AI foundry network settings

Question

Graph AI Foundry is configured with Selected Networks, a Private Endpoint, NSG rules on the subnet, and required inbound/outbound service tags are allowed. However, new clients are unable to access the Foundry portal unless they add their client VPN IP in the networking settings.

How can users access the Foundry portal securely over an Azure VPN without requiring each client to manually add their VPN details to the networking configuration?

Answer 1

Hi @Annaladesi Venugopal (LTIMINDTREE LIMITED)

Welcome to Microsoft Q&A Platform.

As discussed on Teams, I understand that you are trying to access AI Foundry using MSFT_AZVPN and encountering a 403 error. This occurs because the AZVPN traffic is coming from a different IP, not from the virtual network or private endpoint.

Since the VPN uses dynamic IPs, adding a single public IP may work temporarily, but the issue can reoccur when the IP changes. The IP seen in the browser may not be the actual source IP reaching AI Foundry.

To identify the correct source IP, please check the Azure Diagnostics logs, where you can find the actual source IP of the incoming traffic.

Alternatively, you can:

• Add the full IP range in the AI Foundry firewall settings, or
• Reach out to the AZVPN team to obtain the complete VPN IP range and allowlist it accordingly.

Pleaseand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.