In Debug sessions, a Custom Skill cannot connect to Azure Functions which is on a Virtual Network

Question

In Debug sessions, a Custom Skill cannot connect to Azure Functions which is on a Virtual Network

You Matsuo(松尾　陽) 65

I'm trying to connect to a custom skill which is an Azure Function on a Virtual Network in Debug Sessions. Although it works in an indexer, it gives me the following error om a debug session.

Enrichment.WebApiSkill.custom-embeding-skillCould not execute skill because the Web Api request failed.Web Api response status: 'Forbidden', Web Api response details: '<!DOCTYPE html> <html> <head> <title>Web App - Unavailable</title> <style type="text/css"> html { height: 100%; width: 100%; } #feature { width: 960px; margin: 95px auto 0 auto; overflow: auto; } #content { font-family: "Segoe UI"; font-weight: normal; font-size: 22px; color: #ffffff; float: left; width: 460px; margin-top: 68px; margin-left: 0px; vertical-align: middle; } #content h1 { font-family: "Segoe UI Light"; color: #ffffff; font-weight: normal; font-size: 60px; line-height: 48pt; width: 800px; } p a, p a:visited, p a:active, p a:hover { color: #ffffff; } #content a.button { background: #0DBCF2; border: 1px solid #FFFFFF; color: #FFFFFF; display: inline-block; font-family: Segoe UI; font-size: 24px; line-height: 46px; margin-top: 10px; padding: 0 15px 3px; text-decoration: none; } #content a.button img { float: right; padding: 10px 0 0 15px; } #content a.button:hover { background: #1C75BC; } </style> </head> <body bgcolor="#00abec"> <div id="feature"> <div id="content"> <h1 id="unavailable">Error 403 - Forbidden</h1> <p id="tryAgain">The web app you have attempted to reach has blocked your access.</p> </div> </div> </body> </html> '

My skillset is simple as below.

User's image

I set up a shared private link on AI Search to the Azure Function.

User's image

Network settings of the Azure Function. If I enable all public network access, debugging works well.

User's image

Both the AI Search and the Azure Functions on the same Virtual Network, but no luck, only in Debug sessions.

SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2024-11-07T12:14:20.9233333+00:00
@You Matsuo(松尾　陽) Thanks for asking question!

The error message you are seeing suggests that the connection to the Azure Function is being blocked. This could be due to a number of reasons, but one possibility is that the Azure Function is not accessible from the network you are using to run the debug session.

To resolve this issue, you can try the following steps:

Check that the Azure Function is running and accessible from the network you are using to run the debug session. You can test this by accessing the Azure Function URL from a browser or using a tool like Postman.

Ensure that the Azure Function is configured to allow traffic from the network you are using to run the debug session. You can do this by configuring the Azure Function's network security group (NSG) to allow traffic from your IP address or the IP address range of your network. Refer to this link- https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options?tabs=azure-portal#private-endpoints

After creating Shared private link- you need to Approve the private endpoint connection -Approval of the private endpoint connection is granted on the Azure PaaS side. Explicit approval by the resource owner is required.

On the Azure AI Search side, you can confirm request approval by revisiting the Shared Private Access page of the search service Networking page. Connection state should be approved.

Configure the indexer to run in the private environment

Test the shared private link For detailed step follow this document Make outbound connections through a shared private link

Please let us know if further query-
You Matsuo(松尾　陽) 65 Reputation points

2024-11-08T01:29:39.2233333+00:00

@SnehaAgrawal-MSFT Thank you for your reply.I checked all the points you listed, but none helped.

An indexer is working as I said with the shared private link, but not working in the debug session with the Azure Functions featured by a Virtual Network.

So I'm guessing I have to set something up for the debug session, but as far as I can tell, there is not much information about the debug session with an Azure Function on a virtual network.
You Matsuo(松尾　陽) 65 Reputation points

2024-11-08T01:35:52.35+00:00

@SnehaAgrawal-MSFT
Thank you for your help.

I thoroughly checked the points you listed up, but none worked.

The indexer with a shared private link is working normally as I said, but not working in the debug session. So I'm guessing there must a special setting for a debug session using an Azure Function as a custom skill which is on a virtual network.

But as far as I can tell, there is not much information about a debug session with an Azure Function on a virtual network.
You Matsuo(松尾　陽) 65 Reputation points

2024-11-08T01:46:45.7233333+00:00

This comment system is working weirdly. Clicking "Add comment" or "Post your answer" doesn't show anything right after the action, but it suddenly appears after I post other comment.

Accepted answer

1 additional answer

Your answer

SnehaAgrawal-MSFT 22,706 Reputation points Moderator

2024-11-07T12:14:20.9233333+00:00

@You Matsuo(松尾　陽) Thanks for asking question!

The error message you are seeing suggests that the connection to the Azure Function is being blocked. This could be due to a number of reasons, but one possibility is that the Azure Function is not accessible from the network you are using to run the debug session.

To resolve this issue, you can try the following steps:

Check that the Azure Function is running and accessible from the network you are using to run the debug session. You can test this by accessing the Azure Function URL from a browser or using a tool like Postman.

Ensure that the Azure Function is configured to allow traffic from the network you are using to run the debug session. You can do this by configuring the Azure Function's network security group (NSG) to allow traffic from your IP address or the IP address range of your network. Refer to this link- https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options?tabs=azure-portal#private-endpoints

After creating Shared private link- you need to Approve the private endpoint connection -Approval of the private endpoint connection is granted on the Azure PaaS side. Explicit approval by the resource owner is required.

On the Azure AI Search side, you can confirm request approval by revisiting the Shared Private Access page of the search service Networking page. Connection state should be approved.

Configure the indexer to run in the private environment

Test the shared private link For detailed step follow this document Make outbound connections through a shared private link

Please let us know if further query-
You Matsuo(松尾　陽) 65 Reputation points

2024-11-08T01:29:39.2233333+00:00

@SnehaAgrawal-MSFT Thank you for your reply.I checked all the points you listed, but none helped.

An indexer is working as I said with the shared private link, but not working in the debug session with the Azure Functions featured by a Virtual Network.

So I'm guessing I have to set something up for the debug session, but as far as I can tell, there is not much information about the debug session with an Azure Function on a virtual network.
You Matsuo(松尾　陽) 65 Reputation points

2024-11-08T01:35:52.35+00:00

@SnehaAgrawal-MSFT
Thank you for your help.

I thoroughly checked the points you listed up, but none worked.

The indexer with a shared private link is working normally as I said, but not working in the debug session. So I'm guessing there must a special setting for a debug session using an Azure Function as a custom skill which is on a virtual network.

But as far as I can tell, there is not much information about a debug session with an Azure Function on a virtual network.
You Matsuo(松尾　陽) 65 Reputation points

2024-11-08T01:46:45.7233333+00:00

This comment system is working weirdly. Clicking "Add comment" or "Post your answer" doesn't show anything right after the action, but it suddenly appears after I post other comment.

Answer 1

@You Matsuo(松尾　陽) Glad that you were able to resolve your issue and I appreciate your effort in sharing the solution.

Your contribution will undoubtedly assist others facing similar challenges.

As the [Microsoft Q&A community follows a policy where the question author cannot accept their own answer] {https://learn.microsoft.com/en-us/answers/support/accept-answer} ,

I've reposted your solution below. Feel free to consider "Accepting" the answer if you find it suitable.

Resolution- Issue resolved when 'Allow access' from AI Search via setting a service tag AzureCognitiveSearch in the Azure Function's network setting.

User's image

Answer 2

You Matsuo(松尾　陽) 65

Ah finally I figured out. I had to allow access from AI Search via setting a service tag AzureCognitiveSearch in the Azure Function's network setting.

User's image

Share via

In Debug sessions, a Custom Skill cannot connect to Azure Functions which is on a Virtual Network

1 additional answer

Your answer