How to fix 403 forbidden error with Knowledge Retreival using private Azure Foundry

Question

How to fix 403 forbidden error with Knowledge Retreival using private Azure Foundry

Pulin Gupta 0

I am working with Azure Foundry Knowledge Base. created Azure Foundry with public_access disabled. Created AI Search and was trying to use model from private azure foundry. the response results in 403 forbidden. The role "Cognitive Services OpenAI User" is assigned to Search Identity towards foundry and shared connection was created from search to foundry using subresource as cognitiveservices_account. The connection got approved but retrieval is not working and thoring error 403 forbidden "Could not complete model action. The model endpoint returned status code '403' (Forbidden). Public access is disabled. Please configure private endpoint.". This worked last week but for some reason stopped working this week. Could you please check what is the issue and how to enable private outbound connection from AI Search to private foundry.

Anshika Varshney 15,030 Reputation points Microsoft External Staff Moderator

2026-07-15T21:53:01.2066667+00:00

Hello @Pulin Gupta

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thankyou!
Anshika Varshney 15,030 Reputation points Microsoft External Staff Moderator

2026-07-16T20:08:59.5233333+00:00

Hello @Pulin Gupta

If these steps resolve your issue, please mark this answer as Accepted so others can easily find the solution.

If you still face problems, share additional details and we’ll assist further.

Thankyou!

2 answers

Your answer

Anshika Varshney 15,030 Reputation points Microsoft External Staff Moderator

2026-07-15T21:53:01.2066667+00:00

Hello @Pulin Gupta

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Thankyou!
Anshika Varshney 15,030 Reputation points Microsoft External Staff Moderator

2026-07-16T20:08:59.5233333+00:00

Hello @Pulin Gupta

If these steps resolve your issue, please mark this answer as Accepted so others can easily find the solution.

If you still face problems, share additional details and we’ll assist further.

Thankyou!

Answer 1

Hello @Pulin Gupta

The error indicates that authentication is likely working, but the network path being used by the knowledge retrieval service is being treated as a public connection while public access is disabled on the Azure AI Foundry/OpenAI resource. Assigning the Cognitive Services OpenAI User role only grants permission, it does not provide network connectivity.

Since the configuration was working previously, I recommend verifying the following:

Confirm that the Azure AI Foundry/OpenAI resource still has a healthy and approved private endpoint connection.
Check the status of the shared private link connection between Azure AI Search and the Foundry/OpenAI resource.
Verify private DNS resolution for the private endpoint and ensure no DNS changes were introduced.
Confirm that the knowledge base is using the correct model deployment and endpoint configuration.
Review the managed identity role assignments on both the Search service and the Foundry/OpenAI resource.

The key part of the error is: "Public access is disabled. Please configure private endpoint."

This suggests the request is not reaching the model through the expected private network path.

If all networking, DNS, private endpoint, and shared private link configurations appear correct, please share the following details so we can investigate further:

Azure AI Search service name
Azure AI Foundry/OpenAI resource name
Region
Shared private link connection name
Correlation/Request ID
Approximate timestamp when the failure occurred

These details will help determine whether this is a configuration issue or a backend service-side problem.

Thankyou!

Answer 2

hi Pulin Gupta & thx for sharing urs issue here at Q&A portal,

This 403 is pretty clear AI Search is reaching the model endpoint through a path that Foundry sees as public, and public access is disabled. The RBAC role is only one part. Cognitive Services OpenAI User allows auth, but it doesn’t fix network reachability. If the endpoint requires private access, Search must use a supported private path to that Foundry/OpenAI resource. Since this worked last week and stopped now, I’d check first whether anything changed in

Foundry public network access setting

private endpoint approval/state

private DNS zone records

shared private link connection from Search

Search managed identity role assignment

model deployment/resource endpoint being used by the knowledge base

https://learn.microsoft.com/azure/search/search-indexer-howto-access-private & https://learn.microsoft.com/azure/ai-foundry/how-to/configure-private-link

If all config still looks correct, this may need Microsoft support because AI Search outbound to private Foundry/model endpoints is service-side plumbing. Include the Search service name, Foundry resource, region, connection name, timestamp, and request/correlation ID. The real root cause is not the role assignment by itself. The error says network path: public access disabled, private endpoint required.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/