Accessing Generated Images from Azure OpenAI Service (DALL-E) with Private Endpoints

Question

Accessing Generated Images from Azure OpenAI Service (DALL-E) with Private Endpoints

Tamer Abdulghani 50

Hello,

We are using the Azure OpenAI service with private endpoints and have successfully generated images using the DALL-E models. However, when attempting to access the images via the URLs provided, we encounter the following error:

<Error>
<Code>
/Code>
<Message>
Public access is not permitted on this storage account. RequestId:21b03e93-901e-006f-7910-22cb66000000 Time:2024-10-19T10:21:52.3425664Z
</Message>
</Error>

Sample URL:

https://dalleproduse.blob.core.windows.net/private/images/IDOFIMAGE/generated_00.png

Could you provide guidance on how to resolve this issue?

Vahid Ghafarpour 23,385 Reputation points Volunteer Moderator

2024-10-19T21:46:25.8966667+00:00

Ensure that your storage account is configured to allow private endpoint access.

https://learn.microsoft.com/en-us/answers/questions/1489239/azure-open-ai-service-returning-error-public-acces
AshokPeddakotla-MSFT 35,971 Reputation points Moderator

2024-10-21T12:39:02.7533333+00:00

Abdulghani, Tamer (AllianzGI) Greetings!

Public access is not permitted on this storage account. RequestId:21b03e93-901e-006f-7910-22cb66000000 Time:2024-10-19T10:21:52.3425664Z

You are getting the error due to your storage account is not accessible.

Could you double check and confirm if you have access to your account dalleproduse?

How are you getting the URLS of the images?

As Vahid mentioned, did you configure private endpoint access?

To allow access to your Storage Account from your client machines, like using Azure OpenAI Studio, you need to create private endpoint connections that connect to your blob storage.

Also, To allow access to your Storage Account, you need to set up Storage Account to bypass your Azure OpenAI as trusted services based on managed identity.

In the Azure portal, navigate to your storage account networking tab, choose "Selected networks", and then select Allow Azure services on the trusted services list to access this storage account and click Save.

See Configure Azure AI services virtual networks for more details.

Do let me know if that helps or have any further queries.
AshokPeddakotla-MSFT 35,971 Reputation points Moderator

2024-10-22T16:44:07.4133333+00:00

Abdulghani, Tamer (AllianzGI) Did you get a chance to see my response?

Do let me know if you need further help.
AshokPeddakotla-MSFT 35,971 Reputation points Moderator

2024-10-24T16:41:38.55+00:00

Abdulghani, Tamer (AllianzGI) Awaiting for your response.

Did you get a chance to see my reply?

Do let me know if you need further assistance.
Tamer Abdulghani 50 Reputation points

2024-10-28T08:21:48.03+00:00

Sorry but your answers seem to be irrelevant somehow, because we didn't create this blob

https://dalleproduse.blob.core.windows.net , this is coming through the URL generated by DALL-e API.

https://learn.microsoft.com/en-us/azure/ai-services/openai/dall-e-quickstart?tabs=dalle3%2Ccommand-line%2Ctypescript&pivots=rest-api#output
AshokPeddakotla-MSFT 35,971 Reputation points Moderator

2024-10-28T16:09:57.5533333+00:00

Got it. But you mentioned that you have configured a private endpoint for your OpenAI resource still you need to have access to the Storage Account.

Also, you need to set up Storage Account to bypass your Azure OpenAI as trusted services based on managed identity.

As mentioned in the doc you are referring, The URL stays active for 24 hours. Did you try accessing within that time limit?

Do let me know if you need further help.

1 answer

Your answer

Vahid Ghafarpour 23,385 Reputation points Volunteer Moderator

2024-10-19T21:46:25.8966667+00:00

Ensure that your storage account is configured to allow private endpoint access.

https://learn.microsoft.com/en-us/answers/questions/1489239/azure-open-ai-service-returning-error-public-acces
AshokPeddakotla-MSFT 35,971 Reputation points Moderator

2024-10-21T12:39:02.7533333+00:00

Abdulghani, Tamer (AllianzGI) Greetings!

Public access is not permitted on this storage account. RequestId:21b03e93-901e-006f-7910-22cb66000000 Time:2024-10-19T10:21:52.3425664Z

You are getting the error due to your storage account is not accessible.

Could you double check and confirm if you have access to your account dalleproduse?

How are you getting the URLS of the images?

As Vahid mentioned, did you configure private endpoint access?

To allow access to your Storage Account from your client machines, like using Azure OpenAI Studio, you need to create private endpoint connections that connect to your blob storage.

Also, To allow access to your Storage Account, you need to set up Storage Account to bypass your Azure OpenAI as trusted services based on managed identity.

In the Azure portal, navigate to your storage account networking tab, choose "Selected networks", and then select Allow Azure services on the trusted services list to access this storage account and click Save.

See Configure Azure AI services virtual networks for more details.

Do let me know if that helps or have any further queries.
AshokPeddakotla-MSFT 35,971 Reputation points Moderator

2024-10-22T16:44:07.4133333+00:00

Abdulghani, Tamer (AllianzGI) Did you get a chance to see my response?

Do let me know if you need further help.
AshokPeddakotla-MSFT 35,971 Reputation points Moderator

2024-10-24T16:41:38.55+00:00

Abdulghani, Tamer (AllianzGI) Awaiting for your response.

Did you get a chance to see my reply?

Do let me know if you need further assistance.
Tamer Abdulghani 50 Reputation points

2024-10-28T08:21:48.03+00:00

Sorry but your answers seem to be irrelevant somehow, because we didn't create this blob

https://dalleproduse.blob.core.windows.net , this is coming through the URL generated by DALL-e API.

https://learn.microsoft.com/en-us/azure/ai-services/openai/dall-e-quickstart?tabs=dalle3%2Ccommand-line%2Ctypescript&pivots=rest-api#output
AshokPeddakotla-MSFT 35,971 Reputation points Moderator

2024-10-28T16:09:57.5533333+00:00

Got it. But you mentioned that you have configured a private endpoint for your OpenAI resource still you need to have access to the Storage Account.

Also, you need to set up Storage Account to bypass your Azure OpenAI as trusted services based on managed identity.

As mentioned in the doc you are referring, The URL stays active for 24 hours. Did you try accessing within that time limit?

Do let me know if you need further help.

Answer 1

Abdulghani, Tamer (AllianzGI) Your URL is incomplete. At the URL end there will be some extra appends to access the URL some thing like se=2024-11-06T08%3A30%3A45Z&sig=DfZ7r6VdxvnOfcAsSZQwPOWFKVcRd

https://dalleproduse.blob.core.windows.net/private/images/IDOFIMAGE/generated_00.png

When I access your URL, I'm also getting the same issue.

I would suggest you, please try again and access the complete URL generated by the code.

I just tried with the sample code available in the doc and able to access the image with complete URL which generated by the code.

User's image

Do let me know if you are still blocked.

Share via

Accessing Generated Images from Azure OpenAI Service (DALL-E) with Private Endpoints

1 answer

Your answer