Azure limitation on private networking for Functions -> Document Intelligence

Azure Function App calls to Azure AI Document Intelligence over a private endpoint are failing with:

403 Traffic is not from an approved private endpoint.

This question is basically very strong indication for limitations on private networking for document intelligence.
The Function App is on Azure Functions Premium Linux with regional VNet integration, private DNS resolves the Document Intelligence hostname to the approved private endpoint IP, and the private endpoint connection is in Approved state. Despite that, the actual documentModels/prebuilt-read:analyze POST is rejected.

Function plan: Premium Linux (EP1)

Scenario

A Python Azure Function running on Premium plan calls Azure AI Document Intelligence using managed identity and the custom subdomain endpoint:

https://<myservice>.cognitiveservices.azure.com/documentintelligence/documentModels/prebuilt-read:analyze

The Function App is VNet-integrated and should reach the Document Intelligence account through the private endpoint.

Expected Behavior

The request should be accepted over the private endpoint path and the begin_analyze_document call should succeed.

Actual Behavior

The request fails with:

azure.core.exceptions.HttpResponseError: (403) Traffic is not from an approved private endpoint.

Important Evidence Collected

1. The private endpoint connection is approved.

Command run:

az network private-endpoint-connection list --id $docIntId -o json

Observed result:

• privateLinkServiceConnectionState.status = "Approved"
• provisioningState = "Succeeded"

1. The private endpoint NIC IP is the same IP the Function resolves at runtime.

Command run:

$peNicId = az network private-endpoint show `
  --resource-group <myrg> `
  --name <doc int private endpoint> `
  --query "networkInterfaces[0].id" `
  -o tsv

az network nic show --ids $peNicId --query "ipConfigurations[].privateIPAddress" -o tsv

Observed result:

• private endpoint NIC IP = 10.50.0.39

1. The private DNS zone contains the expected A record.

Command run:

az network private-dns record-set a list `
  --resource-group <myrg> `
  --zone-name privatelink.cognitiveservices.azure.com `
  -o table

Observed result:

• A record exists for <my doc int service>

1. The Function App is VNet-integrated with the expected subnet.

Command run:

az functionapp vnet-integration list `
  --resource-group <my rg> `
  --name <my functions app name> `
  -o json

Observed result:

• VNet integration exists
• Subnet = <myvnet>/subnets/<functions subnet>

1. Runtime diagnostics from inside the Function show the destination is the private endpoint IP.

Observed runtime log:

Document Intelligence DNS resolution for '<docintelligenseservce>.cognitiveservices.azure.com': [{'ip': '10.50.0.39', 'is_private': True}]

1. A direct socket diagnostic from inside the Function shows:

DI socket local=('169.254.254.3', 38864) remote=('10.50.0.39', 443)

This indicates the Function worker is connecting to the private endpoint IP as destination. The local address appears to be an internal App Service/Functions platform address rather than a direct subnet IP.

1. A simple HTTPS probe to the endpoint succeeds, but the Document Intelligence analyze call fails.

Observed runtime log:

Running curl-like HTTPS probe for Document Intelligence endpoint 'https://<docintelligenceservoce>.cognitiveservices.azure.com'.
Document Intelligence HTTPS probe response: status=200 reason=Service Operational

But the actual analyze request fails:

Request URL: 'https://<docintelligenceservice>.cognitiveservices.azure.com/documentintelligence/documentModels/prebuilt-read:analyze?...'
Response status: 403
Message: Traffic is not from an approved private endpoint.

SDK / Runtime Details

From runtime logs:

• azsdk-python-ai-documentintelligence/1.0.2
• azsdk-python-identity/1.25.3
• Python 3.11.13
• Functions runtime version ~4

Authentication method:

• Managed identity via DefaultAzureCredential
• local_auth_enabled = false on the Document Intelligence account

Document Intelligence Network Configuration Tested

We tested both of the following on the Document Intelligence resource:

1. Hard private-only:

• public_network_access_enabled = false

1. Selected networks mode:

• public_network_access_enabled = true
• network_acls { default_action = "Deny" }

The same 403 Traffic is not from an approved private endpoint occurs in both configurations.

Current Terraform Configuration

Document Intelligence account:

resource "azurerm_cognitive_account" "document_intelligence" {
  name                          = var.document_intelligence_account_name
  location                      = local.cognitive_location
  resource_group_name           = data.azurerm_resource_group.existing.name
  kind                          = "FormRecognizer"
  sku_name                      = "S0"
  custom_subdomain_name         = var.document_intelligence_custom_subdomain_name
  public_network_access_enabled = true
  local_auth_enabled            = false

  network_acls {
    default_action = "Deny"
  }
}

Function App networking:

• Premium Linux plan
• regional VNet integration enabled
• route-all enabled
• Document Intelligence hostname resolves privately inside the Function runtime

Exact Error

azure.core.exceptions.HttpResponseError: (403) Traffic is not from an approved private endpoint.
Code: 403
Message: Traffic is not from an approved private endpoint.

Request to Azure Support

Please confirm whether Azure Functions Premium/App Service VNet integration is officially supported for Azure AI Document Intelligence private endpoint data-plane operations in this exact scenario.

Specifically, we need to know:

1. Is this architecture supported:
   • Azure Functions Premium Linux
   • regional VNet integration
   • Document Intelligence with private endpoint
   • private DNS resolution to the private endpoint
   • managed identity authentication
2. If it is supported, why does the service still reject the analyze POST with Traffic is not from an approved private endpoint even though:
   • the private endpoint is approved
   • DNS resolves to the private endpoint IP
   • the TCP/TLS connection reaches the private endpoint IP
   • the Function App is VNet-integrated
3. If this is a known limitation or product bug, please provide:
   • the documented limitation
   • the recommended supported workaround
   • whether a fix is available or planned