I have a private endpoint connected to an App Service, but it unexpectedly disappeared last week. The activity log shows that the operation was initiated by Azure Traffic Manager and DNS, with the operation name "Delete Private Endpoint Connection Proxies." Has anyone seen this behavior before or identified the root cause? I recreated the private endpoint for now, but I'm concerned the deletion could happen again.
3 Answers
Azure Policy is worth investigating. A policy with a remediation task, deploy-if-not-exists effect, or a related governance automation could potentially modify networking resources. Look at policy compliance and remediation activity around the timestamp, along with the resource-group activity log.
If the endpoint is managed through infrastructure-as-code, check the deployment history and state file as well. A changed resource ID, renamed private endpoint, or a failed refresh could cause the tool to remove and recreate resources. The activity log should show the actual identity that performed the deletion, so compare that with the service principal or managed identity used by your deployment pipeline.
I’ve seen something similar, although in my case the private endpoint itself remained and only the DNS record was removed. I’d compare the activity logs for both the endpoint and the private DNS zone to determine exactly which resource was changed. Also check the operation’s caller and correlation ID for more detail.
If the deployment was responsible, I’d expect the activity log to show the service principal or managed identity rather than only a platform service name. Checking the caller, correlation ID, and nearby deployment events should help distinguish IaC from an Azure-side operation.