Azure HDInsight now supports private link integration in preview in all regions. you can now remove the public IPs and create fully isolated clusters in a VNET.
By using these new settings, you can also skip the inbound network security group (NSG) service tag rules for HDInsight management IPs. Learn more about how to create private clusters.