After a private endpoint is added, what makes unchanged clients using the service's published hostname take the private path?

## Two halves, and the second one is the switch Creating an endpoint gives you an address in your own range that the provider will carry to the managed service. Nothing about creating it makes any client *use* it. Clients connect to whatever address their resolver hands back, so the mechanism that actually moves traffic is **name resolution**. The platform publishes a **private answer** for the service's published hostname into the network the endpoint lives in. From inside that network the hostname resolves to the endpoint's address; from outside it resolves to the provider's public address. The same name, two answers, depending on who asked — the **split-horizon answer**. ## Why reuse the published hostname instead of a new private name 1. **Nothing in the client changes.** Connection strings, configuration, service manifests and secrets keep the name they already had, so adopting the private path is not a rollout across every consumer. 2. **The certificate still validates.** The service presents a platform-issued certificate for its published name. Point clients at an invented private name and the name in the certificate no longer matches what the client asked for, so the session fails validation or has to be weakened — which is the opposite of the goal. 3. **It stays reversible.** Because the switch lives in resolution rather than in the clients, withdrawing the private answer puts traffic back on the public path without touching a single workload. ## The failure mode this design creates The consequence of an invisible switch is an invisible failure. If the private answer is not published into the network that a client sits in, that client resolves the hostname publicly and keeps taking the public path. Nothing errors. The endpoint exists, its standing charge is on the bill, the design document says traffic is private, and the packets are going out through the internet route. Symptoms worth naming in an interview: - Resolving the service hostname from a workload returns an address that is **not inside any of your prefixes** — the fastest check there is. - The address-translating gateway's byte counters keep climbing for a service you believe is now private. - Some clients moved and others did not, split exactly along which network they run in. ## Scoping, which is where teams get surprised - The private answer is **scoped to the networks it is associated with**. A network you did not associate keeps getting the public answer, and platforms differ in whether that association is automatic for the network holding the endpoint and manual for every other one. - A resolver a team runs itself, or a forwarder pointing at a resolver outside the network, **can bypass the private answer entirely** — the answer only applies to lookups that reach the platform's resolver for that network. - Clients and libraries **cache** answers for the lifetime the record advertises, so a cutover is not instant and a rollback is not instant either. - Some platforms let you attach an alternative name of your own to the endpoint as well; using that name instead of the published one puts you back in the certificate problem above unless you also supply a certificate for it. ## How to verify it, in order 1. Resolve the service's published hostname **from a workload in the target network** — not from a laptop, which is outside every horizon that matters. 2. Confirm the answer is an address inside the subnet where the endpoint was placed. 3. Confirm the route from the workload's subnet reaches that address, because a correct answer with no route gives you a **timeout**, which looks nothing like a permission failure. 4. Only then check that traffic to that address is what the service's own rules accept. That order matters because each step fails differently: a public answer means the traffic silently leaves privately-intended and becomes ordinary internet transfer; a missing route means a hang; a policy that refuses the public path produces an explicit refusal rather than a hang. Reading which of those three you have is how you locate the half that is misconfigured without touching the others.