This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 33%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESP%3C/text%3E%3C/svg%3E)
Our Azure Search services has been set to access with selected networks and Trusted azure services are allowed to connect . However, as per documentation, when AI foundry agent uses EntraID, it should be able to connect, but i am receiving following errors;
tool_user_error: Error: search_access_error; Unable to access Azure AI Search index. Please ensure that the project managed identity has Search Index Data Reader and Search Service Contributor roles on the Search resource, and the Search resource allows role-based access. () Request is denied as the source is not allowed by applicable rules. The service is set 'publicNetworkAccess: Enabled'. Please review all service's network security settings to ensure the client is allowed.
Foundry agent has been set up with Standard Agent service network injection and setting up Private endpoint connections to search services results following error:
Can not connect to host, Please ensure Azure AI search connection has the correct endpoint , DNS server answer with no data
So, now my question is - How can i connect the standard agent from Foundry to Search services when search service is not configured for all networks ?
thanks
An Azure search service with built-in artificial intelligence capabilities that enrich information to help identify and explore relevant content at scale.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 51%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAN%3C/text%3E%3C/svg%3E)
Hello @Sandesh Poudel
Thank you for reaching out Microsoft Q&A. We will be reaching out in teams, as per the error please could you check managed identity under Azur portal>Search Service>Access control
Also as you are private endpoint, please could you verify the configuration.
Yes we have managed identity enabled for Search service. Yes private endpoint configuration seemed to fine. While i couldn't directly test the how DNS resolves to Search service from foundry.
What you’re running into is expected behavior. A Standard Foundry Agent with network injection cannot access Azure AI Search unless the Search service is reachable through private networking from the agent’s VNet. Allowing Trusted Azure services is not sufficient for Foundry agents.
I hope you find this helpful
♠ ♠ Ace ♠ ♠
How can i use private networking from Basic setup ? Is it a must to have standard setup with BYO virtual network to use AI search services ?
Answer accepted by question author
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(80, 7.000000000000001%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPM%3C/text%3E%3C/svg%3E)
As discussed offline, we have shared the recommended solution and configuration steps with you. Since the guidance has been confirmed, we are proceeding with case closure.