Your company hosts a multi-tenant SaaS application on Azure. You need to expose the application privately to customers in other Azure tenants so they can connect using private endpoints in their own VNets, without traversing the public internet. You plan to create an Azure Private Link service. Which infrastructure component must front your application before you can create the Private Link service?