{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-16T07:59:18.009Z",
  "record_id": "VXI-EXT-PROCUREMENT-AZURE-PRIVATE-01-v1",
  "record_kind": "external_reference",
  "title": "Azure private endpoints: Public access and service targets remain separate",
  "system": "Azure Storage",
  "evidence_family": "vendor_evidence_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Does adding an Azure Storage private endpoint automatically disable public network access?",
  "near_questions": [
    "Does a private endpoint disable the storage public endpoint?",
    "Which storage service has an endpoint?",
    "Can Blob and DFS operations need separate endpoints?",
    "What address does the client resolve?",
    "Should the normal storage hostname remain in use?",
    "Do firewall rules govern private traffic identically?",
    "Which VNet is associated?",
    "Can custom DNS change the selected path?",
    "Does successful Blob access prove every service works?",
    "What evidence confirms public access is blocked?",
    "When should an agent avoid claiming complete network isolation?",
    "Can I save the Azure endpoint review?"
  ],
  "supported_claims": [
    {
      "claim": "The storage guide treats the private endpoint and public-endpoint access rules separately. Storage services need their applicable endpoints, and name resolution must reach the private address. An endpoint's existence alone does not prove all service traffic uses it or that public access is blocked.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent execution, completeness or security testing",
    "Vendor certification, legal compliance or guaranteed suitability"
  ],
  "public_summary": "The storage guide treats the private endpoint and public-endpoint access rules separately. Storage services need their applicable endpoints, and name resolution must reach the private address. An endpoint's existence alone does not prove all service traffic uses it or that public access is blocked.",
  "related_record_ids": [],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Azure Storage private endpoints",
    "source_url": "https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints",
    "checked_on": "2026-10-16",
    "candidate_record_id": "VXI-EXT-PROCUREMENT-AZURE-PRIVATE-01-v1",
    "candidate_record_sha256": "28c77ad9fa6ea659590a03eb5127c3902181d2758b0c25786e0f9275b7328c5e",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "The storage guide treats the private endpoint and public-endpoint access rules separately. Storage services need their applicable endpoints, and name resolution must reach the private address. An endpoint's existence alone does not prove all service traffic uses it or that public access is blocked.",
    "required_buyer_context": "Storage service, endpoint, DNS and public access settings. Effective buyer configuration and dated operational evidence are required.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "decision_profile": {
    "schema": "varexis-vendor-evidence-review/1",
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-16",
    "claim_to_check": "One private endpoint makes all storage services private-only.",
    "documented_statement": {
      "status": "documented",
      "statement": "The storage guide treats the private endpoint and public-endpoint access rules separately. Storage services need their applicable endpoints, and name resolution must reach the private address. An endpoint's existence alone does not prove all service traffic uses it or that public access is blocked.",
      "source_ids": [
        "azure-endpoint"
      ]
    },
    "buyer_evidence_required": [
      "Public network-access and firewall settings.",
      "Required service endpoints.",
      "DNS resolution from the actual caller."
    ],
    "review_condition": {
      "status": "varexis_review_policy",
      "statement": "Require service-specific network evidence before claiming private-only access."
    },
    "unknowns": "The buyer configuration, contract, effective entitlement and operational evidence have not been inspected. Missing evidence does not establish absence or failure of the feature.",
    "evidence_sources": [
      {
        "source_id": "azure-endpoint",
        "url": "https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints",
        "final_url": "https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints",
        "title": "Azure Storage private endpoints",
        "checked_on": "2026-10-16",
        "sha256": "02651a177ae102f9fcf92811b72af6020adca7c4950b46fa980b7a1593443fff",
        "bytes": 65843
      }
    ],
    "observed_deployment": false,
    "commercial_reliance_boundary": "Procurement evidence support only; no supplier clearance, legal conclusion, configuration audit or verification of the buyer's claim is supplied.",
    "paid_value": {
      "decision_context": "Keep the endpoint, DNS and public-access conditions behind a private-network claim.",
      "free": "Complete review, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "A saved purchase does not recheck the source or buyer configuration.",
      "specific_watch": "Storage service, endpoint, DNS and public access settings"
    }
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#azure-private-endpoint-public-access-evidence",
  "machine_readable_record": "/varexis-index/records/azure-private-endpoint-public-access-evidence.json"
}