Consider Purview Network Security. We can deploy a Microsoft Purview account private endpoint to allow only client calls to Microsoft Purview that originate from within the private network. To connect to the Microsoft Purview governance portal using a private network connectivity, we can deploy portal private endpoints. We can deploy ingestion private endpoints if we need to scan Azure IaaS or PaaS data sources inside Azure virtual networks and on-premises data sources through a private connection. 

This method ensures network isolation for our metadata flowing from the data sources to the Microsoft Purview data map. The Microsoft Purview account private endpoint is used to add another layer of security by enabling scenarios where only client calls that originate from within the virtual network are allowed to access the Microsoft Purview accounts. This private endpoint is also a prerequisite for the portal private endpoint. The Microsoft Purview portal private endpoint is required to enable connectivity to Microsoft Purview governance portal using a private network. Microsoft Purview can scan data sources in Azure or on-premises environments by using ingestion private endpoints. 

Three private endpoint resources are required to be deployed and linked to Microsoft Purview managed resources when ingestion private endpoints are deployed. They include Blob private endpoints and Queue private endpoints which are linked to a Microsoft Purview managed storage account, and Namespace private endpoints which are linked to a Microsoft Purview managed Event Hub namespace. A managed virtual network in Microsoft Purview is a virtual network which is deployed and managed by Azure inside the same region as Microsoft Purview account to allow scanning data resources inside a managed network without having to deploy and manage any self-hosted integration runtime virtual machines by the customer in Azure.