{"id":59582,"date":"2026-11-05T17:02:08","date_gmt":"2026-11-05T07:02:08","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/05\/modernise-postgresql-private-endpoints-without-rebuilding-apps\/"},"modified":"2026-11-05T17:03:38","modified_gmt":"2026-11-05T07:03:38","slug":"modernise-postgresql-private-endpoints-without-rebuilding-apps","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/05\/modernise-postgresql-private-endpoints-without-rebuilding-apps\/","title":{"rendered":"Modernise PostgreSQL Private Endpoints Without Rebuilding Apps"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post Modernise PostgreSQL Private Endpoints Without Rebuilding Apps we will explain how organisations can improve Azure database networking without copying data into a new server or redesigning every connected application.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">Many businesses have an Azure Database for PostgreSQL Flexible Server that works reliably but is tied to an older network design. Changing that design previously meant considering a second server, data migration, application cutover and a rollback plan\u2014all to solve a networking problem.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As of November 2026, Microsoft supports an in-place change from virtual network integration to a configuration that supports private endpoints. This can remove much of the rebuilding work, but it is not a zero-risk button. DNS, routing, application dependencies and a short service interruption still need careful planning.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What has changed for PostgreSQL Flexible Server<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Azure Database for PostgreSQL Flexible Server is Microsoft&#8217;s managed version of the PostgreSQL database. Microsoft handles the underlying infrastructure, backups, patching and optional high availability, while your team remains responsible for the data, application and network design.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Many existing servers use virtual network integration. In plain English, the database is placed inside a dedicated section of your Azure network called a delegated subnet. This provides private access, but it also connects the database closely to that particular network structure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The newer option uses Azure Private Link and private endpoints. A private endpoint gives the database a private IP address inside a network you control, allowing approved applications to reach it without exposing the connection to the public internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft now allows eligible VNet-integrated servers to change to a private endpoint-capable configuration in place. The database server and its existing backups are retained, avoiding a full data migration solely to modernise the network.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How the private endpoint technology works<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A private endpoint is effectively a secure network doorway to one specific Azure service. It creates a network interface with a private IP address in your chosen subnet, then maps that interface to your PostgreSQL server through Azure Private Link.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Traffic travels across Microsoft&#8217;s private backbone rather than taking a normal public internet route. Applications in connected Azure networks\u2014or in an office or data centre connected through a VPN or ExpressRoute\u2014can use that private path.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DNS is the part that makes this work without major application changes. DNS is the service that translates a database name into the IP address applications use to reach it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Your applications should continue using the PostgreSQL server&#8217;s full host name rather than a hard-coded IP address. Correctly configured private DNS then returns the private endpoint&#8217;s IP address to authorised networks. This means connection strings can usually remain unchanged even though the path behind them has changed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is also why DNS mistakes cause so many private endpoint outages. The endpoint may be healthy, but an application using the wrong DNS server can still be directed to an unreachable public address\u2014or fail to resolve the database name altogether.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why modernise if the current design still works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Separate the database from one network layout<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A VNet-integrated server depends on a delegated subnet. That can become restrictive when networks are consolidated, subscriptions are reorganised or applications move into a hub-and-spoke design, where several smaller networks connect through a central network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Private endpoints let the database service remain separate while access is provided through carefully selected networks. The business outcome is greater flexibility when modernising applications, completing an acquisition or separating production environments.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Avoid migration work that adds little business value<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Rebuilding a server can involve data replication, testing, cutover coordination and temporary duplicate infrastructure. It may also consume senior engineering time while creating a new source of operational risk.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An in-place network change reduces that scope. It does not remove the need for testing, but it can turn a database migration project into a controlled networking change.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Reduce unnecessary public exposure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">After the network configuration change, public access is disabled by default. Once private endpoints and DNS are working, applications can connect through private network paths without requiring broad internet-facing access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This does not automatically make the database secure. Strong identities, encryption, patching, monitoring and appropriate PostgreSQL permissions are still required. However, reducing the available network paths makes accidental exposure less likely.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Private access can also support Essential Eight discussions. Essential Eight is the Australian Government&#8217;s cybersecurity framework that many organisations use to improve security maturity. It does not specifically require PostgreSQL private endpoints, but limiting exposure and controlling access can strengthen the wider security and compliance position.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical business scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person software company with production applications, reporting tools and support systems connected to one PostgreSQL Flexible Server. The server was originally placed in a delegated subnet, but the company now wants to centralise connectivity through an Azure hub network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Under the previous approach, the team might have created a replacement PostgreSQL server, copied the databases, synchronised final changes and moved every application during a weekend cutover. That introduces data migration risk even though the database platform itself does not need replacing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With the in-place option, the company can focus on the actual requirement: changing how systems reach the existing server. It still needs a maintenance window, private endpoint deployment, DNS updates and application testing, but it avoids running and validating a second database platform.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The result is less project effort, fewer moving parts and a smaller chance of data differences appearing during cutover.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Plan the change as a controlled outage<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The conversion is irreversible. Once the server leaves the VNet-integrated model, it cannot simply be placed back into that delegated subnet. Treat the decision as an architecture change, not a routine portal setting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft advises that the overall update can take up to 20 minutes, with the database typically inaccessible for up to 10 minutes. Existing connections may be closed and new connections rejected during that period.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A safe plan should include these steps:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Map every dependency.<\/strong> Include applications, reporting platforms, integration services, monitoring tools, deployment pipelines, administrator workstations and logical replication subscribers.<\/li>\n<li><strong>Design the destination first.<\/strong> Decide which virtual network and subnet will contain the private endpoint, and confirm how other networks and on-premises systems will route to it.<\/li>\n<li><strong>Prepare private DNS.<\/strong> Confirm that Azure workloads, branch offices and remote administrators will resolve the PostgreSQL host name to the expected private IP address.<\/li>\n<li><strong>Agree on a maintenance window.<\/strong> Allow time for the network conversion, private endpoint configuration, approval, DNS propagation and application validation.<\/li>\n<li><strong>Test business transactions.<\/strong> A successful database login is useful, but it does not prove that ordering, payroll, reporting or customer-facing workflows operate correctly.<\/li>\n<li><strong>Update automation.<\/strong> Terraform, deployment templates, monitoring rules and recovery documents must reflect the new architecture.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For a deeper look at DNS and routing preparation, see our guide to moving PostgreSQL to Azure private endpoints without surprises.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Use simple tests before approving the change<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Run tests from every important network location, not just from an administrator&#8217;s virtual machine. The following examples check name resolution, port access and a real database query.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nslookup yourserver.postgres.database.azure.com\n\nTest-NetConnection yourserver.postgres.database.azure.com -Port 5432\n\npsql &quot;host=yourserver.postgres.database.azure.com port=5432 dbname=appdb sslmode=require&quot; \\\n -c &quot;SELECT current_database(), current_timestamp;&quot;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The DNS result should show the intended private path, port 5432 should be reachable, and the PostgreSQL query should complete using the normal application host name. Avoid changing applications to use the endpoint&#8217;s numeric IP address because that creates a fragile long-term dependency.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Do not overlook replication and recovery<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Existing backups, including previously captured geo-redundant backups, are retained through the network change. Even so, confirm backup health and document the recovery process before starting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Logical replication needs special attention. If the PostgreSQL server publishes changes to subscribers, those subscribers must be able to reach the new private endpoint through the same network, a peered network, VPN or ExpressRoute connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is also sensible to separate this work from a major PostgreSQL version upgrade. If both changes are necessary, use pre-upgrade checks to reduce PostgreSQL upgrade risk, then schedule each change independently so troubleshooting remains clear.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Modern networking without unnecessary rebuilding<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The biggest benefit is not simply that private endpoints are newer. It is that organisations can now improve network flexibility and reduce public exposure without automatically turning the work into a full database migration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The safest projects still begin with dependency discovery, DNS design and business-level testing. A short planned interruption is usually easier to manage than discovering after cutover that a reporting service, remote office or replication subscriber can no longer find the database.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc brings more than 20 years of enterprise IT experience to this type of work. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations connect Azure architecture, cybersecurity and practical operational planning without the overhead of a large, faceless provider.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your PostgreSQL server is tied to an ageing network design, or you are unsure whether private endpoints will simplify or complicate your environment, we are happy to review the current setup and identify the safest path forward\u2014no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Azure now offers a safer path from VNet-integrated PostgreSQL to private endpoints. Learn how to modernise network design while retaining your server, backups and application architecture.<\/p>\n","protected":false},"author":1,"featured_media":59584,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[16,19,13,127],"tags":[],"class_list":["post-59582","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-azure","category-azure-security","category-blog","category-cloud-security"],"jetpack-related-posts":[{"id":59542,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/11\/04\/moving-postgresql-to-azure-private-endpoints-without-surprises\/","url_meta":{"origin":59582,"position":0},"title":"Moving PostgreSQL to Azure Private Endpoints Without Surprises","author":"CPI Staff","date":"November 4, 2026","format":false,"excerpt":"Private endpoints can reduce PostgreSQL exposure, but poor DNS and routing design can cause outages. Learn how to plan a safe move for regulated Azure workloads.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/11\/moving-postgresql-to-azure-private-endpoints-without-surprises.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/11\/moving-postgresql-to-azure-private-endpoints-without-surprises.png 1x, \/wp-content\/uploads\/2026\/11\/moving-postgresql-to-azure-private-endpoints-without-surprises.png 1.5x, \/wp-content\/uploads\/2026\/11\/moving-postgresql-to-azure-private-endpoints-without-surprises.png 2x, \/wp-content\/uploads\/2026\/11\/moving-postgresql-to-azure-private-endpoints-without-surprises.png 3x, \/wp-content\/uploads\/2026\/11\/moving-postgresql-to-azure-private-endpoints-without-surprises.png 4x"},"classes":[]},{"id":58755,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance\/","url_meta":{"origin":59582,"position":1},"title":"Modernise Web Apps Without a Rewrite on Azure Managed Instance","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn when Azure App Service Managed Instance can move legacy Windows web apps off ageing servers without a costly rewrite while improving security, supportability and cost control.","rel":"","context":"In &quot;App Service&quot;","block_context":{"text":"App Service","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/app-service\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 1x, \/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 1.5x, \/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 2x, \/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 3x, \/wp-content\/uploads\/2026\/09\/modernise-web-apps-without-a-rewrite-on-azure-managed-instance.png 4x"},"classes":[]},{"id":59234,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/19\/private-networking-for-azure-databricks-serverless-made-simple\/","url_meta":{"origin":59582,"position":2},"title":"Private Networking for Azure Databricks Serverless Made Simple","author":"CPI Staff","date":"October 19, 2026","format":false,"excerpt":"Learn how to give Azure Databricks Serverless private access to data and internal systems while keeping deployment simple, costs visible and security controls practical.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/private-networking-for-azure-databricks-serverless-made-simple.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/private-networking-for-azure-databricks-serverless-made-simple.png 1x, \/wp-content\/uploads\/2026\/10\/private-networking-for-azure-databricks-serverless-made-simple.png 1.5x, \/wp-content\/uploads\/2026\/10\/private-networking-for-azure-databricks-serverless-made-simple.png 2x, \/wp-content\/uploads\/2026\/10\/private-networking-for-azure-databricks-serverless-made-simple.png 3x, \/wp-content\/uploads\/2026\/10\/private-networking-for-azure-databricks-serverless-made-simple.png 4x"},"classes":[]},{"id":58431,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/reduce-azure-postgresql-upgrade-risk-with-pre-upgrade-checks\/","url_meta":{"origin":59582,"position":3},"title":"Reduce Azure PostgreSQL Upgrade Risk with Pre-Upgrade Checks","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Azure PostgreSQL pre-upgrade validation finds compatibility problems before downtime begins, helping your team plan a safer major-version upgrade with fewer surprises.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/reduce-azure-postgresql-upgrade-risk-with-pre-upgrade-checks.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/reduce-azure-postgresql-upgrade-risk-with-pre-upgrade-checks.png 1x, \/wp-content\/uploads\/2026\/08\/reduce-azure-postgresql-upgrade-risk-with-pre-upgrade-checks.png 1.5x, \/wp-content\/uploads\/2026\/08\/reduce-azure-postgresql-upgrade-risk-with-pre-upgrade-checks.png 2x, \/wp-content\/uploads\/2026\/08\/reduce-azure-postgresql-upgrade-risk-with-pre-upgrade-checks.png 3x, \/wp-content\/uploads\/2026\/08\/reduce-azure-postgresql-upgrade-risk-with-pre-upgrade-checks.png 4x"},"classes":[]},{"id":58065,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-azure-virtual-network-integration-secures-hosted-ai-agents\/","url_meta":{"origin":59582,"position":4},"title":"How Azure Virtual Network Integration Secures Hosted AI Agents","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn how Azure Virtual Network integration limits AI agent exposure, controls access to business data, and reduces security and compliance risk.","rel":"","context":"In &quot;AI Agents&quot;","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 1x, \/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 1.5x, \/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 2x, \/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 3x, \/wp-content\/uploads\/2026\/07\/how-azure-virtual-network-integration-secures-hosted-ai-agents.png 4x"},"classes":[]},{"id":57972,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-azure-app-service-runs-business-applications-more-securely\/","url_meta":{"origin":59582,"position":5},"title":"How Azure App Service Runs Business Applications More Securely","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Azure App Service reduces server management, strengthens access controls and protects application data, helping Australian businesses run critical web applications with less risk and overhead.","rel":"","context":"In &quot;App Service&quot;","block_context":{"text":"App Service","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/app-service\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/07\/how-azure-app-service-runs-business-applications-more-securely.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/07\/how-azure-app-service-runs-business-applications-more-securely.png 1x, \/wp-content\/uploads\/2026\/07\/how-azure-app-service-runs-business-applications-more-securely.png 1.5x, \/wp-content\/uploads\/2026\/07\/how-azure-app-service-runs-business-applications-more-securely.png 2x, \/wp-content\/uploads\/2026\/07\/how-azure-app-service-runs-business-applications-more-securely.png 3x, \/wp-content\/uploads\/2026\/07\/how-azure-app-service-runs-business-applications-more-securely.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/11\/modernise-postgresql-private-endpoints-without-rebuilding-apps.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59582","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59582"}],"version-history":[{"count":2,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59582\/revisions"}],"predecessor-version":[{"id":59585,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59582\/revisions\/59585"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59584"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59582"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59582"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59582"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}