Azure Private Endpoint Deployments Expose Cloud Resources to DoS Attacks

The report details a critical Azure Private Link/Private DNS design weakness where Private DNS zone resolution can override public endpoints across linked virtual networks, causing DNS resolution failures and DoS for storage accounts and dependent services (Key Vault, CosmosDB, Function Apps, Container Registry, OpenAI). It describes accidental and malicious deployment scenarios, detection via Azure Resource Graph queries, and mitigation approaches (DNS fallback or manual A records), noting Microsoft acknowledges the limitation and that the issue can affect a sizable portion of Azure environments.