The complete list of groupIds for private endpoint & privatelink service connection


When creating a private link using ARM or Bicep, you need to specify a few settings, one of which are groupId for the privateLinkServiceConnections of the resource type you are connecting it to.  You can’t omit this value and it has to be exactly correct in order for the deployment to succeed, it is even case sensitive.


resource myPrivateEndpoint 'Microsoft.Network/privateEndpoints@2022-09-01' = {
name: '${webAppName}-privateendpoint'
location: location
properties: {
  subnet: {
    id: resourceId(networking.vNetResourceGroup, 'Microsoft.Network/virtualNetworks/subnets', networking.existingVNetName, privateLinkSubnet)
  privateLinkServiceConnections: [
      name: '${appService}-privateLink'
      properties: {
        groupIds: [
dependsOn: [

I have scoured the earth to find a list of them, the documentation of private endpoint bicep helpfully states that it is a ‘string’, but leaves out the values for the different resource types that you can connect to. This is all the documentation tells you:


Name Description Value
groupId The ID of a group obtained from the remote resource that this private endpoint should connect to. string
Name Description Value
groupIds The ID(s) of the group(s) obtained from the remote resource that this private endpoint should connect to. string[]

There’s also a number of examples that helps find the groupid for sql, blob, table sites and a few more. But every time you need it for a new bicep, you have to look and look for the correct value.

Today, I spent some time not giving up, I started collecting every groupid I could find in a list, and after finding maybe 15 different ones, I got real lucky. Via a series of related searches I got to the key word ‘ListSupportedPrivateLinkResources’. This took me to a public GitHub repo named ‘Private Endpoint Overview’. A bit down on this page, there is a table called ‘private link resource’. This lists in turn: Private-link resource name, Resource type & Subresources. Subresources is the goldmine!

This is the (complete?) list of resource types that can have a Private Endpoint and their groupid’s

Private-link resource name Resource type Subresources
Azure App Configuration Microsoft.Appconfiguration/configurationStores configurationStores
Azure Automation Microsoft.Automation/automationAccounts Webhook, DSCAndHybridWorker
Azure Cosmos DB Microsoft.AzureCosmosDB/databaseAccounts SQL, MongoDB, Cassandra, Gremlin, Table
Azure Batch Microsoft.Batch/batchAccounts batchAccount, nodeManagement
Azure Cache for Redis Microsoft.Cache/Redis redisCache
Azure Cache for Redis Enterprise Microsoft.Cache/redisEnterprise redisEnterprise
Azure Cognitive Services Microsoft.CognitiveServices/accounts account
Azure Managed Disks Microsoft.Compute/diskAccesses managed disk
Azure Container Registry Microsoft.ContainerRegistry/registries registry
Azure Kubernetes Service – Kubernetes API Microsoft.ContainerService/managedClusters management
Azure Data Factory Microsoft.DataFactory/factories dataFactory
Azure Data Explorer Microsoft.Kusto/clusters cluster
Azure Database for MariaDB Microsoft.DBforMariaDB/servers mariadbServer
Azure Database for MySQL Microsoft.DBforMySQL/servers mysqlServer
Azure Database for PostgreSQL – Single server Microsoft.DBforPostgreSQL/servers postgresqlServer
Azure Device Provisioning Service Microsoft.Devices/provisioningServices iotDps
Azure IoT Hub Microsoft.Devices/IotHubs iotHub
Azure IoT Central Microsoft.IoTCentral/IoTApps IoTApps
Azure Digital Twins Microsoft.DigitalTwins/digitalTwinsInstances API
Azure Event Grid Microsoft.EventGrid/domains domain
Azure Event Grid Microsoft.EventGrid/topics topic
Azure Event Hub Microsoft.EventHub/namespaces namespace
Azure HDInsight Microsoft.HDInsight/clusters cluster
Azure API for FHIR (Fast Healthcare Interoperability Resources) Microsoft.HealthcareApis/services fhir
Azure Key Vault HSM (hardware security module) Microsoft.Keyvault/managedHSMs HSM
Azure Key Vault Microsoft.KeyVault/vaults vault
Azure Machine Learning Microsoft.MachineLearningServices/workspaces amlworkspace
Azure Migrate Microsoft.Migrate/assessmentProjects project
Application Gateway Microsoft.Network/applicationgateways application gateway
Private Link service (your own service) Microsoft.Network/privateLinkServices empty
Power BI Microsoft.PowerBI/privateLinkServicesForPowerBI Power BI
Microsoft Purview Microsoft.Purview/accounts account
Microsoft Purview Microsoft.Purview/accounts portal
Azure Backup Microsoft.RecoveryServices/vaults AzureBackup, AzureSiteRecovery
Azure Relay Microsoft.Relay/namespaces namespace
Azure Cognitive Search Microsoft.Search/searchServices searchService
Azure Service Bus Microsoft.ServiceBus/namespaces namespace
Azure SignalR Service Microsoft.SignalRService/SignalR signalr
Azure SignalR Service Microsoft.SignalRService/webPubSub webpubsub
Azure SQL Database Microsoft.Sql/servers SQL Server (sqlServer)
Azure Storage Microsoft.Storage/storageAccounts Blob (blob, blob_secondary)
Table (table, table_secondary)
Queue (queue, queue_secondary)
File (file, file_secondary)
Web (web, web_secondary)
Dfs (dfs, dfs_secondary)
Azure File Sync Microsoft.StorageSync/storageSyncServices File Sync Service
Azure Synapse Microsoft.Synapse/privateLinkHubs web
Azure Synapse Analytics Microsoft.Synapse/workspaces Sql, SqlOnDemand, Dev
Azure App Service Microsoft.Web/hostingEnvironments hosting environment
Azure App Service Microsoft.Web/sites sites
Azure Static Web Apps Microsoft.Web/staticSites staticSites
Azure Media Services Microsoft.Media/mediaservices keydelivery, liveevent, streamingendpoint
Resource Management Private Links Microsoft.Authorization/resourceManagementPrivateLinks ResourceManagement
Azure Databricks Microsoft.Databricks/workspaces databricks_ui_api, browser_authentication
Azure Monitor Private Link Scope Microsoft.Insights/privatelinkscopes azuremonitor
Happy deployment!


Private Endpoint Overview (GitHub) (Go here in case there are updates…)





 Thomas Odell Balkeståhl on LinkedIn


Export all data from Azure Cosmos DB for MongoDB to file for archiving


If you want to export all data from a MongoDB in Azure, then you have come to the right place.

Maybe there is a better way, but I could not find it. Azure data studio allows me to connect, and in a query to the collection get data, but it only gets me about 30 items at the time, so copy paste from the results in not realisitc.

This procedure, is done on a WIndows environment, with internet connectivity, the MongoDB does not have any IP restrictions, if it does, you would have to fix connectivity first. I guess a good test can be to connect using the Azure Data Studio.

Here it goes!


mongoexport /h /u mymongodbaccount /p "RANDOMCHARACTERSRANDOMCHARACTERSRANDOMCHARACTERSRANDOMCHARACTERSRANDOMCHARACTERS==" /ssl /d myDatabase /c myDataCollection /o c:\Temp\myDataCollection.json --authenticationDatabase "admin"

Broken down, this command has the following components:


command line .exe tool that is part of the mongodb database tools package that is a free download from, see link in the reference section


host, the complete path including the port to your MongoDB in Azure. You will find this string in the connection string section in the Azure portal

/u mymongodbaccount

User, this is the name of the Cosmos DB for MongoDB account, also the first section of the host string.


Password, this is also find in the connection string section (I could be wrong here, I deleted all my DB’s before creating this post…if not here, then its in a different section in the portal, it IS there though)


LTS/SSL/Https, secure encrypted connection

/d myDatabase

Database, the database name where you are exporting from

/c myDataCollection

Collection, the name of the collection you are exporting from. The file will contain all data from this collection in json format

/o c:\Temp\myDataCollection.json

Output/target file, put it anywhere locally on your computer

–authenticationDatabase “admin”

This is required for the auth using the account + password to work


The result, when executed in a CMD prompt looks like this:



If you have more than one collection, in more than one mongoDB, then you will have to run the command again and again, remember though to change the output filename.

Happy exporting!






 Thomas Odell Balkeståhl on LinkedIn

List all changes made in your Azure environment in one query using Azure Resource Graph


The kusto query below is using the new ResourceChanges resource, and will give you a list of all changes made in your Azure environment, create, update, delete, automatic or manual, it will all be there. (Where you have access).
This is a great way to keep track of what is happening in and to your environment.

You will get the following info from each change made:

Subcription Name

This list can get pretty long, so it can be a good idea to filer and sort a bit. Especially on the timeframe (in the sample query, it is set to 7 days).
Filter can be applies to subscription, dates, resource groups, resource name, type, etc.

| where resourceGroup contains “production”
Will give you only the changes made to RG’s with production in the name.

| where resourceType = “virtualMachines”
Will give you only the changes made to resources of type Virtual Machine.

Open the Azure portal, find ‘Azure Resource Graph Explorer’, then paste the following query in the query windows and hit run.

| join kind=inner
   | where type == 'microsoft.resources/subscriptions'
   | project subscriptionId, subscriptionName = name)
   on subscriptionId
| extend changeTime = todatetime(properties.changeAttributes.timestamp), targetResourceId = tostring(properties.targetResourceId),
changeType = tostring(properties.changeType), correlationId = properties.changeAttributes.correlationId,
changedProperties = properties.changes, changeCount = properties.changeAttributes.changesCount
| extend resourceName = tostring(split(targetResourceId, '/')[-1])
| extend resourceType = tostring(split(targetResourceId, '/')[-2])
| where changeTime > ago(7d)
// Change the time span as preferred, 1d(1 day/24h), 7d, 30d...
| where subscriptionName contains "DevTest" // "" for all subscriptions
| order by changeType asc, changeTime desc
// Change what you sort by as prefered, type, time, subscriptionName, etc.
| project changeTime, resourceName, resourceType, resourceGroup, changeType, subscriptionName, subscriptionId, targetResourceId, 
correlationId, changeCount, changedProperties
As this is a functionality in public preview at the time of posting, the following applies:

Resource configuration changes is in Public Preview and only supports changes to resource types from the Resources table in Resource Graph. This does not yet include changes to the resource container resources, such as Management groups, Subscriptions, and Resource groups.

Happy resource mining!





 Thomas Odell Balkeståhl on LinkedIn