We are currently unable to configure network access restrictions in AI Language.

Question

We are currently unable to configure network access restrictions in AI Language.

Yuuya Takada (高田裕也) 20

We would greatly appreciate it if you could provide any insights regarding the cause and possible solutions.

In the "Networking" tab of AI Language, we are trying to restrict access by selecting "Selected networks and private endpoints" as the allowed access method. However, when we attempt to save the settings, we encounter the following error:

"Failed to save firewall and virtual network settings for Azure AI services account 'AILanguage-QA'. Error: An error occurred while processing the request. Please try again later."

As a result, we are unable to complete the configuration.

If anyone has any information about the cause or potential solutions, your assistance would be highly appreciated.

We have already configured the private endpoint according to the official documentation.

The region for AI Language is Japan East.

Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-07-28T02:53:07.92+00:00
Hi Yuuya Takada (高田裕也)

Japan East is Indeed supported region for Azure. I am trying to replicate the scenario at my side before connecting with you on private message.

Here is possible reason for below error

"Failed to save firewall and virtual network settings for Azure AI services account 'AILanguage-QA'. Error:

Permission : Cognitive Service Contributor for OpenAI resource

Networking: Service endpoints not configured properly before saving the rules

Custom subdomain not enabled on Azure language resource

Policy error blocking network config changes which can be checked in activity log of you resource or HAR trace

Reference - https://docs.azure.cn/en-us/ai-services/cognitive-services-virtual-networks?context=%2Fai-services%2Flanguage-service%2Fcontext%2Fcontext&tabs=portal

Thank you.
Yuuya Takada (高田裕也) 20 Reputation points

2025-07-28T05:01:20.3933333+00:00

Manas Mohanty

Thank you for your message. I reviewed the points you mentioned and tried again, but the error still occurred.

>Permission: Cognitive Service Contributor for OpenAI resource

I have assigned the appropriate permission to the AI Language resource.

Networking: Service endpoints not configured properly before saving the rules

　The service endpoint Microsoft.CognitiveServices was already registered with the subnet of the corresponding virtual network.

>Custom subdomain not enabled on Azure language resource

When I checked the endpoint, it looked as shown in the attached image.

Policy error blocking network config changes which can bechecked in activity log of you resource >or HAR trace

I checked the activity log, but no error was recorded.
Yuuya Takada (高田裕也) 20 Reputation points

2025-07-28T05:04:53.9066667+00:00

I posted it in the wrong place, so I’ve corrected it.
Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-07-28T07:13:29.8433333+00:00

Hi Yuuya Takada (高田裕也)

Thank you for sharing the inputs on above checks.

Please provide the requested details on private message for further assistance.
Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-07-31T05:33:24.1333333+00:00
Hi Yuuya Takada (高田裕也)

Could you do few more checks.

Delete the existing deployment if not used in production - Old public deployment might be restricting change of network setting. Max deployment 32 for Azure OpenAI. https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/quotas-limits#resource-limits

Disconnect Public Azure resource connected to your language resource ( like Public AI search resource) - Please confirm for connection of any public resources to your language resource.

Please share your inbound and outbound rules on NSG if you have network security group controlling the network flow

Please share relevant activity from resource activity log causing failure while saving virtual network

I shall reach networking product group for review if above pointers does not resolve the issue

Looking forward to hearing from you.

Thank you
Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-08-06T07:58:09.6533333+00:00

Hi Yuuya Takada (高田裕也)

Thank you for connecting in teams call and providing the detail.

Have reached product group again with ticket today.

Shall keep you posted as we progress.

Thank you
Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-08-06T12:06:34.9133333+00:00

Hi Yuuya Takada (高田裕也)

Trying to follow up on your case.

Product group is requesting input on region on Language AI search, VNET.

Seems there is UI bug recorded for this issue from product group already.

Answer accepted by question author

0 additional answers

Your answer

Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-07-28T02:53:07.92+00:00

Hi Yuuya Takada (高田裕也)

Japan East is Indeed supported region for Azure. I am trying to replicate the scenario at my side before connecting with you on private message.

Here is possible reason for below error

"Failed to save firewall and virtual network settings for Azure AI services account 'AILanguage-QA'. Error:

Permission : Cognitive Service Contributor for OpenAI resource

Networking: Service endpoints not configured properly before saving the rules

Custom subdomain not enabled on Azure language resource

Policy error blocking network config changes which can be checked in activity log of you resource or HAR trace

Reference - https://docs.azure.cn/en-us/ai-services/cognitive-services-virtual-networks?context=%2Fai-services%2Flanguage-service%2Fcontext%2Fcontext&tabs=portal

Thank you.
Yuuya Takada (高田裕也) 20 Reputation points

2025-07-28T05:01:20.3933333+00:00

Manas Mohanty

Thank you for your message. I reviewed the points you mentioned and tried again, but the error still occurred.

>Permission: Cognitive Service Contributor for OpenAI resource

I have assigned the appropriate permission to the AI Language resource.

Networking: Service endpoints not configured properly before saving the rules

　The service endpoint Microsoft.CognitiveServices was already registered with the subnet of the corresponding virtual network.

>Custom subdomain not enabled on Azure language resource

When I checked the endpoint, it looked as shown in the attached image.

Policy error blocking network config changes which can bechecked in activity log of you resource >or HAR trace

I checked the activity log, but no error was recorded.
Yuuya Takada (高田裕也) 20 Reputation points

2025-07-28T05:04:53.9066667+00:00

I posted it in the wrong place, so I’ve corrected it.
Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-07-28T07:13:29.8433333+00:00

Hi Yuuya Takada (高田裕也)

Thank you for sharing the inputs on above checks.

Please provide the requested details on private message for further assistance.
Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-07-31T05:33:24.1333333+00:00

Hi Yuuya Takada (高田裕也)

Could you do few more checks.

Delete the existing deployment if not used in production - Old public deployment might be restricting change of network setting. Max deployment 32 for Azure OpenAI. https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/quotas-limits#resource-limits

Disconnect Public Azure resource connected to your language resource ( like Public AI search resource) - Please confirm for connection of any public resources to your language resource.

Please share your inbound and outbound rules on NSG if you have network security group controlling the network flow

Please share relevant activity from resource activity log causing failure while saving virtual network

I shall reach networking product group for review if above pointers does not resolve the issue

Looking forward to hearing from you.

Thank you
Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-08-06T07:58:09.6533333+00:00

Hi Yuuya Takada (高田裕也)

Thank you for connecting in teams call and providing the detail.

Have reached product group again with ticket today.

Shall keep you posted as we progress.

Thank you
Manas Mohanty 16,835 Reputation points Microsoft External Staff Moderator

2025-08-06T12:06:34.9133333+00:00

Hi Yuuya Takada (高田裕也)

Trying to follow up on your case.

Product group is requesting input on region on Language AI search, VNET.

Seems there is UI bug recorded for this issue from product group already.

Answer 1

Hi Yuuya Takada (高田裕也)

Thank you for confirming on private messages that issue is resolved after connecting with you on teams call on Aug 1st itself.

Attached case summary for your reference.

Issue: Not able to save "selected virtual network and public Ip" with private endpoint enabled on private endpoints side

Status - Resolved after adding the needed permission (took some time relay the permission changes probably on backend

Checks done from Support side

Permission:

Configured Search service contributor for User and Language resource

Networking:

Service endpoints configured

Subnet join/read permission to communicate

Custom subdomain enabled on Azure language resource

AI search - Basic tier minimum as needed

Org policy

Nothing found in activity logs to show cause org policy block

Please take a minute to accept this answer if you appreciated our inputs.

Thank you for using Azure Services.

Share via

We are currently unable to configure network access restrictions in AI Language.

0 additional answers

Your answer