Question

A financial services company runs a critical third-party SaaS application that is published by the vendor as an Azure Private Link service. Security policy mandates that all traffic to this SaaS application must traverse the company's existing ExpressRoute private peering circuit and must never be exposed to the public internet, and the application must be reachable using a private IP address inside the company's Azure VNet. Which connectivity approach meets these requirements?

Accepted Answer

Create a Private Endpoint in the company VNet that maps to the vendor's Private Link service, and reach it over the existing ExpressRoute private peering

Answer

Enable ExpressRoute Microsoft peering and access the SaaS application through its public service endpoint

Answer

Deploy a Service Endpoint on the VNet subnet pointing to the vendor's SaaS resource over the Microsoft backbone

Answer

Configure a site-to-site IPsec VPN to the vendor and use NAT to translate the SaaS public IP to a private address