run-privatelink-demo

name

run-privatelink-demo

description

Drive the live five-beat Private Link demo for DATACON 2026, "Why Azure Is the Best Cloud for SQL" — Demo 3, the control plane is the security perimeter (Entra-only Azure SQL Hyperscale, a client VM whose managed identity is the server admin, and the private DNS zone that nobody links). USE WHEN the presenter says any of: "let's run demo 3", "start the private link demo", "run the control plane demo", "let's do the five beats", "walk me through demo 3", "next beat", "rehearse the private link demo", "pre-flight demo 3", "reset the demo", "is demo 3 ready", "what do I say at beat 4", "the VM query still works, is that right", or wants step-by-step help presenting the Private Link arc. Scope is RUN / REHEARSE / RESET the five beats ONLY. Do NOT use to provision, rename or re-region the environment (that's build-privatelink-demo), to run the Adventure Works SQL MCP demos, or to run the Ward General hyperscale demos — those are separate.

Run the Private Link demo (Demo 3)

Read presentations/dataconus2026/whyazurebest/demos/demo3_controlplane/README.md first. It holds the narration, the measured findings and the Learn quotes. Drive from it; do not invent beats.

Kit: presentations/dataconus2026/whyazurebest/demos/demo3_controlplane/. This skill assumes the environment already exists.

What the demo proves

A perimeter around a PaaS database is a control-plane property, not a firewall exercise. Five az commands take the database from publicly addressable to reachable only from inside the VNet — no firewall rule deleted, no VPN, no code change, no redeploy, no new connection string.

Then it lands the most common Private Link failure in production: endpoint right, zone right, A record right, still resolves public — because nobody linked the zone to the VNet.

Pre-flight — always, before the first beat

cd presentations/dataconus2026/whyazurebest/demos/demo3_controlplane
.\reset-demo.ps1     # rewinds beats 2, 3, 5; repoints RDP at the current public IP
.\05-verify.ps1      # must print 17/17 PASS, "Demo is in its Beat 1 state"
mstsc .\demo3.rdp    # sign in as demoadmin

Run scripts synchronously (isBackground: false, timeout: 0) and check the exit code — 05-verify.ps1 exits 1 if anything is out of place.

A new venue means a new egress IP, which breaks RDP. reset-demo.ps1 calls allow-me.ps1 for you; run it standalone if only RDP is broken.

reset-demo.ps1 re-enables public access first, and that order is load-bearing. With public access disabled, any attempt to add or edit a firewall rule is denied (Error 42101).

Two windows, and they never swap

Laptop terminal = control plane. RDP session = client. That split is the point. Say so at the start and keep both on screen the whole time.

The five beats

#	Window	Run	Expected
1	VM	.\query.ps1	Works over the public endpoint
2	Laptop	.\beat-2-add-privatelink.ps1	PE + zone + A record. No VNet link
2	VM	.\query.ps1	Still works — adding Private Link broke nothing
3	Laptop	.\beat-3-lockdown.ps1	publicNetworkAccess=Disabled, every firewall rule left in place
4	VM	.\query.ps1 -Expect Fail	Blocked — public access denied
4	VM	.\dns.ps1	Resolves a public address — the zone isn't linked
5	Laptop	.\beat-5-dns-link.ps1	VNet link created
5	VM	.\dns.ps1	Resolves 10.42.1.4
5	VM	.\query.ps1	Works again, privately

Drive one beat at a time: say which beat, give the command, wait for the result, confirm it matches, then ask before moving on.

Narration the presenter should not miss

• Beat 1 — query.ps1 prints SUSER_SNAME(), so the audience sees the managed identity connect. No password exists anywhere on this server; SQL auth was off from birth. The 0.0.0.0 "Allow Azure services" rule is deliberately on — it is the anti-pattern the demo exists to kill.
• Beat 2 — the payoff is that nothing happens. Adding a private endpoint is additive and non-breaking.
• Beat 3 — read the firewall rules on screen. Every one survives. The rule bought nothing; disabling public access did all the work.
• Beat 4 — the big one. dns.ps1 shows public DNS already CNAMEs the server to its privatelink name. The VM is asking for exactly the right thing; it just has no private zone to answer with. That is Learn's number-one cause, live.
• Beat 4 — say this out loud: Test-NetConnection -Port 1433 reports TcpTestSucceeded : True even with public access disabled. The TCP handshake to the gateway still completes; rejection happens at login. Nobody should use Test-NetConnection as proof a database is locked down.
• "But I can still resolve the name" — yes. Resource existence is enumerable; resource access is not. Beat 4 is the proof.

Do not read numbers off the slide

The private address (10.42.1.4) and the topology are real and pinned. The public-side addresses are deliberately not — the gateway varies by region and round-robins between rehearsals. Read the tail of the CNAME chain off the screen. Likewise, do not quote a specific login error number; read the message that appears.

Recovery

Symptom	Do this
Beat 5 dns.ps1 still shows a public IP	Run it once more. The link takes seconds to propagate; Clear-DnsClientCache is already in the script
Beat 4 shows a private IP	The VNet link already existed — Beat 2 must not create it. Run reset-demo.ps1; 05-verify.ps1 fails if it finds a link
Beat 2 says "already exists" but the A-record list is empty	It created nothing. Verify by side effect, not by the message
RDP won't connect	.\allow-me.ps1
VM unreachable but ARM works	Invoke-VmScript from 00-config.ps1 goes through ARM, not the VNet
VM query fails against a server that doesn't exist	vmkit/config.ps1 drifted from 00-config.ps1. Fix both, .\push-vmkit.ps1

Edited anything under vmkit/? Re-push it. The VM runs its own copy in C:\demo.

Between rehearsals, and when you finish

.\reset-demo.ps1
.\05-verify.ps1

Always leave the environment at Beat 1, 17/17 PASS. Never walk away with publicNetworkAccess=Disabled still set — the next pre-flight will fail with Error 42101 before it can fix itself.

Deallocate the VM between rehearsals. Serverless Hyperscale bills per second and does not auto-pause; that's General Purpose only.