Unable to add Private endpoint to existing Azure Database for PostgreSQL flexible server

Question

Unable to add Private endpoint to existing Azure Database for PostgreSQL flexible server

Shabir jan 21

I am trying to add private endpoint to existing Azure Database for PostgreSQL flexible server, and i following this guide: https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/how-to-networking-servers-deployed-public-access-add-private-endpoint?tabs=portal-add-private-endpoint-connections

But every time when I click create on the last step, the deployment continuously fails with this error:

The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.

Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'b2e56841-87aa-41f1-a570-3d9973644757' (Code: InternalServerError)

Adithya Prasad K 1,140 Reputation points Microsoft External Staff Moderator

2025-04-17T16:59:10.73+00:00
Hi Shabir jan,
I'm sorry to hear you're encountering an issue when trying to add a private endpoint to your Azure Database for PostgreSQL Flexible Server. The error message indicating an "InternalServerError" with the tracking ID 'b2e56841-87aa-41f1-a570-3d9973644757' suggests that the deployment is failing due to an unexpected issue on the Azure service side. Since you're following the guide at Microsoft Learn, let’s go through some troubleshooting steps and potential solutions:

Verify Prerequisites:

Ensure your PostgreSQL Flexible Server is deployed with Public Access (Allowed IP Addresses) and not VNet Integration, as the guide specifies that private endpoints cannot be added to servers with VNet Integration.

Confirm that the subscription containing the PostgreSQL server and the virtual network (VNet) is registered with the Microsoft.DBforPostgreSQL and Microsoft.Network resource providers. You can check this in the Azure portal under your subscription’s “Resource providers” settings and register them if needed.

Ensure the VNet and subnet you’re using for the private endpoint have sufficient IP addresses available and that the subnet is not delegated to another service.

Check Subnet Configuration:

Verify that the subnet you’re selecting for the private endpoint does not have a delegation set (e.g., for Azure services like Azure Kubernetes Service). Private endpoints require a non-delegated subnet or a subnet explicitly delegated to Microsoft.Network/privateEndpoints.

Ensure that network policies (e.g., Network Security Groups or User-Defined Routes) are enabled for the subnet, as private endpoints support these policies.

If possible, try creating the private endpoint in a different subnet within the same VNet to rule out subnet-specific issues.

DNS Configuration:

Ensure that the private DNS zone (e.g., privatelink.postgres.database.azure.com) is correctly configured and linked to the VNet. The guide you’re following includes steps to set this up. Double-check that the DNS zone has an A record pointing to the private IP address of the private endpoint.

If you’re using a custom DNS server, ensure it forwards requests for the PostgreSQL domain to Azure DNS (168.63.129.16).

Review Deployment Details:

In the Azure portal, navigate to the failed deployment under your resource group’s “Deployments” section. Look for additional error details or logs that might provide more context beyond the generic “InternalServerError”.

Retry with Alternative Methods:

Since you’re using the Azure portal, try creating the private endpoint using the Azure CLI or Bicep to see if the issue is specific to the portal. The Microsoft Learn guide provides CLI steps. For example:
az network private-endpoint create \ --name myPrivateEndpoint \ --resource-group myResourceGroup \ --vnet-name myVNet \ --subnet mySubnet \ --private-connection-resource-id $(az resource show --name myServer --resource-group myResourceGroup --resource-type "Microsoft.DBforPostgreSQL/flexibleServers" --query id --output tsv) \ --group-id postgresqlServer \ --connection-name myConnection

Ensure you replace myPrivateEndpoint, myResourceGroup, myVNet, mySubnet, myServer, and myConnection with your actual resource names.

Check for Regional or Service Issues:

Occasionally, transient issues in a specific Azure region can cause deployment failures. Check the Azure Service Health dashboard for any ongoing issues in your region.

If possible, try deploying the private endpoint in a different region (with a new PostgreSQL server for testing) to rule out regional service problems.

Additional Notes:

If you recently made changes to the PostgreSQL server’s networking settings (e.g., firewall rules or public access settings), ensure they align with the requirements for adding a private endpoint. For example, you may need to keep public access enabled temporarily until the private endpoint is successfully created, then disable it if desired.

If you’re using Bicep (as mentioned in a related Q&A), ensure the Bicep code includes a network security group association and proper subnet delegation, as shown in the PostgreSQL Flexible Server networking guide.

If you’ve tried these steps and the issue persists, please share any additional error details from the deployment logs or confirm whether you’ve verified the prerequisites (e.g., public access setting, subnet configuration). Also, let me know if you’re able to test with the CLI or another region.
Shabir jan 21 Reputation points

2025-04-18T10:54:51.2833333+00:00
Hi

Please check answer to each of your query in Bold.

Verify Prerequisites:

Ensure your PostgreSQL Flexible Server is deployed with Public Access (Allowed IP Addresses) and not VNet Integration, as the guide specifies that private endpoints cannot be added to servers with VNet Integration. Public Access is enabled

Confirm that the subscription containing the PostgreSQL server and the virtual network (VNet) is registered with the Microsoft.DBforPostgreSQL and Microsoft.Network resource providers. You can check this in the Azure portal under your subscription’s “Resource providers” settings and register them if needed. Verified, both are registered.

Ensure the VNet and subnet you’re using for the private endpoint have sufficient IP addresses available and that the subnet is not delegated to another service. No delegation on the subnet, 251 available ip address range

Check Subnet Configuration:

Verify that the subnet you’re selecting for the private endpoint does not have a delegation set (e.g., for Azure services like Azure Kubernetes Service). Private endpoints require a non-delegated subnet or a subnet explicitly delegated to Microsoft.Network/privateEndpoints. No delegation on the subnet

Ensure that network policies (e.g., Network Security Groups or User-Defined Routes) are enabled for the subnet, as private endpoints support these policies. No NSG or User Defined Routes enabled on subnet

If possible, try creating the private endpoint in a different subnet within the same VNet to rule out subnet-specific issues. Tried but same result

DNS Configuration:

Ensure that the private DNS zone (e.g., privatelink.postgres.database.azure.com) is correctly configured and linked to the VNet. The guide you’re following includes steps to set this up. Double-check that the DNS zone has an A record pointing to the private IP address of the private endpoint. Double checked and verified

If you’re using a custom DNS server, ensure it forwards requests for the PostgreSQL domain to Azure DNS (168.63.129.16). Not Using custom

Review Deployment Details:

In the Azure portal, navigate to the failed deployment under your resource group’s “Deployments” section. Look for additional error details or logs that might provide more context beyond the generic “InternalServerError”. Only see this in the deployment logs for resource group
Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'ecde9bdc-0a24-4827-8892-3f5fd39261e3' (Code: InternalServerError)

and this : The resource operation completed with terminal provisioning state 'Failed'.

Retry with Alternative Methods:

Ran with az cli using --debug command and this is the ouput

Traceback (most recent call last): File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/aaz/_poller.py", line 45, in run
super().run()
File "/usr/lib64/az/lib/python3.12/site-packages/azure/core/polling/base_polling.py", line 772, in run
raise HttpResponseError(response=self._pipeline_response.http_response, error=err) from err
azure.core.exceptions.HttpResponseError: (InternalServerError) Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'd517aa9d-6230-4321-bf1f-9e6f1ffcb6cb' Code: InternalServerError Message: Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'd517aa9d-6230-4321-bf1f-9e6f1ffcb6cb' During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/usr/lib64/az/lib/python3.12/site-packages/knack/cli.py", line 233, in invoke
cmd_result = self.invocation.execute(args) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 666, in execute
raise ex
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 734, in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 714, in _run_job
result = LongRunningOperation(cmd_copy.cli_ctx, 'Starting {}'.format(cmd_copy.name))(result) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 1076, in call
raise exception
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/commands/init.py", line 1063, in call
result = poller.result() ^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/aaz/_poller.py", line 108, in result
self.wait(timeout)
File "/usr/lib64/az/lib/python3.12/site-packages/azure/core/tracing/decorator.py", line 94, in wrapper_use_tracer
return func(*args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/aaz/_poller.py", line 130, in wait
raise self._exception
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/aaz/_poller.py", line 94, in _start
raise error
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/aaz/_poller.py", line 86, in _start
self._polling_method.run()
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/aaz/_poller.py", line 50, in run
self._http_response_error_callback(err.response)
File "/usr/lib64/az/lib/python3.12/site-packages/azure/cli/core/aaz/_operation.py", line 327, in on_error
raise HttpResponseError(response=response, error_format=error_format)
azure.core.exceptions.HttpResponseError: (InternalServerError) Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'd517aa9d-6230-4321-bf1f-9e6f1ffcb6cb' Code: InternalServerError Message: Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'd517aa9d-6230-4321-bf1f-9e6f1ffcb6cb' cli.azure.cli.core.azclierror: (InternalServerError) Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'd517aa9d-6230-4321-bf1f-9e6f1ffcb6cb' Code: InternalServerError Message: Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'd517aa9d-6230-4321-bf1f-9e6f1ffcb6cb' az_command_data_logger: (InternalServerError) Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'd517aa9d-6230-4321-bf1f-9e6f1ffcb6cb' Code: InternalServerError Message: Call to Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occured while processing the request. Tracking ID: 'd517aa9d-6230-4321-bf1f-9e6f1ffcb6cb'

Let me know if anything else is required.
Shabir jan 21 Reputation points

2025-04-18T10:56:48.3233333+00:00

I have also checked the activity log of the postgresql server and this is what I see
Saraswathi Devadula 3,150 Reputation points Microsoft External Staff Moderator

2025-04-18T11:09:12.11+00:00

Hello Shabir jan
Kindly please share the details requested in the private message for further investigation.
Saraswathi Devadula 3,150 Reputation points Microsoft External Staff Moderator

2025-04-18T15:16:25.15+00:00

Hello Shabir jan

Following our discussion, you are unable to create the private endpoint for Azure PostgreSQL flexible server with the error message,
Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occurred while processing the request.

Upon my investigation, I verified that the Private endpoint enabling is capable for the specific server and I am trying to work on this request to mitigate this issue.

Appreciate your time and patience while working on this request.

Accepted answer

0 additional answers

Your answer

Shabir jan 21 Reputation points

2025-04-18T10:56:48.3233333+00:00

I have also checked the activity log of the postgresql server and this is what I see
Saraswathi Devadula 3,150 Reputation points Microsoft External Staff Moderator

2025-04-18T11:09:12.11+00:00

Hello Shabir jan
Kindly please share the details requested in the private message for further investigation.
Saraswathi Devadula 3,150 Reputation points Microsoft External Staff Moderator

2025-04-18T15:16:25.15+00:00

Hello Shabir jan

Following our discussion, you are unable to create the private endpoint for Azure PostgreSQL flexible server with the error message,
Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occurred while processing the request.

Upon my investigation, I verified that the Private endpoint enabling is capable for the specific server and I am trying to work on this request to mitigate this issue.

Appreciate your time and patience while working on this request.

Answer 1

Hello Shabir jan

Following our discussion, you are unable to create the private endpoint for Azure PostgreSQL flexible server with the error message, Microsoft.DBforPostgreSQL/flexibleServers failed. Error message: An unexpected error occurred while processing the request.

Upon my investigation, I verified that the Private endpoint enabling is capable for the specific server and I tried to mitigate this issue.

Kindly please try to create the private endpoint and let us know the update.

I hope this has been helpful!

Your feedback is important so please take a moment to accept answers. If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

If this answers your query, do click Accept Answer and Upvote for was this answer helpful.

Shabir jan 21 Reputation points

2025-04-18T16:22:01.6+00:00

@Saraswathi Devadula Thank you so much for your help in resolving this ticket, really appreciate how you helped me fixing the issue.

Share via

Unable to add Private endpoint to existing Azure Database for PostgreSQL flexible server

0 additional answers

Your answer