The connection stays within an organization's virtual network, or "VNet" (see diagram): [Click on image for larger view.] Private connection to Azure services using Azure Private Link.