How to Create System-Generated Private Endpoints for Azure Storage Account Using Bicep?

Question

Hello everyone,

I am trying to provision an Azure Storage account along with private endpoints using a Bicep template. I am able to create the first two private endpoints (for blob and file) with the following Bicep code:

resource mlBlobStoragePrivateEndpoint 'Microsoft.Network/privateEndpoints@2022-11-01' = {
  name: mlBlobStoragePrivateEndpointName
  location: location
  properties: {
    subnet: {
      id: vnet::privateEndpointsSubnet.id
    }
    privateLinkServiceConnections: [
      {
        name: mlBlobStoragePrivateEndpointName
        properties: {
          groupIds: [
            'blob'
          ]
          privateLinkServiceId: mlStorage.id
        }
      }
    ]
  }
}
resource mlFileStoragePrivateEndpoint 'Microsoft.Network/privateEndpoints@2022-11-01' = {
  name: mlFileStoragePrivateEndpointName
  location: location
  properties: {
    subnet: {
      id: vnet::privateEndpointsSubnet.id
    }
    privateLinkServiceConnections: [
      {
        name: mlFileStoragePrivateEndpointName
        properties: {
          groupIds: [
            'file'
          ]
          privateLinkServiceId: mlStorage.id
        }
      }
    ]
  }
}

These create private endpoints for blob and file successfully. However, I noticed that two additional private endpoints (with _SYS_PE prefix) are automatically created by the Azure Portal when setting up the storage account. These are visible in the Private Endpoint Connections tab (see the attached screenshot).

I could not find any reference in the Azure documentation about how these system-generated endpoints are created. Here's what I want to know:

1. Are these system endpoints automatically created when using certain Azure services or configurations?
2. How can I replicate the creation of these _SYS private endpoints using a Bicep template?
3. Is there any special configuration or additional properties required in the Bicep code to enable these private endpoints?

Error Context: Additionally, I'm encountering an issue in my pipeline while creating data assets. Here's the error snippet:

Error in creating data asset with Exception: 

Answer 1

Hi ,

Thanks for reaching out to Microsoft Q&A.

The _SYS_PE private endpoints for Azure Storage accounts are system-generated private endpoints used internally by Azure for specific operations or services (e.g., Azure Backup, Azure Data Lake). These are automatically created by Azure when certain configurations or features are enabled for your storage account. Let's address your queries step-by-step:

---

1. Are these system endpoints automatically created when using certain Azure services or configurations?

Yes, the _SYS_PE private endpoints are automatically created when you enable specific Azure services or features, such as:

• Azure Backup for the storage account.
• Azure Data Lake Storage (hierarchical namespace) features.
• Services that internally rely on private communication to Azure-managed resources.

For example:

• Enabling Azure Backup for a storage account automatically creates these private endpoints for backup-specific traffic.
• Using Data Lake Storage Gen2 hierarchical namespace may create additional system private endpoints for internal operations.

---

2. How can I replicate the creation of these _SYS private endpoints using a Bicep template?

You cannot directly create _SYS_PE private endpoints using Bicep or any other Infrastructure-as-Code tools. These are managed by Azure and are created automatically when you configure certain features. However, you can:

• Ensure the required configurations are enabled in your Bicep template, which may trigger Azure to create the system-generated private endpoints.
• Examples of such configurations include enabling hierarchical namespace (isHnsEnabled) or Azure Backup policies.

3. Is there any special configuration or additional properties required in the Bicep code to enable these private endpoints?

The _SYS_PE endpoints are not explicitly configured. Instead, ensure the following in your Bicep template:

1. Enable the required feature or service: Ensure that hierarchical namespace, Azure Backup, or any dependent service is properly configured in the storage account's properties.
2. Private Endpoint Configuration: Ensure private endpoints for the relevant services (e.g., blob, file) are configured in the subnet.
3. Permissions: Ensure your service principal or account has adequate permissions (e.g., Storage Blob Data Contributor) for all private endpoint configurations.

Error Context

The error snippet you provided seems incomplete. Could you provide more details about the error, such as:

• The full exception message.
• The part of the pipeline or script where it occurs.

This will help narrow down the issue further.

---

Summary

• _SYS_PE private endpoints are created automatically when enabling certain Azure features or services.
• You cannot explicitly define _SYS_PE endpoints in Bicep, but enabling the relevant services or configurations will trigger Azure to create them.
• Review your storage account and service configurations in Bicep to ensure all prerequisites for these private endpoints are met.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.