Unable to access Azure OpenAI from AI project

Question

Unable to access Azure OpenAI from AI project

Luca Pio Miano 0

Hello,

I've been trying to access my azure OpenAI resources from an Azure AI project in the Agents section but i always get this error when i try to load the resources.

Unable to access your agents Public access is disabled in the AI Service. Please open and configure a private endpoint connection. Learn more

I've also tried to setup the Azure AIHub where the project is deployed by enabling the managed virtual network option and creating a private endpoint for the OpenAI resource but i still get the error.

Apparently the OpenAI resource is correctly connected, i can clearly see the models deployed into it and if i try to open the chat and ask something to one of the models from the Playground section inside the AI Project everything works fine, the only problem is for the Agents section.

Any ideas?

Prashanth Veeragoni 4,105 Reputation points Microsoft External Staff

2025-05-06T02:28:08.75+00:00
Hi Luca Pio Miano,

Thanks for providing the detailed explanation — this is a common issue related to network isolation and access control in Azure AI Studio, especially when using private endpoints with Azure OpenAI. Let’s walk through a resolution plan.

The error message:

“Unable to access your agents. Public access is disabled in the AI Service. Please open and configure a private endpoint connection.”

...means that your Azure OpenAI resource has public access disabled, and the Azure AI project (Agents section) cannot reach it through a private endpoint yet — even though Playground seems to work.

This occurs because:

·       Playground uses internal access via AI Studio infrastructure (via Managed VNet).

·       Agents (Orchestration) uses a separate runtime that must explicitly route through private endpoints when public access is off.

Step-by-Step Fix:

Ensure Azure OpenAI Resource Has a Private Endpoint

·       Go to your Azure OpenAI resource > Networking.

·       Ensure Private Endpoint is created and in "Approved" state.

·       Check the subnet used by the private endpoint — it must allow the AI Project VNet traffic.

2.Disable Public Access (If Required)

·       Still under Networking, verify that:

o   Public access is disabled, and

o   Private endpoint is correctly bound to a VNet accessible from your AI Project.

If public access is disabled and no VNet integration is configured properly, Agent access will fail.

3.Ensure Azure AI Project Uses a Managed VNet

·       In your Azure AI Studio project settings:

o   Make sure "Enable Managed Virtual Network" is ON.

o   This ensures all resources (Agents, Jobs, etc.) run inside an isolated VNet.

If your project was created before enabling Managed VNet, you must create a new project with it turned on — it can’t be retrofitted.

4.Use Private DNS Zone Resolution

·       If your private endpoint connects to OpenAI via a private IP, ensure that the private DNS zone:

privatelink.openai.azure.com

·       is correctly linked to the VNet that the Azure AI project is using.

·       Also ensure custom DNS settings in your VNet aren’t breaking resolution.

You can check using Azure CLI or test from a VM in the same VNet:

nslookup your-openai-resource-name.openai.azure.com

5.Recreate Agent with Updated Config

·       After all networking changes, go back to Agents section:

o   Try removing the old Agent and re-adding a new one.

o   Make sure to select the right model and deployment from the now-resolved OpenAI resource.

Hope this helps, do let me know if you have any further queries.

Thank you!
Luca Pio Miano 0 Reputation points

2025-05-06T08:31:41.1566667+00:00

Hi @Prashanth Veeragoni ,

Thank you for your answer.

I carely realized all of the steps you suggested:

I've recreated an Azure AIHub resource with Managed VNet enabled and created a private endpoint pointing to the OpenAI resource inside Managed VNet.

I've also created a private endpoint for Azure OpenAI resource inside my VNet as well as disabling public access.

I've also tested the DNS resolution from inside a VM inside the same VNet but I'm still having the same issue trying to connect from AI Project Agents section.

I still cannot see how to put the AI Project resource inside the same VNet of the OpenAI private endpoint, the one that I've created, not the Managed one. There is no such option

Any ideas?

Luca

1 answer

Your answer

Luca Pio Miano 0 Reputation points

2025-05-06T08:31:41.1566667+00:00

Hi @Prashanth Veeragoni ,

Thank you for your answer.

I carely realized all of the steps you suggested:

I've recreated an Azure AIHub resource with Managed VNet enabled and created a private endpoint pointing to the OpenAI resource inside Managed VNet.

I've also created a private endpoint for Azure OpenAI resource inside my VNet as well as disabling public access.

I've also tested the DNS resolution from inside a VM inside the same VNet but I'm still having the same issue trying to connect from AI Project Agents section.

I still cannot see how to put the AI Project resource inside the same VNet of the OpenAI private endpoint, the one that I've created, not the Managed one. There is no such option

Any ideas?

Luca

Answer 1

Luca Pio Miano 0

Hi @Prashanth Veeragoni ,

Thank you for your answer.

I carely realized all of the steps you suggested:

I've recreated an Azure AIHub resource with Managed VNet enabled and created a private endpoint pointing to the OpenAI resource inside Managed VNet.

I've also created a private endpoint for Azure OpenAI resource inside my VNet as well as disabling public access.

I've also tested the DNS resolution from inside a VM inside the same VNet but I'm still having the same issue trying to connect from AI Project Agents section.

I still cannot see how to put the AI Project resource inside the same VNet of the OpenAI private endpoint, the one that I've created, not the Managed one. There is no such option

Any ideas?

Luca

Prashanth Veeragoni 4,105 Reputation points Microsoft External Staff

2025-05-07T04:55:03.1766667+00:00
Hi Luca Pio Miano,

You cannot place the Azure AI Project or its Agents into your own custom VNet. It always runs inside a Microsoft-managed VNet (called a Managed Virtual Network, or MVNet) its platform limitation.

To resolve the issue and make the Agents section access the Azure OpenAI resource, the private endpoint must be created in the Managed VNet of the AI Project, not in your own VNet.

1.Identify the Managed VNet created by the AI Project.

·       These are auto-created and look like:

vnet-region-project-<GUID>

2.Create a new private endpoint for the Azure OpenAI resource, and during setup:

·       Under "Virtual Network", select the AIHub’s Managed VNet.

·       This makes the OpenAI endpoint reachable by the AI Project runtime.

3.Ensure DNS resolution:

·       Link the private DNS zone privatelink.openai.azure.com to the Managed VNet.

·       Or use Azure-provided DNS if already linked.

Hope this helps.

Thank you!
Luca Pio Miano 0 Reputation points

2025-05-07T16:37:05.3033333+00:00

Hi @Prashanth Veeragoni

Thank you for the answer.

This is what I've done to add the private endpoint for openai inside de managed vnet, it says active so it should be working but i still get the same connection problem

If I try to access the private endpoint, to investigate further more, by clicking on it, I get an unathorized error, i can clearly see that a resource group has been created (commonHoboRG1) but i cannot see it, even if I have admin role

Share via

Unable to access Azure OpenAI from AI project

1 answer

Your answer