SaaS migration PART 2 - Private Links (AZURE, AWS) + encyption (BYOK, CMK)

Mizső — Wed, 14 Oct 2026 15:28:28 GMT

Hi Folks,

For most organizations (especially financial institutions), security policies mandate the use of private links and the encryption of data using their own keys in the cloud.

Dynatrace offers AWS Private Link (GA) and Azure Private Link (Preview - I hope it will be GA soon).

AWS Private Link (GA):

AWS Private Link is well documented: AWS PrivateLink — Dynatrace Docs

Azure Private Link (Preview):

Some advantages:

Monitoring traffic is always encrypted — Private Link adds an extra network-isolation layer
Reduces your Azure egress traffic costs since data stays within the Azure backbone
Provides more stable and predictable connectivity compared to internet-routed traffic

In case of Azure Private Link at the moment you should raise a Support Ticket first with your SaaS tenant ID and your Azure Subscription ID. Official documentation will be published soon and as I saw it is very clear and straitforward. We have already configured it and I can confirm that it is up and running.

High level setps:

Step 1: Support ticket opened → Private Link Service Alias received
Step 2: Private Endpoint created using the alias
Step 3: Private DNS Zone configured with A record
Step 4: DNS resolution verified — private IP confirmed
Step 5: OneAgent connectivity verified via private endpoint

After the setup your high level route will be in a full Private Link:

OnPremis OA -> OnPremis AG -> Azure ExpressRoute -> Your Azure tenant -> Azure Private Link on top of Microsoft Azure backbone -> Your Dynatrace SaaS tenant.

AKS OA (in your Azure tenant) -> AKS AG (in your Azure tenant) -> Azure Private Link on top of Microsoft Azure backbone -> Your Dynatrace SaaS tenant.

Here is a high level desgin of an Azure setup:

Encyption:

AWS BYOK (GA):

AWS BYOK is well documented: Manage AWS encryption keys — Dynatrace Docs

Azure BYOK (Planning phase):

Based on the preliminary information Azure BYOK will be in Preview in 2027 Q2/Q3. IT IS NOT AN OFFICIAL STATEMENT.

I hope with these information you can chose your target platform for the latest Dynatrace.

Best regards,

János

topic SaaS migration PART 2 - Private Links (AZURE, AWS) + encyption (BYOK, CMK) in Dynatrace tips

SaaS migration PART 2 - Private Links (AZURE, AWS) + encyption (BYOK, CMK)