Connection Timeout Error in Azure OpenAI Studio without public access on search service

Hello Dennis !

Thank you for posting on Microsoft Learn.

When public access is disabled on your Azure Cognitive Search (ACS) resource, only explicitly allowed networks or trusted Azure services can access it.

However, Azure OpenAI Studio (the web interface) is not considered a trusted service under “Allow trusted Azure services” for ACS. So:

• The index creation step (run server-side by Azure OpenAI) might still succeed, depending on timing or caching.
• But the index update step fails because the backend service running that operation cannot reach ACS if public access is blocked.

So you need to allow public access just while uploading and indexing data in Azure OpenAI Studio.

But if you want secure access without public exposure, you need to enable private endpoint on your Azure AI Search resource and verify that your Azure OpenAI resource (or a managed identity used by your backend) is in the same Virtual Network or has access to it.

Then, update your search index via code, Azure Function, or Azure ML pipeline not via OpenAI Studio, which lacks VNet support.

Or, simply use the Azure OpenAI REST API or Azure ML pipeline to upload data and update the ACS index from within your VNet.

Hi Dennis BC,
To securely manage this without exposing your ACS to the public internet, you should use a private endpoint for Azure Cognitive Search, ensuring that only trusted services or resources within your Virtual Network (VNet) can access it.

You’ll need to ensure that the Azure OpenAI Studio or any Azure service interacting with ACS has network access to the ACS resource. However, Azure OpenAI Studio itself does not support private endpoint connections directly, so this solution will require you to handle the indexing via code or other Azure services like Azure Functions or Azure ML pipelines.

Steps:

Enable Private Endpoint on the Azure Cognitive Search (ACS) resource.

This ensures that your ACS can only be accessed by resources inside your VNet.

reference : https://learn.microsoft.com/en-us/azure/search/service-create-private-endpoint

Set up a Managed Identity or Azure Function/Azure ML Pipeline within the same VNet to interact with the ACS.

reference : https://learn.microsoft.com/en-us/azure/search/search-how-to-managed-identities?tabs=portal-sys%2Cportal-user

Use an Azure Function or Azure REST API to handle the embedding and index update tasks instead of relying on Azure OpenAI Studio.

Azure AD Authentication can be used to secure access between services (Azure Function -> ACS).

This approach avoids public exposure and ensures that your search service remains securely behind a VNet.

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Vishvani