Strengthening data security with workspace-level private connectivity for custom endpoints for Eventstream (Preview)

Microsoft Employee

4 hours ago

Organizations that operate sensitive applications often keep them in networks with no route to the public internet. Applications in restricted networks need real-time analytics without a route to the public internet. Eventstream now supports workspace-level private links for custom endpoint sources (Preview), so those applications can send events to Microsoft Fabric over a private connection. Teams can bring sensitive operational data into real-time analytics without opening a public internet path for ingestion.

The change is especially useful for in-house applications, services, and gateways that do not have a managed Eventstream connector. They can publish directly to a custom endpoint source through the workspace’s private connection, bringing these workloads into the same private networking model as supported connector-based sources.

What is workspace-level private connectivity?

Private Link is a network security feature of the Fabric platform that provides a private connection between a virtual network and Fabric. Data traffic travels over the Microsoft backbone network instead of the public internet.

Workspace-level private links map an individual workspace to a virtual network, which makes it possible to restrict access to specific workspaces while other workspaces remain open to public access. Each workspace has its own private link service, and that service can accept connections from multiple virtual networks through separate private endpoints.

In the other direction, a single virtual network can connect to multiple workspaces by creating a private endpoint for each one. To reach a workspace over its private link, applications use a fully qualified domain name (FQDN) that is constructed from the workspace ID. When the FQDN resolves inside a virtual network that has a private endpoint for that workspace, it returns a private IP address, and the connection stays on the private network.

Eventstream integrates with workspace-level private links. When a private link is in place and public access is restricted, an eventstream in that workspace can be reached only from approved virtual networks. This means that any source sending data into the eventstream must communicate through the private link rather than over the public internet.

Why custom endpoint support matters

Eventstream provides managed connectors for sources such as Azure Event Hubs, Azure IoT Hub, Apache Kafka, MQTT, and database change data capture (CDC) sources. For an application without a managed connector, a custom endpoint source provides connection information for publishing events directly to an eventstream. Applications, services, or gateways can publish using supported Kafka or AMQP clients, or Azure Event Hubs SDKs.

In-house applications can run in restricted network segments where access to the public internet isn't permitted. Before this release, a team in that position had to allow a route to the public internet or keep the application outside of Eventstream. With private link support for custom endpoints, these applications can publish through a private endpoint, and the organization's network policy remains in place.

Workspace-level vs. tenant-level protection

Tenant-level private links provide private connectivity across a Fabric tenant. When public internet access is also blocked at the tenant level, supported workspaces and resources are reachable only through private connections. That scope suits organizations that require a tenant-wide restriction. In a mixed environment, however, some workspaces contain sensitive operational data while others need standard internet access. Blocking public access tenant-wide can prevent those legitimate access patterns and add administrative overhead.

Workspace-level private links address this by allowing protection to be scoped to individual workspaces. A security team can restrict the workspaces that hold regulated or operationally sensitive data while leaving the rest of the tenant’s workspaces open to public access. Each decision is independent: adding a private link to one workspace does not affect any other workspace. This makes workspace-level protection a better fit when the sensitivity of the data varies across teams, projects, or business units within the same tenant.

How the components fit together

A custom endpoint source and an Azure private endpoint serve different purposes: one receives events inside Eventstream, while the other provides the private network path. The workspace private link service connects that path to the target workspace.

The workspace private link service is a Fabric-side resource that maps a specific workspace to the Azure Private Link infrastructure. It is what makes a workspace eligible to receive private connections. Each workspace has its own private link service, and it is the anchor point that private endpoints connect to.

An Azure private endpoint is a network interface inside the customer’s virtual network. It is created in Azure and connected to the workspace’s private link service. Once in place, the private endpoint provides a private IP address that routes traffic from the virtual network to that workspace over the Microsoft backbone network. Multiple private endpoints in different virtual networks can connect to the same workspace, and a single virtual network can host private endpoints for multiple workspaces.

The custom endpoint source is the application-facing entry point inside Eventstream, not an Azure networking resource. It supplies the connection information an application uses to publish events with supported Kafka or AMQP clients, or Azure Event Hubs SDKs. With a workspace-level private link configured, the application’s traffic reaches that source through the Azure private endpoint over the Microsoft backbone network. This keeps the application-to-Eventstream ingestion path off the public internet.

Feature in action: A telecommunications example

Consider an illustrative scenario: a telecom operator monitors a mobile network with thousands of cell towers and connected devices. Each reports its status continuously. Faults, such as a tower losing power or a connection between sites going down, send messages to an in-house monitoring application running in the operator’s private network. The operations team needs to see these faults within seconds to respond before more customers lose service. In this scenario, governance policies prohibit public internet access from the monitoring application and require the receiving Fabric workspace to reject public traffic.

Without a supported private ingestion path to the custom endpoint, the operator in this scenario would need another way to deliver events. Opening a public internet route would require an exception to its network policy. A scheduled batch process could delay fault visibility, while a separate middleware layer would add infrastructure to maintain. The value of private custom endpoint support is avoiding a public-access exception or an additional relay solely to reach Eventstream.

With workspace-level private links configured, the monitoring application can send fault messages to the eventstream’s custom endpoint source through an Azure private endpoint, without crossing the public internet or using an additional relay solely for public network access. Eventstream can route the messages to an Eventhouse in preprocessing mode for querying live data by town or region. A cluster of tower faults can indicate a regional outage and help operations investigate while the incident is developing. A second copy can go to a Lakehouse for long-term analysis, where engineers can study months of fault history to inform capacity planning and maintenance schedules.

How it works

Before you begin, use a workspace assigned to a Fabric capacity (F SKU), enable the required workspace-level inbound network tenant setting, and confirm that you have workspace admin access and the necessary Azure permissions. Trial and Premium (P SKU) capacities are not supported. The following steps summarize the setup; use the linked guidance for the full procedure.

Configure workspace-level Private Link and connect the application's virtual network through an Azure private endpoint.
Create an eventstream with a custom endpoint source and configure the application with its connection information.
Validate the private network path, and then restrict public inbound access for the workspace.

Figure: Workspace inbound networking controls. For private-only access, configure workspace-level private links and deny public access without allowing public IP addresses.

Send events from the application and verify that they arrive through the private connection.

For the complete setup, including prerequisites and configuration options, refer to Set up and use workspace-level private links and Secure inbound connections with Tenant and Workspace Private Links.

Benefits of workspace-level private connectivity

Private link support for custom endpoints gives teams a way to stream data from their own applications while keeping that data off the public internet. Workspace-level private links restrict a single workspace while other workspaces remain open, so a team can secure the data that requires it without changing access for the rest of the organization.

The setup also adapts to the way an organization's networks are arranged. One workspace can be reached from several virtual networks, and one virtual network can reach several workspaces, which suits applications that are spread across different network segments. Applications can continue using supported clients over the private network path, without requiring an additional relay solely to provide public network access.

Once events arrive, teams can process and route them to supported destinations, including a Lakehouse or an Eventhouse in preprocessing mode. Private-link-enabled eventstreams have scenario restrictions: Eventhouse direct ingestion mode, Activator, and custom endpoint destinations are not supported. Review the supported scenarios before choosing a destination.

Get started

Some operational applications run in networks where public internet access is intentionally restricted. With private link support for custom endpoint sources, Eventstream can now bring events from those applications into Fabric while the network policy stays in place.

Ready to try the preview? Review the prerequisites and supported scenarios, then validate the private connection with a test application and a workspace on a supported Fabric capacity. Once events are flowing, route them to a supported destination, such as a Lakehouse or an Eventhouse in preprocessing mode, to begin exploring the data.