Private connectivity vs public internet
Internet reachability requires explicit configuration (public endpoint plus allowed inbound). VNet connection equals private communication. Public IP address equals public endpoint for internet reachability. No public endpoint → VM can still work privately. 'On a VNet' does not equal 'reachable from the internet'.