Powershell Resolve-DnsName not working when Private Endpoint enabled - azure

Question

I have an Azure storage account with public IP address and can resolve this name using both nslookup and Resolve-DnsName. Output below, truncated for brevity.
C:>nslookup stgweb.blob.core.windows.net
Name: blob.syd25prdstr01a.store.core.windows.net
Address: 20.60.72.36
Aliases: stgweb.blob.core.windows.net
Resolve-DnsName -Name stgweb.blob.core.windows.net
Name : blob.syd25prdstr01a.store.core.windows.net
QueryType : A
TTL : 60
Section : Answer
IP4Address : 20.60.72.36
When I create a private endpoint the private IP address resolves correctly from an Azure VM in both nslookup and Resolve-DnsName. But I can no longer resolve the public name from outside of Azure using Resolve-DnsName, but can using NSlookup.
C:>nslookup stgweb.blob.core.windows.net
Name: blob.syd25prdstr01a.store.core.windows.net
Address: 20.60.72.36
Aliases: stgweb.blob.core.windows.net
stgweb.privatelink.blob.core.windows.net
PS>Resolve-DnsName -Name stgweb.blob.core.windows.net
Resolve-DnsName: stgweb.blob.core.windows.net : DNS name does not exist.
But Resolve-DnsName will resolve the blob.syd25prdstr01a.store.core.windows.net name
PS>Resolve-DnsName -Name blob.syd25prdstr01a.store.core.windows.net
blob.syd25prdstr01a.store.core.windows.net A 60 Answer 20.60.72.36
Why is this, is there a way to get Resolve-DnsName to work correctly like NSlookup? Its not just storage accounts its anything with a private endpoint that fails.

Answer 1

• When you enable the private endpoint for a storage account, a private DNS zone is created with the name of ‘privatelink.blob.core.windows.net’ in which an ‘A’ host record is created for the storage account with a private IP address assigned as shown below: -
This is created along with a private NIC configuration as below wherein it is implied or deployed that the private DNS integration for the NIC created is associated with the storage account as well as with the private link created for it due to which when you are trying to resolve the FQDN of the storage account, i.e., ‘kartikbstor.blob.core.windows.net’, it will not be accessible since it is privately associated with the IP address in the virtual network associated. Therefore, only when you try to ‘nslookup’ for the ‘CNAME’ record created by you, i.e., ‘blob.syd25prdstr01a.store.core.windows.net’ after creating private endpoint, it is not accessible since the private link DNS configuration takes into effect after private endpoint creation.
• As the ‘nslookup’ from inside the Azure VM searches for the DNS entries in the respective virtual network’s private DNS zone only due to which the DNS ‘A’ record related to the private link are relayed back and the DNS resolution regarding it takes place. Similarly, when you hit the ‘Resolve-DNS’ command after creation of the private endpoint, this command tries to search for the ‘CNAME’ record, i.e., ‘blob.syd25prdstr01a.store.core.windows.net’ in the private DNS zone which is found but the public DNS name is not accessible any longer since its FQDN is no longer available in the private DNS zone created due to private link creation.
Therefore, when you create the private endpoint for a storage account, the public DNS entries are not accessible from inside the virtual network’s resources, i.e., Azure VM and instead are accessible from the public internet*.
For more detailed information, kindly refer to the below link: -
https://learn.microsoft.com/en-us/powershell/module/dnsclient/resolve-dnsname?view=windowsserver2022-ps