--- title: Private endpoints | Tiger Data Docs description: Connect your services to Azure Private Link endpoints to eliminate public internet exposure --- Tiger Cloud supports private connectivity through Azure Private Link. Once configured, applications in your Azure Virtual Network reach your service through a private endpoint on Microsoft's internal network, with no exposure to the public internet. This page walks you through provisioning the private endpoint in Azure, claiming it in Tiger Console, and attaching it to your service. ## Prerequisites for this procedure To follow these steps, you'll need: - A [Tiger Cloud service](/get-started/quickstart/create-service/index.md). * An [Azure account](https://azure.microsoft.com/en-gb/pricing/purchase-options/azure-account) with an active subscription. * [Permissions](https://learn.microsoft.com/en-us/azure/private-link/rbac-permissions) configured to create private endpoints. * An [Azure Virtual Network](https://learn.microsoft.com/en-us/azure/virtual-network/quickstart-create-virtual-network?tabs=portal) with a subnet for the resources you will connect to Tiger Cloud. ## Set up a private endpoint connection Take the following steps to connect your Tiger Cloud service to a Private Link endpoint. 1. **Copy the alias for your region** 1. In [Tiger Console](https://console.cloud.tigerdata.com/dashboard/azure-privatelink), select `Security` > `Private Endpoints` > `Manage endpoints`. 2. Under `Create the endpoint`, copy the `Alias` for the region in which you need to create the connection. Choose the region closest to your Azure resources for optimal performance. ![Copying the region alias in the Manage endpoints panel](/_astro/manage-private-endpoints-tiger-console.BLu4n2kT_1oyPW7.webp) ![Copying the region alias in the Manage endpoints panel](/_astro/manage-private-endpoints-tiger-console-dark.CZvz50Fb_ZOyRE5.webp) 2. **Create a private endpoint in Azure** 1. In [Azure Portal](https://azure.microsoft.com/en-us/get-started/azure-portal), go to `Private endpoints` and click `Create`. ![Create Azure Private Endpoint](/_astro/create-private-endpoint-azure.Dx-kiaPM_AmeyO.webp) ![Create Azure Private Endpoint](/_astro/create-private-endpoint-azure-dark.Cz8pjKNg_2abXyf.webp) 2. In `Subscription`, select the subscription that contains the resources you want to connect to Tiger Cloud. 3. In `Resource group`, select an existing resource group or create a new one for your private endpoint. 4. Provide a name for your endpoint. 5. Select the region where your Virtual Network is deployed, then click `Next: Resource`. 6. In `Connection method`, select `Connect to an Azure resource by resource ID or alias`. 7. In `Resource ID or alias`, paste the alias you have copied from Tiger Console. 8. Leave `Request message` empty, then click `Next: Virtual Network`. 9. Select the Virtual Network that contains the resources you want to connect to Tiger Cloud, then choose the subnet where the endpoint's private IP will be created. Optionally select an application security group, then click `Next: DNS`. 10. Optionally configure private DNS integration and tags for your endpoint, then click `Next: Review + create`. 11. Review your config and click `Create`. Azure creates your private endpoint. Wait for the deployment to succeed. 12. Go to your private endpoint's `Overview`. Once Tiger Cloud approves the connection, the connection status message reads `Connected. Claim this connection in the console using ID `. Copy this ID; you claim the connection with it. ![The connection status message on an Azure private endpoint](/_astro/private-endpoint-overview-azure.DX_qlMTf_ZCIMBs.webp) ![The connection status message on an Azure private endpoint](/_astro/private-endpoint-overview-azure-dark.Dq1PtslV_18pjl8.webp) Note Approval takes up to a few minutes. The ID is your endpoint's `resourceGuid`, so you can also read it from `JSON View` under `properties` if you prefer. 13. Go to `Private endpoints` and copy the private endpoint IP from the `Private IP` column. 3. **Claim the connection** 1. In [Tiger Console](https://console.cloud.tigerdata.com/dashboard/azure-privatelink) > `Security` > `Private Endpoints`, click `Manage endpoints`. 2. Under `Claim it`, paste the ID you copied into `Endpoint identifier`, then click `Claim connection`. Tiger Cloud links the connection to the project you are working in, and it appears in the list. ![Claiming a private endpoint connection with the endpoint identifier](/_astro/claim-private-endpoint-tiger-console-azure.CapDPXgI_Z1iewpj.webp) ![Claiming a private endpoint connection with the endpoint identifier](/_astro/claim-private-endpoint-tiger-console-azure-dark.BFovvjVu_TJww.webp) Note You can claim a private endpoint against one project only. 4. **Configure and attach** 1. Under `IP Address` click `Add IP` and paste the private endpoint IP address you have copied from Azure Portal. 2. Under `Services` click `Attach service`. Select your service from the dropdown and click `Attach`. You can attach a service to one private endpoint. ![A private endpoint connection with an IP address and an attached service](/_astro/private-endpoint-attached-tiger-console-azure.C6-D-4KM_Z22XMT8.webp) ![A private endpoint connection with an IP address and an attached service](/_astro/private-endpoint-attached-tiger-console-azure-dark.cAtElxAR_Z1TKIsY.webp) 3. From a VM inside your Azure VNet, connect to your service using a connection string with your [connection details](/integrate/find-connection-details/index.md). You should be able to connect successfully. ## Manage connections - To detach a service from a private endpoint connection, go to `Security` > `Private Endpoints`, expand the arrow in the `Services` column, and click the trash icon next to the service connection string. - To edit or remove an endpoint connection, go to `Security` > `Private Endpoints` and click the three dots next to the connection in the list. Select `Edit` or `Disconnect`, respectively. You need to detach all services from a private endpoint connection before deleting it.