Azure Private Endpoint Deployments Exposes Azure Resources to DoS Attack

Palo Alto Networks details a critical Azure Private Endpoint/Private Link DNS handling flaw that can break hostname resolution and cause denial-of-service for storage accounts and dependent services (Key Vault, CosmosDB, Container Registry, Function Apps, OpenAI). The issue arises when a Private DNS zone linked from one VNet to another lacks matching A records, forcing DNS failures in the linked VNet; Microsoft acknowledges the limitation and offers two partial mitigations that introduce security or operational trade-offs.