How can a Microsoft-hosted Azure DevOps agent deploy to an Azure Database for PostgreSQL Flexible Server using Private Link?

JohnSmith-4373 25 Reputation points
2026-07-30T02:24:39.55+00:00

I need to deploy database updates from an Azure DevOps Pipeline to an Azure Database for PostgreSQL Flexible Server. The pipeline runs on a Microsoft-hosted agent, and the PostgreSQL Flexible Server has been configured to use Networking with Private Link as per Microsoft's recommendation.

I have reviewed the Microsoft documentation for the Azure Pipelines PostgreSQL task. However, I am unclear on how a Microsoft-hosted agent can connect to a PostgreSQL Flexible Server that is only accessible through a private endpoint.

My understanding is that Microsoft-hosted agents run outside of my virtual network, so they would not have direct connectivity to the private endpoint. Could someone please clarify:

  1. Whether the deployment from a Microsoft-hosted agent to a Private Link-enabled PostgreSQL Flexible Server is supported.
  2. If so, what networking configuration is required.
  3. Whether a self-hosted agent running within the VNet (or a peered network) is the recommended approach.

I have been unable to find documentation specifically covering this scenario.
Any guidance would be greatly appreciated.

Thanks,
John

Azure Database for PostgreSQL
0 comments
Answer accepted by question author
Allan Solomon Mejia 7,915 Reputation points
2026-07-30T18:46:26.34+00:00

Hello @JohnSmith-4373

Your understanding is correct. A Microsoft-hosted Azure DevOps agent cannot directly reach an Azure Database for PostgreSQL Flexible Server that is only exposed through a Private Endpoint, because the agent runs outside your VNet and cannot resolve or route to the private IP.

The recommended approach is to use a self-hosted Azure DevOps agent deployed in the same VNet (or a peered VNet) as the PostgreSQL Flexible Server. Ensure:

  • The agent has network connectivity to the Private Endpoint.
  • Private DNS (privatelink.postgres.database.azure.com) resolves correctly.
  • NSGs, firewalls, and routing allow TCP 5432.

If you must use a Microsoft-hosted agent, the database would need to be reachable over a public endpoint (with appropriate firewall restrictions), which defeats the purpose of a Private Link-only deployment.

Microsoft documents that Private Link is intended for clients within connected VNets, making a self-hosted agent the recommended pattern for CI/CD deployments targeting private databases.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.