Share via

AI Search indexer fails when both AI Search and Blob Storage have network restrictions - need PC/client IP configuration?

Su Myat Hlaing 200 Reputation points
2025-08-07T05:31:31.8233333+00:00

Hi,

I have both Azure AI Search and Blob Storage configured with "Selected networks" (restricted access). When I run my AI Search indexer from my PC, I get a connection error to the blob storage.

Current setup:

  • AI Search: Network restricted to selected IPs
  • Blob Storage: Network restricted to selected IPs
  • Running indexer trigger from my PC

Error:

Error message
Credentials provided in the connection string are invalid or have expired. For more information on troubleshooting connection issues to Azure Storage accounts, please see https://go.microsoft.com/fwlink/?linkid=2049388

Additional context: The indexer works fine when I set Blob Storage to "All networks", confirming the credentials are correct.

Question: In my Blob Storage network settings, what IP addresses do I need to whitelist to allow the AI Search indexer to run successfully?

Azure AI Search
Azure AI Search
An Azure search service with built-in artificial intelligence capabilities that enrich information to help identify and explore relevant content at scale.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vishvani Jilukara 5 Reputation points Microsoft External Staff Moderator
    2025-08-08T07:46:52.3933333+00:00

    Hii Su Myat Hlaing, Yes, using Managed Identity is the recommended and secure approach for your scenario where both Azure Cognitive Search and Azure Blob Storage are restricted to Selected Networks. 

    Why Managed Identity Is the Right Approach

    1. Secure Authentication
      • Managed Identity eliminates the need to store and manage credentials like connection strings or keys.
      • You don’t expose secrets that could be leaked or compromised.
    2. Network Compatibility
      • By allowing resource access via "Resource instances" in your Blob Storage network settings, you bypass the need for public IP whitelisting.
      • This makes your setup more secure and cloud-native.
    3. Granular Access Control
      • You can assign only the necessary role (e.g., Storage Blob Data Reader) to the AI Search service.
      • This follows the principle of least privilege.
    4. Scalability and Maintenance
      • No need to manage IP addresses (which can change).

    Works seamlessly across environments (e.g., dev/test/prod).

    You can mark it 'Accept Answer' and 'Upvote' if this helped you

    Regards,

    Vishvani

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.