Your Sentinel AMA Logs & Queries Are Public by Default - AMPLS Architectures to Fix That

Good question GeorgT​ . Based on the current Microsoft guidance, the Sentinel Data Lake itself does not expose a dedicated Private Link/Private Endpoint configuration. It is a Microsoft-managed service, so you cannot directly attach a Private Endpoint to the Data Lake layer. 

For ingestion, Private Link is implemented at the Azure Monitor / Log Analytics Workspace and Data Collection Endpoint (DCE) layer through Azure Monitor Private Link Scope (AMPLS). This controls how data reaches Sentinel rather than the Data Lake itself. 

For queries, Azure Monitor supports restricting Log Analytics queries to originate via Private Link Scope. However, I have not found Microsoft documentation stating that Data Lake queries themselves have a separate Private Link endpoint or dedicated network path independent of the underlying Azure Monitor controls. 

Therefore, my current understanding is:

• Ingestion: Supported via AMPLS / Private Link to Log Analytics and DCEs. 
• Data Lake: No dedicated Private Endpoint for the Data Lake service itself. 
• Queries: Governed by Azure Monitor/Log Analytics private access controls rather than a Data Lake-specific Private Link configuration. 

Given that Sentinel Data Lake is still evolving, it may be worth getting confirmation from Microsoft on the exact networking behaviour for Data Lake exploration queries, but I have not found documentation showing a separate Data Lake Private Link capability.

Thanks

Prabhu