Azure Firewall - Private endpoint DPI

Hi Eddie; in my opinion Private Link already provides the main security benefit in this scenario; the traffic uses a private IP and remains on the Microsoft backbone, even when the service is hosted in another tenant; Azure Firewall Premium adds visibility and threat inspection, but it does not make Private Link itself private or encrypted because those properties are already provided by the service.

Whether Premium is worth the additional cost depends mainly on the risk and compliance requirements; I would consider it when the third-party service exchanges sensitive data, when you need IDPS inspection, full URL visibility or evidence that encrypted traffic is being inspected centrally; Premium can decrypt outbound HTTPS traffic, inspect it against application rules and IDPS signatures, and then re-encrypt it.

For a normal trusted SaaS provider, with a limited number of well-defined endpoints, strong authentication and good application-level logging, I would probably start with Private Link, DNS controls, least-privilege access and standard firewall network rules; upgrading the whole firewall only for this flow can be difficult to justify.

There is also some operational effort to consider; TLS inspection requires an intermediate CA stored in Key Vault, certificate lifecycle management and trust deployment to the clients or workloads; it can also introduce latency and compatibility issues; mutual TLS, client certificate authentication, QUIC and some certificate scenarios have limitations or may require inspection bypasses.

Routing the private endpoint through the firewall is also more complex than standard Private Link connectivity; you need the correct UDRs, DNS resolution and symmetric routing, and in some designs SNAT is recommended; Microsoft’s guidance also notes that specific routes may be required for each private endpoint.

My approach would be to enable Premium only when there is a clear requirement for inspection rather than as a default requirement for every cross-tenant Private Link connection; a short proof of concept in IDPS alert mode is probably the best way to measure the actual visibility, false positives, latency and operational value before committing to the additional cost.