the three subscription IDs to the visibility list only, and rely on the default connection state to approve them automatically.

Answer

Enable the TCP Proxy V2 setting so that trusted consumers are auto-approved based on the PROXY protocol header.

Answer

Create a service endpoint policy that lists the three subscriptions and attach it to the Private Link service NAT subnet.