connectivity between azure cognitive services and storgae account through private account

Question

connectivity between azure cognitive services and storgae account through private account

Surya Y 0

Hi,

I am trying to establish a secure private connection between Azure document intelligence and storage account using azure private endpoint but I am facing an issues

while document intelligence is calling the storage account to download the pdf through private IP storage account is blocking it as it's treating it as public request for safer sideI have added resource instance and Allow Azure services on the trusted services list to access this storage account is also checked when Public network access is Enabled from all networks it's working. PFA could anyone please share some suggestions. Best, Surya

Nandamuri Pranay Teja 4,445 Reputation points Microsoft External Staff Moderator

2025-08-07T12:50:59.0133333+00:00
Hello Surya Y

Thank you for posting the question!

In Image 2, I can see you're using "Enabled from all networks" which bypasses the private endpoint. Try this instead:

Change Public network access to: "Enabled from selected virtual networks and IP addresses" Add the Virtual Network where Document Intelligence operates:

In the "Virtual networks" section, click "Add existing virtual network"

Select the VNet where your Document Intelligence service runs

Add the specific subnet

In Image 1, ensure your private endpoint shows "Approved" status (which it does)

Check DNS Resolution: Document Intelligence needs to resolve the storage account FQDN to the private IP. The private endpoint should automatically create DNS records Verify: nslookup yourstorageaccount.blob.core.windows.net should resolve to private IP (10.x.x.x)

Since you mentioned adding resource instances: Add Document Intelligence as Resource Instance Resource type: Microsoft.CognitiveServices/accounts,Instance name: Your Document Intelligence service name, this explicitly allows that specific service.

Enable the "Microsoft routing" option shown in Image 2:

Check "Allow read access to storage metrics from any network"

This helps with service-to-service communication over private networks

Post which Test the private endpoint try accessing the storage account from a VM in the same VNet. Check effective routes: Ensure traffic routes through the private endpoint. Monitor logs: Check storage account logs to see if requests are coming from private vs public IPs.

Let me know if you have any questions I'm happy to assist you.

1 answer

Your answer

Nandamuri Pranay Teja 4,445 Reputation points Microsoft External Staff Moderator

2025-08-07T12:50:59.0133333+00:00

Hello Surya Y

Thank you for posting the question!

In Image 2, I can see you're using "Enabled from all networks" which bypasses the private endpoint. Try this instead:

Change Public network access to: "Enabled from selected virtual networks and IP addresses" Add the Virtual Network where Document Intelligence operates:

In the "Virtual networks" section, click "Add existing virtual network"

Select the VNet where your Document Intelligence service runs

Add the specific subnet

In Image 1, ensure your private endpoint shows "Approved" status (which it does)

Check DNS Resolution: Document Intelligence needs to resolve the storage account FQDN to the private IP. The private endpoint should automatically create DNS records Verify: nslookup yourstorageaccount.blob.core.windows.net should resolve to private IP (10.x.x.x)

Since you mentioned adding resource instances: Add Document Intelligence as Resource Instance Resource type: Microsoft.CognitiveServices/accounts,Instance name: Your Document Intelligence service name, this explicitly allows that specific service.

Enable the "Microsoft routing" option shown in Image 2:

Check "Allow read access to storage metrics from any network"

This helps with service-to-service communication over private networks

Post which Test the private endpoint try accessing the storage account from a VM in the same VNet. Check effective routes: Ensure traffic routes through the private endpoint. Monitor logs: Check storage account logs to see if requests are coming from private vs public IPs.

Let me know if you have any questions I'm happy to assist you.

Answer 1

Surya Y 0

HI @Nandamuri Pranay Teja ,

Thanks for your response!

Regarding(1.Change Public network access to: "Enabled from selected virtual networks and IP addresses" Add the Virtual Network where Document Intelligence operates:)

I am using the same settings and Document intelligence Private endpoint is in Pe-subnet User's image

User's image

Regarding Check DNS Resolution User's image

Note: Ensure traffic routes through the private endpoint this is the main task as storage account is treating the document intelli call as public and it's blocking

I am not sure what is missing !!! it's working with Public network access is Enabled from all networks but we can't use it right?

Nandamuri Pranay Teja 4,445 Reputation points Microsoft External Staff Moderator

2025-08-08T09:27:47.0633333+00:00
Hello Surya Y

Thank you for the response!

Based on your screenshots, I can see Private endpoint exists and is enabled. DNS resolution shows private IP (10.0.8.12) Virtual networks are configured but Traffic is still going through public path.

Based on your setup, the most likely issue is Document Intelligence doesn't have its own private endpoint or VNet integration. Even though storage has a private endpoint, Document Intelligence might still be calling from public internet. Run these to verify:

# Check if Document Intelligence subnet can reach storage private IP ping 10.0.8.12 # Check routing table route -n # Verify NSG rules allow traffic

sometimes Document Intelligence may not be properly integrated with your VNet. There is different integration methods firstly Check which method you're using Private Endpoint for Document Intelligence, which is recommended, VNet Integration or Service Endpoints.

From your DNS test, I see the private IP resolution is working, but verify:

# Your nslookup shows private IP, which is good # But ensure Document Intelligence uses the same DNS

Coming to Document Intelligence Private Endpoint Configuration Create Private Endpoint for Document Intelligence:

Navigate to Document Intelligence resource > Networking → Private endpoint connections > Create private endpoint > Target sub-resource: accountUse same VNet and subnet as storage private endpoint.

So firstly, Verify Document Intelligence Private Endpoint

Document Intelligence → Networking → Private endpoint connections

If missing, create one targeting the same VNet

Step 2: Check DNS Resolution from Document Intelligence Context

The DNS resolution you showed (10.0.8.12) is from your machine. We need to ensure Document Intelligence service resolves the same way.

Let me know if you have any questions!
Nandamuri Pranay Teja 4,445 Reputation points Microsoft External Staff Moderator

2025-08-11T05:36:13.8266667+00:00

Hello Surya Y,

Just checking in to see if the provided answer helped. If you have any further queries do let us know.
Surya Y 0 Reputation points

2025-08-11T05:39:25.4366667+00:00

Hi @Nandamuri Pranay Teja ,

if Resolve DNS via public DNS servers: It will get the public IP address of your storage account Be blocked by the storage account's firewall Since the public access is restricted to "Selected virtual networks and IP addresses the private endpoint of document intelligence is in pe subnet which is in vnet so we can conclude document intelligence is vnet integrated for private route and for public route Allow Azure services on the trusted services list is enabled then why public call is also blocked by storage account?? see if we configure both private and public(enabled to VNET) endpoint for storage account it need to give response to calls respectively but why it's blocking even if document intelligence is trying to call using private and public call to SA

Nandamuri Pranay Teja 4,445 Microsoft External Staff Moderator

Hello Surya Y

What You're ExpectingDocument Intelligence → Storage Account

├── Private Route: Uses private endpoint (10.x.x.x)
└── Public Route: Uses public IP + Trusted Services

What Actually Happens is

Document Intelligence → Storage Account
├── DNS Resolution determines EVERYTHING
│   ├── Private DNS → Private IP → Private endpoint 
│   └── Public DNS → Public IP → Public firewall rules (doesn't work)
└── No "fallback" between routes

Please be informed that Azure's "Trusted Services" bypass only works when the service connects via Microsoft's internal backbone to the public endpoint.

Document Intelligence Service
│
├── Uses Microsoft Internal Network
├── Resolves DNS (could be private or public)
│
└── If resolves to private IP (10.x.x.x):
    │── Goes through private endpoint
    │── Bypasses all firewall rules
    │── Should work 
    │
└── If resolves to public IP (52.x.x.x):
    │── Goes to public endpoint  
    │── Subject to firewall rules
    │── Should use "Trusted Services" bypass ✅
    │── BUT: Something is wrong here

Azure doesn't provide automatic fallback between private and public routes. DNS resolution determines the path, and once a private endpoint exists with private DNS, services in that VNet will always try the private route first. If that fails, there's no automatic fallback to public + trusted services.

Share via

connectivity between azure cognitive services and storgae account through private account

1 answer

Your answer