Health Data Services Private Endpoint CNAME records missing

Question

Health Data Services Private Endpoint CNAME records missing

Maarten Rasenberg 0

Hi All,

We are having difficulties with connecting to our Health Data Services through a Private endpoint. All configuration is verified and via a VM using the hosts file, we can connect.

It seems that Azure DNS is not updated automatically as it should be; it resolves the public A record of the service instead of the CNAME to the privatelink.azurehealthcareapis.com address.

Searching the community, I've found a similar issue whit a different service: https://learn.microsoft.com/en-us/answers/questions/1258850/apim-private-endpoint-missing-dns-cname-alias

Is the Health Data Services service having the exact same issue of not updating the Azure DNS when creating a private endpoint?

Kind regards,
Maarten Rasenberg

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Christos Panagiotidis 3,551 Reputation points

2026-07-29T14:43:28.78+00:00

Your Health Data Services private endpoint works only with a hosts-file entry, while normal DNS follows the public name and never reaches a private A record. That confirms the network path works but Private Link DNS is incomplete. In the private endpoint’s DNS configuration, verify the expected private DNS zones and A records exist for the workspace and FHIR or DICOM service, and link each zone to the client VNet. If clients use custom DNS, configure conditional forwarding through Azure Private Resolver or another DNS forwarder; do not maintain hosts files. Microsoft documents that Health Data Services Private Link DNS entries can be missing after provisioning. If records should be automatic, delete and recreate the private endpoint, wait for provisioning, then confirm resolution returns its private IP. If records are managed manually, create the documented records. Escalate to Microsoft Support if reprovisioning still omits them.

Christos Panagiotidis 3,551 Reputation points

2026-07-29T14:43:28.78+00:00

Your Health Data Services private endpoint works only with a hosts-file entry, while normal DNS follows the public name and never reaches a private A record. That confirms the network path works but Private Link DNS is incomplete. In the private endpoint’s DNS configuration, verify the expected private DNS zones and A records exist for the workspace and FHIR or DICOM service, and link each zone to the client VNet. If clients use custom DNS, configure conditional forwarding through Azure Private Resolver or another DNS forwarder; do not maintain hosts files. Microsoft documents that Health Data Services Private Link DNS entries can be missing after provisioning. If records should be automatic, delete and recreate the private endpoint, wait for provisioning, then confirm resolution returns its private IP. If records are managed manually, create the documented records. Escalate to Microsoft Support if reprovisioning still omits them.