cannot access azure ai search after putting it in a private endpoint

Hello MarwanSamrout-7915,

Thanks for raising this question in Q&A forum.

Classic private endpoint issue - 3 fixes needed when publicNetworkAccess: Disabled:

1. App Service VNet Integration

text
App Service → Networking → VNet integration → Add:
- VNet: Same as AI Search PE
- Subnet: App Service subnet (delegated)
- Route All: Enabled

Verify: SSH → nslookup yoursearch.search.windows.net → Private IP

2. Private DNS Zone

text
Private DNS Zones → + Create:
- Name: `privatelink.search.windows.net`
- Link to VNet (both App Service + AI Search subnets)

A/CNAME record auto-created by PE

3. AI Search Networking

text
AI Search → Networking:
- ✅ Allow trusted Microsoft services (for Custom QnA)
- ❌ Public network: Disabled (correct)

NSG Check (App Service subnet):

text
Allow outbound: Port 443 → search.windows.net (Service Tag)

Test: App Service → Kudu/SSH → curl https://yoursearch.search.windows.net → Works.

Custom QnA: Trusted services = enough (no VNet needed for QnA service itself).

Most likely: Missing VNet integration or DNS zone. Add both → Works in 10 mins. If it helps kindly accept the answer.

Cheers,

Jerald Felix

Hi @MarwanSamrout-7915,

Thank you for reaching us regarding the issue of accessing Azure AI Search after configuring it with a private endpoint and disabling public access.

When publicNetworkAccess is Disabled, Azure AI Search rejects all traffic sent to its public endpoint, including traffic originating from Azure services.

In this scenario, one or more of the following is true:

1. The App Service is not properly VNet‑integrated
   • App Service does not live inside the VNet by default.
   • Without Regional VNet Integration, outbound traffic goes over the public internet.
2. Private DNS is missing or not linked
   • Azure AI Search private endpoints require private DNS resolution.
   • The service FQDN https://<search-name>.search.windows.net must resolve to a private IP, not a Microsoft public IP.
   • Without correct DNS, the App Service unknowingly calls the public endpoint → request is denied.
3. “Allow trusted Azure services” does not apply
   • This setting only works when public network access is enabled.
   • When publicNetworkAccess = Disabled, only private endpoint traffic is allowed.
   • App Service is not exempt.

Recommended actions:

1. Create a private endpoint for Azure AI Search.
2. Create Private DNS Zone : privatelink.search.windows.net

• DNS zone linked to the same VNet used by the App Service
• DNS record for the search service resolves to a private IP.

3. App Service

• Regional VNet Integration enabled.
• Integrated with a subnet in the same VNet as the private endpoint.
• Subnet is delegated to Microsoft.Web/serverFarms

4. Networking

• NSGs allow outbound traffic to the private endpoint subnet
• No UDR forces traffic to the internet or firewall without private routing

Reference:
https://learn.microsoft.com/en-us/azure/search/service-create-private-endpoint
https://learn.microsoft.com/en-us/azure/search/service-configure-firewall
https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/troubleshoot-vnet-integration-apps
Kindly let us know if the above helps or you need further assistance on this issue.

 Please "upvote" if the information helped you. This will help us and others in the community as well.

Hello @MarwanSamrout-7915

Thank you for reaching out Microsoft Q&A. Please could you let us know from where you're trying to access Azure AI search.

im trying to access it from azure app service using ai search rest api

Hello MarwanSamrout-7915,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you cannot access azure ai search after putting it in a private endpoint.

Since @Jerald Felix checklist is largely answering the issue and maps to Azure’s documented best practices conditionally. For more unresolved issues, follow the steps below:

1. Ensure Private Endpoint on AI Search is “Approved” and note its private IP. - https://learn.microsoft.com/en-us/azure/search/service-create-private-endpoint
2. Make sure from App Service > VNet Integration

• Integrate with the same VNet (different, dedicated subnet).
• Route all outbound (Application routing; optionally outboundVnetRouting.allTraffic for full coverage, or legacy WEBSITE_VNET_ROUTE_ALL=1) - https://learn.microsoft.com/en-us/azure/app-service/configure-vnet-integration-routing and https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/app-service/configure-vnet-integration-routing.md gives you more insight.

3. On private DNS:

• Create privatelink.search.windows.net.
• Link it to the App Service VNet.
• Verify the A‑record for your Search service exists and points to the PE private IP. -https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns

4. In your AI Search > Networking, ensure Public network access = Disabled. Enable Trusted Services (needed for Azure OpenAI/Custom ). - https://learn.microsoft.com/en-us/azure/search/service-configure-firewall and https://stackoverflow.com/questions/77861840/how-do-i-make-a-secure-connection-from-azure-openai-to-an-azure-search-instance gives more insight.
5. Also, validate from Kudu

• Linux: nslookup <name>.search.windows.net → private IP + privatelink alias.
• Windows: nameresolver.exe <name>.search.windows.net and tcpping.exe <name>.search.windows.net 443.
• If not private, fix Step 3; if TCP fails, review NSG/UDR/firewall on the App Service integration subnet. - https://learn.microsoft.com/en-us/troubleshoot/azure/app-service/troubleshoot-vnet-integration-apps - and - https://blog.zuehlke.cloud/2022/10/app-services-with-private-endpoint-and-outbound-routing/ is more detailed.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.