Unable to access Azure OpenAI from AI project

Question

Unable to access Azure OpenAI from AI project

Luca Pio Miano 20

Hello,

I've been trying to access my azure OpenAI resources from an Azure AI project in the Agents section but i always get this error when i try to load the resources.

Unable to access your agents Public access is disabled in the AI Service. Please open and configure a private endpoint connection. Learn more

I've also tried to setup the Azure AIHub where the project is deployed by enabling the managed virtual network option and creating a private endpoint for the OpenAI resource but i still get the error.

Apparently the OpenAI resource is correctly connected, i can clearly see the models deployed into it and if i try to open the chat and ask something to one of the models from the Playground section inside the AI Project everything works fine, the only problem is for the Agents section.

Any ideas?

Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-06T02:28:08.75+00:00
Hi Luca Pio Miano,

Thanks for providing the detailed explanation — this is a common issue related to network isolation and access control in Azure AI Studio, especially when using private endpoints with Azure OpenAI. Let’s walk through a resolution plan.

The error message:

“Unable to access your agents. Public access is disabled in the AI Service. Please open and configure a private endpoint connection.”

...means that your Azure OpenAI resource has public access disabled, and the Azure AI project (Agents section) cannot reach it through a private endpoint yet — even though Playground seems to work.

This occurs because:

·       Playground uses internal access via AI Studio infrastructure (via Managed VNet).

·       Agents (Orchestration) uses a separate runtime that must explicitly route through private endpoints when public access is off.

Step-by-Step Fix:

Ensure Azure OpenAI Resource Has a Private Endpoint

·       Go to your Azure OpenAI resource > Networking.

·       Ensure Private Endpoint is created and in "Approved" state.

·       Check the subnet used by the private endpoint — it must allow the AI Project VNet traffic.

2.Disable Public Access (If Required)

·       Still under Networking, verify that:

o   Public access is disabled, and

o   Private endpoint is correctly bound to a VNet accessible from your AI Project.

If public access is disabled and no VNet integration is configured properly, Agent access will fail.

3.Ensure Azure AI Project Uses a Managed VNet

·       In your Azure AI Studio project settings:

o   Make sure "Enable Managed Virtual Network" is ON.

o   This ensures all resources (Agents, Jobs, etc.) run inside an isolated VNet.

If your project was created before enabling Managed VNet, you must create a new project with it turned on — it can’t be retrofitted.

4.Use Private DNS Zone Resolution

·       If your private endpoint connects to OpenAI via a private IP, ensure that the private DNS zone:

privatelink.openai.azure.com

·       is correctly linked to the VNet that the Azure AI project is using.

·       Also ensure custom DNS settings in your VNet aren’t breaking resolution.

You can check using Azure CLI or test from a VM in the same VNet:

nslookup your-openai-resource-name.openai.azure.com

5.Recreate Agent with Updated Config

·       After all networking changes, go back to Agents section:

o   Try removing the old Agent and re-adding a new one.

o   Make sure to select the right model and deployment from the now-resolved OpenAI resource.

Hope this helps, do let me know if you have any further queries.

Thank you!
Luca Pio Miano 20 Reputation points

2025-05-06T08:31:41.1566667+00:00

Hi @Prashanth Veeragoni ,

Thank you for your answer.

I carely realized all of the steps you suggested:

I've recreated an Azure AIHub resource with Managed VNet enabled and created a private endpoint pointing to the OpenAI resource inside Managed VNet.

I've also created a private endpoint for Azure OpenAI resource inside my VNet as well as disabling public access.

I've also tested the DNS resolution from inside a VM inside the same VNet but I'm still having the same issue trying to connect from AI Project Agents section.

I still cannot see how to put the AI Project resource inside the same VNet of the OpenAI private endpoint, the one that I've created, not the Managed one. There is no such option

Any ideas?

Luca
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-08T04:55:21.4033333+00:00
Hi Luca Pio Miano,

You can't:

Azure AI Projects use a Managed Virtual Network (VNet) behind the scenes (like commonHoboRG1) and do not support using customer-managed VNets directly.

Why this happens:

·       The Azure AI Project/Agent infrastructure is tightly integrated with AI Hub’s Managed VNet.

·       Even though you have a Private Endpoint in their own VNet, the AI Project cannot route traffic through that VNet.

·       There's no way to "move" or associate the AI Project itself into your VNet — this is by design.

What actually works:

If you want to use Azure OpenAI with Private Access in AI Projects → Agents, you must:

1.Enable Managed VNet on AI Hub (you've already done this)

Create the Private Endpoint to Azure OpenAI inside that Managed VNet (you've also done this)

Make sure:

·       Private DNS resolution is working from inside the Managed VNet

·       Outbound network rules allow traffic to the OpenAI endpoint

·       The OpenAI endpoint URL used in the agent is the Private Link URL:

https://<resource>.privatelink.openai.azure.com

Avoid using your own VNet

·       Any Private Endpoint outside the Managed VNet is inaccessible to the AI Project and will never work from the Agents section.

Hope this helps.

Thank you!
Luca Pio Miano 20 Reputation points

2025-05-14T08:22:21.23+00:00

Hi @Prashanth Veeragoni
How do i check these points (neither have I access to the Managed VNet nor the private endpoint to check the details):
·       Private DNS resolution is working from inside the Managed VNet

·       Outbound network rules allow traffic to the OpenAI endpoint

·       The OpenAI endpoint URL used in the agent is the Private Link URL:

For the last one i've also tried to add the connected resource pointing to the private link of the openai service instead of the classic link as you suggested (https://<resource>.privatelink.openai.azure.com), i have already tried using the classic link for the resource.

Nevertheless i still get an error, this time i get ServiceError: Service temporarily unavailable. Please try again later.
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-15T01:54:09.3733333+00:00

Luca Pio Miano,

Thanks for the updated info — this is a common and tricky issue when using Azure OpenAI with Private Link in Azure AI Projects.

What to Check (Even Without VNet Access)

1.Private DNS Resolution (Critical)

The AI Project uses a Managed VNet. It must be able to resolve *.privatelink.openai.azure.com to the private IP address.

What You Can Do:

·   Ensure a Private DNS Zone named privatelink.openai.azure.com exists.

·   Make sure the Private Endpoint is linked to that DNS zone.

·   The Managed VNet (created by AI Hub) must be linked to this zone.

Check if Managed VNet from AI Hub linked to the privatelink.openai.azure.com Private DNS Zone?

2.Outbound NSG / Route Restrictions

Even if the DNS works, NSGs or UDRs on the Managed VNet can block traffic.

You must ensure:

·   NSGs allow outbound traffic from the subnet to the OpenAI Private IP

·   No UDRs overriding traffic to the OpenAI endpoint

Test This with Microsoft Hosted Notebook or Agent:

If DNS fails or outbound is blocked:

·   Agents will error

·   Hosted notebooks will error

·   You may see "service unavailable", "timeout", or "name resolution failure"

Hope this helps.

Thank you!
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-16T01:36:26.0766667+00:00

Luca Pio Miano,

Checking back to see if my above response was helpful to you, hope that helps.

Thank you!
Saideep Anchuri 9,425 Reputation points Microsoft External Staff Moderator

2025-05-19T05:27:48.3533333+00:00

Luca Pio Miano,

Did get any chance to check above response.

Thank You.
Luca Pio Miano 20 Reputation points

2025-05-19T08:04:49.71+00:00

Hello @Prashanth Veeragoni , @Saideep Anchuri

I've done all of the steps suggested but I still get the same error.
Checking inside the AIHub connected resources I found this error related to private endpoint connection to openAI resource

Network Service does not have permission to check resource /subscriptions/MY_SUBSCRIPTION_NUMBER/resourceGroups/RESOURCE_GROUP_NAME/providers/Microsoft.CognitiveServices/accounts/OPENAI_SERVICE details. Please consider grant Azure Machine Learning (appId: 0736f41a-0425-4b46-bdb5-1563eff02385) read or contributor access to connected resource.

Unfortunately i cannot find any resource with id: 0736f41a-0425-4b46-bdb5-1563eff02385, neither have I an Azure Machine Learning resource.

Luca
Luca Pio Miano 20 Reputation points

2025-05-19T08:26:27.1366667+00:00

Hello @Prashanth Veeragoni , @Saideep Anchuri

The problem had nothing to do with the one I mentioned earlier, I finally managed to solve it.
The problem is that the connected resource in AIHub has to be configured with Managed EntraID authentication instead of Api Key authentication, doing so I managed to access the agent successfully.

Best regards.

Luca
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-20T02:02:53.48+00:00

Hi Luca Pio Miano,

Glad to know that you were able to resolve the issue! Thank you for sharing the root cause — configuring the connected resource in AIHub with Managed EntraID authentication instead of API Key authentication.

Accepted answer

1 additional answer

Your answer

Luca Pio Miano 20 Reputation points

2025-05-06T08:31:41.1566667+00:00

Hi @Prashanth Veeragoni ,

Thank you for your answer.

I carely realized all of the steps you suggested:

I've recreated an Azure AIHub resource with Managed VNet enabled and created a private endpoint pointing to the OpenAI resource inside Managed VNet.

I've also created a private endpoint for Azure OpenAI resource inside my VNet as well as disabling public access.

I've also tested the DNS resolution from inside a VM inside the same VNet but I'm still having the same issue trying to connect from AI Project Agents section.

I still cannot see how to put the AI Project resource inside the same VNet of the OpenAI private endpoint, the one that I've created, not the Managed one. There is no such option

Any ideas?

Luca
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-08T04:55:21.4033333+00:00

Hi Luca Pio Miano,

You can't:

Azure AI Projects use a Managed Virtual Network (VNet) behind the scenes (like commonHoboRG1) and do not support using customer-managed VNets directly.

Why this happens:

· The Azure AI Project/Agent infrastructure is tightly integrated with AI Hub’s Managed VNet.

· Even though you have a Private Endpoint in their own VNet, the AI Project cannot route traffic through that VNet.

· There's no way to "move" or associate the AI Project itself into your VNet — this is by design.

What actually works:

If you want to use Azure OpenAI with Private Access in AI Projects → Agents, you must:

1.Enable Managed VNet on AI Hub (you've already done this)

Create the Private Endpoint to Azure OpenAI inside that Managed VNet (you've also done this)

Make sure:

· Private DNS resolution is working from inside the Managed VNet

· Outbound network rules allow traffic to the OpenAI endpoint

· The OpenAI endpoint URL used in the agent is the Private Link URL:

https://<resource>.privatelink.openai.azure.com

Avoid using your own VNet

· Any Private Endpoint outside the Managed VNet is inaccessible to the AI Project and will never work from the Agents section.

Hope this helps.

Thank you!
Luca Pio Miano 20 Reputation points

2025-05-14T08:22:21.23+00:00

Hi @Prashanth Veeragoni
How do i check these points (neither have I access to the Managed VNet nor the private endpoint to check the details):
· Private DNS resolution is working from inside the Managed VNet

· Outbound network rules allow traffic to the OpenAI endpoint

· The OpenAI endpoint URL used in the agent is the Private Link URL:

For the last one i've also tried to add the connected resource pointing to the private link of the openai service instead of the classic link as you suggested (https://<resource>.privatelink.openai.azure.com), i have already tried using the classic link for the resource.

Nevertheless i still get an error, this time i get ServiceError: Service temporarily unavailable. Please try again later.
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-15T01:54:09.3733333+00:00

Luca Pio Miano,

Thanks for the updated info — this is a common and tricky issue when using Azure OpenAI with Private Link in Azure AI Projects.

What to Check (Even Without VNet Access)

1.Private DNS Resolution (Critical)

The AI Project uses a Managed VNet. It must be able to resolve *.privatelink.openai.azure.com to the private IP address.

What You Can Do:

· Ensure a Private DNS Zone named privatelink.openai.azure.com exists.

· Make sure the Private Endpoint is linked to that DNS zone.

· The Managed VNet (created by AI Hub) must be linked to this zone.

Check if Managed VNet from AI Hub linked to the privatelink.openai.azure.com Private DNS Zone?

2.Outbound NSG / Route Restrictions

Even if the DNS works, NSGs or UDRs on the Managed VNet can block traffic.

You must ensure:

· NSGs allow outbound traffic from the subnet to the OpenAI Private IP

· No UDRs overriding traffic to the OpenAI endpoint

Test This with Microsoft Hosted Notebook or Agent:

If DNS fails or outbound is blocked:

· Agents will error

· Hosted notebooks will error

· You may see "service unavailable", "timeout", or "name resolution failure"

Hope this helps.

Thank you!
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-16T01:36:26.0766667+00:00

Luca Pio Miano,

Checking back to see if my above response was helpful to you, hope that helps.

Thank you!
Saideep Anchuri 9,425 Reputation points Microsoft External Staff Moderator

2025-05-19T05:27:48.3533333+00:00

Luca Pio Miano,

Did get any chance to check above response.

Thank You.
Luca Pio Miano 20 Reputation points

2025-05-19T08:04:49.71+00:00

Hello @Prashanth Veeragoni , @Saideep Anchuri

I've done all of the steps suggested but I still get the same error.
Checking inside the AIHub connected resources I found this error related to private endpoint connection to openAI resource

Network Service does not have permission to check resource /subscriptions/MY_SUBSCRIPTION_NUMBER/resourceGroups/RESOURCE_GROUP_NAME/providers/Microsoft.CognitiveServices/accounts/OPENAI_SERVICE details. Please consider grant Azure Machine Learning (appId: 0736f41a-0425-4b46-bdb5-1563eff02385) read or contributor access to connected resource.

Unfortunately i cannot find any resource with id: 0736f41a-0425-4b46-bdb5-1563eff02385, neither have I an Azure Machine Learning resource.

Luca
Luca Pio Miano 20 Reputation points

2025-05-19T08:26:27.1366667+00:00

Hello @Prashanth Veeragoni , @Saideep Anchuri

The problem had nothing to do with the one I mentioned earlier, I finally managed to solve it.
The problem is that the connected resource in AIHub has to be configured with Managed EntraID authentication instead of Api Key authentication, doing so I managed to access the agent successfully.

Best regards.

Luca
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-20T02:02:53.48+00:00

Hi Luca Pio Miano,

Glad to know that you were able to resolve the issue! Thank you for sharing the root cause — configuring the connected resource in AIHub with Managed EntraID authentication instead of API Key authentication.

Answer 1

Hi Luca Pio Miano,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.

Ask: Unable to access Azure OpenAI from AI project

Solution: The issue is resolved. The problem had nothing to do with the one I mentioned earlier, I finally managed to solve it. The problem is that the connected resource in AIHub has to be configured with Managed EntraID authentication instead of Api Key authentication, doing so I managed to access the agent successfully.

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

If you have any other questions, please let me know. Thank you again for your time and patience throughout this issue.

Please don’t forget to Accept Answer and Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members.

Thank you!

Answer 2

Luca Pio Miano 20

Hi @Prashanth Veeragoni ,

Thank you for your answer.

I carely realized all of the steps you suggested:

I've recreated an Azure AIHub resource with Managed VNet enabled and created a private endpoint pointing to the OpenAI resource inside Managed VNet.

I've also created a private endpoint for Azure OpenAI resource inside my VNet as well as disabling public access.

I've also tested the DNS resolution from inside a VM inside the same VNet but I'm still having the same issue trying to connect from AI Project Agents section.

I still cannot see how to put the AI Project resource inside the same VNet of the OpenAI private endpoint, the one that I've created, not the Managed one. There is no such option

Any ideas?

Luca

Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-07T04:55:03.1766667+00:00
Hi Luca Pio Miano,

You cannot place the Azure AI Project or its Agents into your own custom VNet. It always runs inside a Microsoft-managed VNet (called a Managed Virtual Network, or MVNet) its platform limitation.

To resolve the issue and make the Agents section access the Azure OpenAI resource, the private endpoint must be created in the Managed VNet of the AI Project, not in your own VNet.

1.Identify the Managed VNet created by the AI Project.

·       These are auto-created and look like:

vnet-region-project-<GUID>

2.Create a new private endpoint for the Azure OpenAI resource, and during setup:

·       Under "Virtual Network", select the AIHub’s Managed VNet.

·       This makes the OpenAI endpoint reachable by the AI Project runtime.

3.Ensure DNS resolution:

·       Link the private DNS zone privatelink.openai.azure.com to the Managed VNet.

·       Or use Azure-provided DNS if already linked.

Hope this helps.

Thank you!
Luca Pio Miano 20 Reputation points

2025-05-07T16:37:05.3033333+00:00

Hi @Prashanth Veeragoni

Thank you for the answer.

This is what I've done to add the private endpoint for openai inside de managed vnet, it says active so it should be working but i still get the same connection problem

If I try to access the private endpoint, to investigate further more, by clicking on it, I get an unathorized error, i can clearly see that a resource group has been created (commonHoboRG1) but i cannot see it, even if I have admin role
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-09T02:32:28.28+00:00

Hi Luca Pio Miano,

Following up to see if the above suggestion was helpful. And, if you have any further queries do let me know.

Thank you!
Prashanth Veeragoni 4,930 Reputation points Microsoft External Staff Moderator

2025-05-12T00:58:33.4266667+00:00

Hi Luca Pio Miano,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thank you!

Share via

Unable to access Azure OpenAI from AI project

1 additional answer

Your answer