Merge pull request #220491 from duongau/afdprivatelink

Front Door - add endpoints section to Private Link concept

Author: Stacyrch140

articles/frontdoor/media/private-link/delete-endpoint.png

@@ -6,7 +6,7 @@ documentationcenter: ''
 author: duongau
 ms.service: frontdoor
 ms.topic: conceptual
-ms.date: 03/30/2022
+ms.date: 12/05/2022
 ms.author: duau
 ms.custom: references_regions
 ---
@@ -17,7 +17,7 @@ ms.custom: references_regions
 
 Azure Front Door Premium can connect to your origin using Private Link. Your origin can be hosted in a virtual network or hosted as a PaaS service such as Azure App Service or Azure Storage. Private Link removes the need for your origin to be access publicly.
 
-:::image type="content" source="./media/concept-private-link/front-door-private-endpoint-architecture.png" alt-text="Diagram of Azure Front Door with Private Link enabled.":::
+:::image type="content" source="./media/private-link/front-door-private-endpoint-architecture.png" alt-text="Diagram of Azure Front Door with Private Link enabled.":::
 
 ## How Private Link works
 
@@ -32,7 +32,64 @@ After you enable an origin for Private Link and approve the private endpoint con
 
 Once your request is approved, a private IP address gets assigned from the Azure Front Door managed virtual network. Traffic between your Azure Front Door and your origin will communicate using the established private link over the Microsoft backbone network. Incoming traffic to your origin is now secured when arriving at your Azure Front Door.
 
-:::image type="content" source="./media/concept-private-link/enable-private-endpoint.png" alt-text="Screenshot of enable Private Link service checkbox from origin configuration page.":::
+:::image type="content" source="./media/private-link/enable-private-endpoint.png" alt-text="Screenshot of enable Private Link service checkbox from origin configuration page.":::
+
+## Association of a private endpoint with an Azure Front Door profile
+
+### Private endpoint creation
+
+Within a single Azure Front Door profile, if two or more Private Link enabled origins are created with the same set of Private Link, resource ID and group ID, then for all such origins only one private endpoint gets created. Connections to the backend can be enabled using this private endpoint. This setup means you only have to approve the private endpoint once because only one private endpoint gets created. If you create more Private Link enabled origins using the same set of Private Link location, resource ID, group ID, you won't need to approve anymore private endpoints.
+
+#### Single private endpoint
+
+For example, a single private endpoint gets created for all the different origins across different origin groups but in the same Azure Front Door profile as shown in the below table:
+
+:::image type="content" source="./media/private-link/single-endpoint.png" alt-text="Diagram showing a single private endpoint created for origins created in the same Azure Front Door profile.":::
+
+#### Multiple private endpoints
+
+A new private endpoint gets created in the following scenario:
+
+* If the region, resource ID or group ID changes:
+
+    :::image type="content" source="./media/private-link/multiple-endpoints.png" alt-text="Diagram showing a multiple private endpoint created because changes in the region and resource ID for the origin.":::
+
+    > [!NOTE]
+    > The Private Link location and the hostname has changed, resulting in extra private endpoints created and requires approval for each one.
+
+* When the Azure Front Door profile changes:
+
+    :::image type="content" source="./media/private-link/multiple-profiles.png" alt-text="Diagram showing a multiple private endpoint created because the origin is associated with multiple Azure Front Door profiles.":::
+
+    > [!NOTE]
+    > Enabling Private Link for origins in different Front Door profiles will create extra private endpoints and requires approval for each one.
+
+### Private endpoint removal
+
+When an Azure Front Door profile get deleted, private endpoints associated with the profile will also get deleted. 
+
+#### Single private endpoint
+
+If AFD-Profile-1 gets deleted, then PE1 private endpoint across all the origin will also get deleted.
+
+:::image type="content" source="./media/private-link/delete-endpoint.png" alt-text="Diagram showing if AFD-Profile-1 gets deleted then PE1 across all origins will get deleted.":::
+
+#### Multiple private endpoints
+
+* If AFD-Profile-1 gets deleted, all private endpoints from PE1 through PE4 will get deleted.
+ 
+    :::image type="content" source="./media/private-link/delete-multiple-endpoints.png" alt-text="Diagram showing if AFD-Profile-1 gets deleted, all private endpoints from PE1 through PE4 gets deleted.":::
+
+* Deleting a Front Door profile won't affect private endpoints created for a different Front Door profile. 
+
+    :::image type="content" source="./media/private-link/delete-multiple-profiles.png" alt-text="Diagram showing Azure Front Door profile getting deleted won't affect private endpoints in other Front Door profiles.":::
+
+    For example:
+    
+    * If AFD-Profile-2 gets deleted, only PE5 will be removed.
+    * If AFD-Profile-3 gets deleted, only PE6 will be removed.
+    * If AFD-Profile-4 gets deleted, only PE7 will be removed.
+    * If AFD-Profile-5 gets deleted, only PE8 will be removed.
 
 ## Region availability