Azure News - 2026-08-06

1. Overview

Private Link over IPv6 (PL IPv6) enables customers to securely access Azure PaaS services over IPv6-based connectivity.

This capability is critical for:

• IPv6 based PE connectivity to PaaS resources
• Enabling IPv6 in On-prem environments

This document is intended to serve as guide to setup and test the On-prem connectivity from IPv6 customer address to Azure PaaS resources over Express Route via Private link. (IPv6 PE connectivity)

Note: This feature is currently in public preview and is not recommended for production workloads. 

2. Supported Scenarios

Scenario A: Native Azure (Azure VM → PaaS via IPv6 Private Endpoint)

• IPv6 client VM in VNet → IPv6 Private Endpoint → Azure PaaS

Scenario B: OnPrem Access via ExpressRoute

• On-prem IPv6 client → ExpressRoute → VNet Routing Appliance (VNRA) à IPv6 Private Endpoint → PaaS
• Supported via ER Circuits

3. Prerequisites

3.1 Supported Regions (Preview Scope)

• Limited preview regions
• West Central US
• East Asia
• UK South
• US Central
• North Europe

3.2 Supported Services (Preview)

• Azure Storage
• Azure SQL
• Azure Key Vault
• Azure Data Explorer

3.3. Subscription registration

An Azure account with an active subscription. Create an account for free.

• Your subscription must be registered for the Private Link over IPv6 preview. Registration is mandatory before you configure any resources. You can self-register the subscription by running the following commands:
  az feature register --namespace Microsoft.Network --name SupportIPv6PrivateEndpoint --subscription <subscription-id>
  az provider register --namespace Microsoft.Network

4. Configurations

4.1 Azure VNET level configurations

Please note that you will need to create:

• Dual-stack IPv6-enabled Vnet with a VM that is assigned both IPv4 and IPv6 address. For on-prem connectivity, this is the same Vnet where ER Gateway is created.
  Refer: Create an Azure virtual machine with a dual-stack network - Azure Virtual Network | Microsoft Learn
• PL scale enabled on VNET via configuration flags (refer config flags mentioned further in this section and bolded flags in the code snippet)
• Dual Stack (IPv4+ IPv6) Subnet
• Private Endpoints with IPv6

Refer these flags for enabling VNET with PL scale:

Vnet level :
"privateEndpointVNetPolicies": "Basic",

Subnet level:
“privateEndpointNetworkPolicies": "RouteTableEnabled"

Refer Azure documentation for VNET creation: Quickstart: Create an Azure Virtual Network | Microsoft Learn

4.3 Private endpoint configuration:

With the Private Link IPv6 support, we have introduced a new parameter in PE creation API/CLI, ‘ip VersionType’. Please ensure that this is set to ‘IPv6’ for enabling PL IPv6 traffic.

Refer Azure documentation for PE creation: Quickstart: Create a private endpoint - Azure portal - Azure Private Link | Microsoft Learn

Reference CLI:

az network private-endpoint create \

  --name <private-endpoint-name> \

  --resource-group <resource-group-name> \

  --vnet-name <vnet-name> \

  --subnet <subnet-name> \

  --private-connection-resource-id <resource-id-of-target-service> \

  --group-id <group-id> \

  --connection-name <connection-name> \

  --location <region> \

  --ip-version-type <Ipv4|Ipv6 >

4.4 DNS Configuration

Ensure these points for DNS configurations:

• Create Private DNS Zone for each Service type
• Attach the respective DNS zone to the Private Endpoints.
• Ensure to check that after above steps completed PaaS FQDN resolves to PEIPv6 address.

Refer Azure documentation for On-prem access via Private Link:
Azure Private Endpoint DNS Integration Scenarios | Microsoft Learn

Native Azure Connectivity (Azure VM → PaaS via IPv6)

Validation:

• Ensure the Storage Account FQDN resolves to the IPv6 Private Endpoint address.
• Access the Storage Account using the standard service FQDN.

From the dual-stack VM:

nslookup <storageaccount>.blob.core.windows.net

Expected Result:

<storageaccount>.privatelink.blob.core.windows.net

AAAA: <Private Endpoint IPv6 Address>

Connectivity validation:

curl https://<storageaccount>.blob.core.windows.net

Test-NetConnection <storageaccount>.blob.core.windows.net -Port 443

Configurations specific to On-prem connectivity via ER circuit and Virtual Network Routing Appliance

On-premises IPv6 clients access IPv6 private endpoints over ExpressRoute through a Virtual Network Routing Appliance (VNRA). ExpressRoute forwards traffic from on-premises IPv6 clients to the VNRA, which then routes the traffic to the target IPv6 private endpoint that's hosted by the Azure PaaS service.

This connectivity requires the following components:

• An ExpressRoute circuit with the appropriate gateway SKU for your connectivity type (FastPath or standard). For more information, see Create and modify an ExpressRoute circuit.

4.5 Virtual Network Routing Appliance (VNRA) configurations

To know more about VNRA, refer: Overview of Routing Appliances - Azure Virtual Network | Microsoft Learn

• We are leveraging VNRA to facilitate PL IPv6 ER traffic forwarding. User would be required to create a VNRA in the VNet.
• To facilitate the forwarding of PL IPv6 traffic via VNRA, a UDR would be required to be added in the gateway subnet with next hop as VNRA IPv6 address. Below are the guided steps to achieve all of this.

Step 1: Create a VNRA in the VNet

Create a VNRA in your resource group via Azure Preview portal.

1. Search for Azure Virtual Network routing appliance on the Azure portal search

2. Click on create:
   
3. In the above creation page, choose your subscription and resource group, enter name, region, capacity (10-200 Gbps) & the VNet.
4. Review and Create the VNRA.
   
   

Step 2: Create User Defined Route (UDR) to VNRA

The UDR will ensure ER PLIPv6 traffic is forwarded to VNRA which will further process & forward the traffic to the IPv6 Private Endpoint.

1.Create a new route table on Azure portal:

2. Choose the subscription, resource group and set ‘Gateway propagation’ as default (true)

3. Add a route in this route table to forward the on-prem PLIPv6 traffic to VNRA (for this please add route as shown in reference below) as per below details:

• Enter ‘Destination type’ as ‘IP Address’
• Enter ‘Destination IP addresses/CIDR Ranges’ as Private Endpoint IPv6 subnet range - This is the subnet on which your Private Endpoint resides to which the traffic would be sent
• Enter ‘Next hop’ as “Virtual Appliance”,
• Give the ‘Next hop address’ as the IPv6 address of VNRA
  
  

4.Attach this route table to the Gateway subnet

This completes the VNRA setup.

5. Validate Connectivity

After establishing configuration and deploying your setup, you can run following validations:

From OnPrem VM:

• Perform DNS lookup on PaaS FQDN → confirm IPv6 PE resolution
• Connect using PaaS FQDN

Validation Checks

• VM → PE connectivity over IPv6
• Data plane traffic successful

6. Preview Considerations

• Limited regional availability (Check preview regions above)
• Destination PaaS resource must be in the same region as the Private Endppint. Cross region connectivity is not supported in this release.
• Limited PaaS onboarding (Azure Storage, Azure SQL, Azure Key Vault, Azure Data Explorer)
• Current on-premises connectivity support is limited to ExpressRoute-based scenarios and does not currently include VPN, Virtual WAN (vWAN), or Network Virtual Appliances (NVAs).
• In Private Link IPv6 scenarios, the original client IPv6 address is not preserved in downstream service logs. Due to implicit NAT translation, logs will display the VNet-side translated source IP address instead.

Link to Azure documentation: Configure Azure Private Link over IPv6 (Preview) - Azure Private Link | Microsoft Learn