Scale Data Collection Endpoint private connectivity with IP Endpoint Compression - Preview

Mahesh_Sundaram

Microsoft

Oct 21, 2026

Monitoring 1,000+ resources? Your private network shouldn't become the bottleneck. DCE endpoint compression is designed to help organizations scale private telemetry collection more efficiently, reducing pressure on private IP address space while preserving the Azure Monitor architecture they already use.

Scale Azure Monitor Private Link with data collection endpoint IP compression

As organizations expand their Azure Monitor deployments, private networking needs to scale with them. For enterprises running large, distributed environments, that can create an increasingly important challenge: how do you grow private monitoring without consuming private IP address space at the same rate?

Azure Monitor is introducing private IP endpoint compression for data collection endpoints (DCEs) connected through Azure Monitor Private Link Scope (AMPLS).

This capability is designed to reduce the private IP footprint by ~90%-95% associated with DCEs while preserving the Azure Monitor Private Link architecture and the security controls customers already use.

The challenge: private monitoring at enterprise scale

Organizations often centralize Azure Monitor connectivity through carefully governed hub-and-spoke networks.

As these environments grow, they can include monitored resources, data collection rules (DCRs), DCEs, and Log Analytics workspaces distributed across multiple regions.

When private connectivity is required, DCEs are connected through AMPLS. The associated private endpoint uses addresses from a customer-managed subnet.

As more DCEs are added, this can increase the private IP footprint required for Azure Monitor connectivity and create challenges such as:

Increased subnet-capacity planning
Additional network-governance reviews
Delays when onboarding workloads or regions
Provisioning challenges when available subnet capacity becomes constrained
More operational complexity in centralized DNS and hub-and-spoke environments

As customers onboard more Azure resources to send telemetry over private networks, they need a scalable way to preserve valuable private IP address space without increasing the operational complexity of their network-isolated monitoring environment.

Introducing DCE private IP endpoint compression

DCE private IP endpoint compression changes how DCE service endpoints are represented behind an AMPLS private endpoint.

Instead of having the private IP footprint scale directly with every DCE, the compressed architecture groups compatible DCE service endpoints regionally and allows them to use a smaller, bounded set of private IP configurations.

Requests continue to be routed to the intended DCE based on the requested endpoint and the existing Azure Monitor authorization context.

The result is a more scalable private-network architecture without introducing a new data collection model.

What does this mean for customers?

Large enterprises have limited, tightly managed, often fragmented private IPv4 spaces. Private endpoints require IP addresses from customers' private IPv4 subnets. With private IP endpoint compression, all DCEs in a region share 3 regional private IPs. For example, 20 DCEs drop from 60 private IPs to 3, which is 95% fewer. Private IP address use stops growing with every DCE you add. There are no changes to how DCEs, DCRs, AMPLS, Azure Monitor Agent or Log Analytics work.

Use private address space more efficiently

A smaller, bounded private IP footprint can preserve valuable subnet capacity for additional workloads and Azure services.

This can be particularly useful for enterprises operating with constrained private IP address space or centralized network-allocation processes.

Make network planning more predictable

Instead of treating each additional DCE as a proportional increase in private IP requirements, network teams can plan capacity around the regional architecture. This approach makes the network planning more predictable for enterprise customers.

Scale monitoring across more workloads and regions

Reducing pressure on private IP address space can make it easier to expand monitoring across applications, subscriptions, and regions without repeatedly redesigning private endpoint subnets.

Reduce operational friction

A more compact endpoint representation can reduce the networking work associated with subnet capacity reviews, expansion planning, and Private Link onboarding.

What stays the same?

One of the goals of this design is to improve network scalability while preserving the Azure Monitor model customers already use.

DCE private IP endpoint compression doesn't change:

The role of AMPLS as the private Azure Monitor network boundary
The role of the private endpoint connecting a virtual network to AMPLS
AMPLS Open and Private Only access modes
DCR collection, transformation, and routing logic
Azure Monitor Agent configuration semantics
Log Analytics tables, retention, or KQL query behavior
The amount of telemetry ingested into Azure Monitor
Application Insights data collection, which doesn't use DCEs
Azure Monitor ingestion charges
Azure Private Link data-processing charges based on data volume

Customers should continue following their existing DNS, routing, network security, public network access, and AMPLS configuration requirements.

Preparing for the controlled preview

DCE private IP endpoint compression is currently intended for subscriptions participating in a controlled preview.

For customers participating in the preview, we recommend starting with a nonproduction or limited deployment.

Before expanding the deployment:

Map your topology. Understand the virtual networks, peering, AMPLS resources, private endpoints, DCEs, DCRs, workspaces, DNS zones, and supporting subnets involved.
Review DNS ownership. Pay particular attention to networks sharing Azure Monitor private DNS zones and use a deliberate AMPLS topology.
Establish a baseline. Record your existing private endpoint IP configurations and DCE DNS responses.
Confirm regional alignment. Review the relationship between monitored resources, DCE configuration access, ingestion endpoints, and destination workspaces.
Review access modes. Confirm the appropriate use of AMPLS Open or Private Only access modes for your security requirements.
Validate end to end. Verify DNS resolution, Azure Monitor Agent configuration access, DCR health, ingestion, transformation, and query behavior before expanding the deployment.

Looking ahead

Bottom line: DCE private IP endpoint compression is designed to make private Azure Monitor deployments easier to scale by reducing the relationship between DCE growth and private IP consumption, while preserving the Azure Monitor and AMPLS architecture customers use today.

Customers interested in participating in the controlled preview can contact the author via email with their subscription need to be allowlisted for the preview. This preview is available only to allowlisted subscriptions. To request access, submit your Azure subscription ID through the DCE IP Endpoint Compression preview onboarding form. Wait for Microsoft to confirm that your subscription is preview-enabled before you create the test DCEs. IP compression applies automatically to newly created DCEs in preview-enabled subscriptions. There's no additional setting to enable when you create a DCE or associate it with AMPLS. We look forward to helping customers scale private Azure Monitor deployments while making more efficient use of their network address space.