Service Endpoint — There is no additional cost for using VNet service endpoints. Private Link — It costs can quickly grow depending on total ingress and egress traffic and runtime of the link. Both services are not available for all resources/services. See the complete list for Service Endpoints and Private Link.Is it possible to make a private VNET connection?
You could use VNet peering and connect to the consumer’s VNet to make it private, but it is not scalable and will soon run into IP address conflicts.What is Azure private link (private endpoint)?
Azure Private Link (Private Endpoint) allows you to access Azure PaaS services over Private IP address within the VNet. It gets a new private IP on your VNet. When you send traffic to PaaS resource, it will always ensure traffic stays within your VNet.What is the difference between NSG’s and private link?
For example, if you wanted to, you could use NSG’s to block access to all Azure SQL databases and then use Private Link to grant access only to your specific Azure SQL Server. Unlike Service Endpoints, Private Link allows access from resources on your on-premises network through VPN or ExpressRoute, and from peered networks.