Azure Private Link for Elastic Cloud Serverless is now generally available

When you associate an Azure Private connection policy with a Serverless project, traffic between your Azure Virtual Network and Elastic travels entirely within Azure's network fabric. The public Elastic endpoints remain resolvable, but once a policy is attached, any request that does not arrive through a matching private endpoint or IP filter is rejected with 403 Forbidden. There is no separate "private endpoint only" toggle; the policy attachment itself enforces the access boundary.

The connection runs through an Azure private endpoint in your VNet. Elastic hosts a Private Link service on our side; you create the private endpoint in your subscription, and Elastic auto-approves it when your VNet is whitelisted by a policy you create. All data — ingestion, search, and Kibana — travels through that private path.

On Azure, a private connection policy is required (not optional). The policy carries the resource IDs of the private endpoints you want to admit, and Elastic uses it to auto-approve connection requests. This differs from AWS, where the policy is optional, and you can approve connections manually.

Private connectivity for Serverless is included in the following tiers at no additional charge and is effective August 4, 2026:

• Observability Serverless projects: require Observability Complete

• Security Serverless projects: require Security Analytics Complete

• For other project types, such as Elasticsearch Serverless projects, the feature is available with no tier requirement.

Projects created before August 4, 2026 are grandfathered regardless of tier. Any Serverless project created before that date can use traffic filtering — both private connections and IP filters — without restriction for the project's lifetime. This applies even if the project is not currently using traffic filtering; projects created before the cutoff date can configure it at any time.

If you upgrade an observability or security project to the Complete tier after August 4, the platform automatically applies your default network security policies to the newly eligible project — no manual reconfiguration needed.

Gating is enforced in both the Elastic Cloud Console UI and the API. Projects that do not meet the tier requirement and were created on or after August 4 will not have the option to associate a private connection or IP filter policy.

Does Azure Private Link also work for Elastic Cloud Hosted deployments?
Azure Private Link for Hosted deployments has been available via a separate API. This release covers Elastic Cloud Serverless specifically.

Can I use both an IP filter and a Private connection policy on the same project?
Yes. Each request must match at least one attached policy. A private-endpoint connection matches the Private connection policy; traffic from a listed IP range matches the IP filter. Traffic matching neither is rejected.

Is a policy required on Azure to secure a private connection?
Yes, for Azure Private Link, you must create a policy in Elastic Cloud Console and add your private endpoint’s Resource name and Resource ID before Elastic will approve the connection. This differs from AWS, where the policy is optional. Associating the policy with specific projects is optional and only needed if you want to filter the traffic coming from specific private endpoints.

Do I need a separate endpoint per project or per solution type?
One private connection policy referring to your Azure private endpoint can be attached to multiple projects. Each Serverless project has its own private hostname that uses a private connection. See the documentation for the per-endpoint configuration details.