Share via

Access and Configure Azure AI Document Intelligence from On Premise Network

Abhishek kumar 0 Reputation points
2025-08-08T13:46:36.67+00:00

We have configured document intelligence in our organization cloud subscription. We have setup vnet for document intelligence and created private endpoints as well also selected the network settings only private network and selected IP. Now while calling the api from on premise VM it throws error 403 access denied due to virtual network/ firewall rules. I managed to solve this by adding my client IP option in the document intelligence resource network setting. It worked fine after that. But we dont want to add any Ip here because of security reasons as its NAT address. How can we solve this issue? Without adding any client Ip manually how can we securely access document intelligence successfully? Any help would be highly appreciated

Azure AI Document Intelligence
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vinodh247 36,031 Reputation points MVP Volunteer Moderator
    2025-08-10T05:38:42.26+00:00

    Hi ,

    Thanks for reaching out to Microsoft Q&A

    Suggestions that you can try:

    create hybrid connectivity from on-prem to the azure vnet that contains the private endpoint site-to-site vpn (azure vpn gateway) or expressroute with private peering. This ensures your on-prem vm can route to the private endpoint ip.

    ensure dns resolution of the document intelligence fqdn to the private endpoint ip from on-prem

    you must resolve the resource host name to the private ip. Use an azure private dns zone linked to the vnet and then enable hybrid DNS resolution by either:

    • using an azure dns private resolver inbound endpoint and add that inbound ip as a conditional forwarder on your on-prem dns servers, or
    • run a DNS forwarder vm in Azure and point your on-prem conditional forwarder to it.

    check routing and nsg/udr

    ensure your on-prem > azure VPN/ER route includes the private endpoint subnet and no udr/nsg blocks that traffic. Use the private endpoint ip to validate connectivity (ping/tcping if allowed) and nslookup to validate name resolution.

    remove client ip from the document intelligence resource access controls

    once on-prem resolves and routes to private ip, the request will come from the private network path and the public IP check is not required.

     

    Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.