Azure Private Endpoints are network interfaces that provide private connectivity from a virtual network to Azure PaaS services such as Storage Accounts, SQL Databases, or Key Vaults. When the target service behind a private endpoint is deleted, migrated, or replaced, the private endpoint itself is not automatically removed. Instead, it transitions to a disconnected state and persists as an orphaned network resource that continues to incur hourly charges. Because private endpoints are network-layer resources managed separately from the application resources they connect to, they are frequently overlooked when services are decommissioned — particularly when the service owner and the network owner are different teams.

This pattern is especially common in development and testing environments where resources are created and destroyed frequently, but networking components are not consistently cleaned up as part of the resource lifecycle. It also occurs during production migrations, service replacements, or architecture changes. Over time, these orphaned endpoints accumulate silently — occupying private IP addresses in subnets, contributing to IP address exhaustion, and generating ongoing charges with no functional benefit. Because each private endpoint maps to a specific target resource and subresource (for example, separate endpoints are required for blob versus file storage on the same storage account), even a single decommissioned service can leave behind multiple orphaned endpoints.