Standard service endpoint: when it replaces private endpoints and when it does not

What changes compared with the existing service endpoint

With the existing service endpoint, which Microsoft now calls basic, every PaaS resource carries one rule per allowed subnet. With many VNets and subscriptions, that list grows with every new subnet.

With the standard service endpoint, all subnets are assigned the same public IP as network identifier, across VNets and subscriptions, as long as tenant and region are the same. The network security perimeter allows that one IP. New subnets require no change on the resources.

The IP only serves as identification. The service remains reachable through its public endpoint, restricted by the perimeter rules.

What it cannot do

• No access from on-premises. Service endpoints only apply to traffic from subnets in Azure.
• No data exfiltration protection of the kind Private Link provides by binding to a single resource.
• No private endpoint. The public endpoint of the resource stays active.
• Only four services. For Azure SQL Database it only works in the same region as the VNet.
• All service endpoints in a subnet must use the same network identifier.

What it costs compared with private endpoints

According to the pricing page, the standard service endpoint costs 0.10 US dollars per VNet and hour, about 73 US dollars a month. The public IP used as network identifier costs about 3.65 US dollars a month and can be shared by all VNets in the same region. The pricing page lists no per-GB charge.

A private endpoint costs 0.01 US dollars per hour, about 7.30 US dollars a month, plus 0.01 US dollars per GB for inbound and outbound data. It is billed per endpoint, meaning per resource and sub-resource, not per VNet.

Cost therefore grows in different directions. The standard service endpoint gets more expensive with the number of VNets, private endpoints with the number of resources and the data volume. Without data charges, the break-even point is ten private endpoints per VNet.

US list prices as of 1 Nov 2026, 730 hours per month, data volume as the sum of both directions, one shared public IP. Private DNS zones and inter-region traffic are not included.

The standard service endpoint therefore pays off with few VNets and many resources or large data volumes. In a hub and spoke environment with central private endpoints and many spokes, it is usually more expensive. The existing service endpoint remains free. If it is sufficient and rule management is not a problem, there is no reason to switch.

Before switching

• Whether the requirements call for a private endpoint. If access from on-premises, data exfiltration protection or a disabled public endpoint is required, Private Link is the only option.
• Whether the network security perimeter limits fit: up to 200 prefixes and 1,000 PaaS resources per perimeter, 100 perimeters per subscription, allow rules only.
• Run the perimeter in transition mode first and review the diagnostic logs for one to two weeks before enforcing it.
• Adding or changing the network identifier resets active connections. That belongs in a maintenance window.
• Assigning the IP requires the Network Contributor role or the joinServiceEndpointNetworkIdentifier permission on the public IP.

Which connection fits where

Which connection fits each service depends on protection requirements, network topology and data volumes. An architecture review compares existing service endpoints, private endpoints and firewall rules and calculates the options for your environment. Configuration is then carried out by your team or your service provider.