Share via

Azure AI Foundry: API endpoints still publicly visible even with private access only

RONY SANTIAGO BANOL RICO 0 Reputation points
2025-10-16T20:57:53.8333333+00:00

Hello.

I’m trying to deploy an Azure AI Foundry service for a client. The idea is to restrict access by the client’s IPs only.

However, the API endpoints are still publicly visible — they look like an IP address and return:

{"error": {"code": "404", "message": "Resource not found"}}

This happens even when networking is disabled and the service is supposed to be accessible only through private endpoints.

In some cases, the endpoint just shows a blank white page, but it’s still reachable from the internet.

Is there any way to completely block these endpoints from being exposed publicly — so they don’t even appear accessible in a browser?User's image

User's image

User's image

Azure OpenAI Service
Azure OpenAI Service
An Azure service that provides access to OpenAI’s GPT-3 models with enterprise capabilities.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. SRILAKSHMI C 8,545 Reputation points Microsoft External Staff Moderator
    2025-10-17T02:16:05.29+00:00

    Hello RONY SANTIAGO BANOL RICO,

    Welcome to Microsoft Q&A.

    Thank you for providing the details and screenshots. I understand that you’ve configured your Azure AI Foundry service to allow access only via private endpoints, but you’re still seeing the public API endpoint returning a 404 response when accessed from the internet.

    This behavior is expected and does not indicate that your resource is publicly accessible. Even when public network access is disabled, the DNS record for the endpoint may still resolve, but the service itself will reject any incoming requests from unauthorized networks. The 404 (“Resource not found”) response simply confirms that the endpoint exists at the DNS level but is not serving any content publicly meaning the resource is secure and inaccessible over the internet.

    To ensure that your configuration is set up correctly, please review the following:

    Verify that your private endpoints are correctly configured and linked to your Azure AI Foundry service and the desired virtual network.

    Network Configuration –

    • Go to your Azure resource → Networking.
    • Confirm that public network access is disabled.
    • Ensure that private endpoint connections are active and approved.

    Firewall Settings –

    • Navigate to Resource Management → Networking → Firewalls and virtual networks.
    • Make sure access is restricted only to specific IP ranges or VNets as required.

    Check if there are any overriding network or service endpoint policies that might unintentionally allow external access. Adjust these to ensure full privacy.

    Double-check that all public access options are turned off under the Networking section of your resource to prevent any unintended exposure.

    • Run a test using curl -v or a browser from an external network; you should see a 404 or blocked connection, which indicates no public access.
    • Access the service internally via your private endpoint to confirm that it works as expected.

    If you have already verified all these configurations and are still observing the same behavior, you can try removing and re-adding the private endpoints following the steps in the this documentation on configuring a private link for Azure AI Foundry.

    The 404 response you’re seeing is expected and secure behavior it confirms that your service is not publicly accessible. The DNS record remains visible only for Azure routing consistency and doesn’t expose your resource in any way.

    Also please refer this How to configure a private link for Azure AI Foundry

    I Hope this helps. Do let me know if you have any further queries.

    Thank you!

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.