Private Link provides private connectivity from a virtual network to Azure platform as a service (PaaS) services. It simplifies the network architecture and secures the connection between endpoints in Azure by eliminating data exposure to the public internet.
Use Private Link to connect to an Azure Cosmos DB account from your virtual network via a private endpoint (a set of private IP addresses in a subnet within the virtual network), then limit access to your Azure Cosmos DB account over these private IP addresses. When Private Link is combined with restricted network security group (NSG) policies, it helps reduce the risk of data exfiltration.