update

function azure portal limitation
dns for scm
slots are not protected

Author: Ericgre

articles/app-service/networking/private-endpoint.md

@@ -4,7 +4,7 @@ description: Connect privately to a Web App using Azure Private Endpoint
 author: ericgre
 ms.assetid: 2dceac28-1ba6-4904-a15d-9e91d5ee162c
 ms.topic: article
-ms.date: 03/18/2020
+ms.date: 05/12/2020
 ms.author: ericg
 ms.service: app-service
 ms.workload: web
@@ -61,12 +61,20 @@ In the Web HTTP logs of your Web App, you will find the client source IP. This i
 As this feature is in preview, we don't change the DNS entry during the preview. You need to manage the DNS entry in your private DNS server or Azure DNS private zone yourself.
 If you need to use a custom DNS name, you must add the custom name in your Web App. During the preview, the custom name must be validated like any custom name, using public DNS resolution. See [custom DNS validation][dnsvalidation] for more information.
 
+If you need to use the Kudu console, or Kudu REST API (deployement with Azure DevOps for example), you need to create two records in your Azure DNS private zone or your custom DNS server. 
+- PrivateEndpointIP yourwebappname.azurewebsites.net 
+- PrivateEndpointIP yourwebappname.scm.azurewebsites.net 
+
 ## Pricing
 
 For pricing details, see [Azure Private Link pricing][pricing].
 
 ## Limitations
 
+When you use Azure Function in Elastic Premium Plan with Private Endpoint, you cannot run or execute the function in Azure Web portal, you must have direct network access in order to run your app or you will recieve an HTTP 403 error. 
+
+During the preview only the production slot is exposed behind the Private Endpoint, other slots are reachable by Public Endpoint only.
+
 We are improving Private Link feature and Private Endpoint regularly, check [this article][pllimitations] for up-to-date information about limitations.
 
 ## Next steps