Question

Your company hosts a multi-tenant SaaS application behind an Azure Private Link service (PLS) fronted by a Standard internal load balancer. Currently the PLS is configured so that any Azure customer who knows the resource alias can send a connection request. Your security team now requires that only two specific partner subscriptions be able to automatically connect, while all other connection requests should be silently rejected without appearing in your pending approvals list. Which Private Link service configuration change meets this requirement?

Accepted Answer

Set the visibility to restricted by adding the two partner subscription IDs to the 'Visibility' (RBAC restricted) list and disable manual approval so their requests auto-approve while others are not offered the service.

Answer

Enable a service endpoint policy on the PLS subnet that lists the two allowed subscription IDs.

Answer

Add a network security group to the NAT subnet allowing only the partner subscriptions' public IP ranges.

Answer

Keep visibility open (role-based access anyone) but manually approve only the two partner connection requests as they arrive.