How to Connect AI Foundry Agent to Azure Search Behind a Firewall

Select Language:

If you’re trying to connect your Foundry AI agent to Azure Search services that are set to only allow access from specific networks, you might run into some connection issues. Here’s a simple way to handle this situation.

First, check your Azure Search service settings. If it’s set to “access with selected networks,” only certain IP addresses or networks can connect. If you want your Foundry agent to connect without changing this setting, ensure that the network where the agent runs is included in the allowed networks. That might mean adding your agent’s IP address or virtual network to the list of trusted networks.

Next, verify the permissions of the identity used by your AI agent. The error indicates that the project managed identity needs roles like “Search Index Data Reader” and “Search Service Contributor.” Make sure these roles are assigned properly to the managed identity in Azure.

If you’re using a private endpoint for security, there could be DNS or network configuration issues. When setting up private endpoints, confirm that the DNS resolves the search service hostname correctly and that your network allows traffic to that endpoint.

Finally, when the search service is restricted to certain networks, connecting from outside those networks won’t work unless you modify the network rules. To connect from outside, you have two options:

Add your agent’s network to the allowed list in the Azure Portal.
Use a virtual network or VPN so that your agent operates within the trusted network.

In summary, to connect your Foundry agent to an Azure Search service that isn’t set for all networks: