Skip to main content
Use a virtual network (VNet) to isolate evaluation traffic in Microsoft Foundry. This article helps you choose the appropriate network setup guidance, configure evaluation-specific requirements, and resolve common network-related evaluation errors.

​
Prerequisites

  • A Foundry project in a region that supports VNet evaluation.
  • Permissions to configure network isolation and assign Azure role-based access control (RBAC) roles.
  • A VNet and a subnet that you can delegate for network injection, or permission to deploy them by using the evaluation-only setup template.

​
Choose network setup guidance

Use the following table to find the networking guidance for your scenario. Return to this article for requirements and troubleshooting that are specific to evaluation.

​
Configure evaluation network requirements

Virtual network support for evaluation requires network injection through subnet delegation. If you only need evaluation capabilities and don’t require full agent support, such as Azure Cosmos DB, Azure AI Search, or a project capability host, use the simplified evaluation-only setup template (15a). The template deploys a minimal network-secured environment for evaluation scenarios.
To prevent evaluation and red teaming run failures, assign the Foundry User role to the project’s managed identity at the Foundry resource scope during initial project setup.
The Foundry RBAC roles were recently renamed. Foundry User, Foundry Owner, Foundry Account Owner, and Foundry Project Manager were previously named Azure AI User, Azure AI Owner, Azure AI Account Owner, and Azure AI Project Manager. You might still see the previous names in some places while the rename rolls out. The role IDs and core permissions are unchanged by the rename.
If you connect Application Insights, evaluation data is sent to it.

​
Virtual network region support

You can bring your own VNet for evaluation in the following regions:

​
Configure virtual network support for data generation

Synthetic data generation and trace-to-dataset generation use the same network injection through subnet delegation as evaluation. Use the evaluation-only setup template (15a) to deploy the required network-secured environment. For data-generation region availability, see Supported regions for data generation.

​
Troubleshoot virtual network evaluation errors

​
Diagnose your virtual network configuration

Run the VNet project setup diagnostic from a machine that has private connectivity to your virtual network. The script inspects an existing Foundry project configuration and its network connectivity without running an evaluation or changing Azure resources. Follow the usage guide to prepare the prerequisites, run the appropriate diagnostic checks, and review the generated diagnostics.md report. The report provides actionable findings, supporting evidence, known limitations, and remediation guidance to help you resolve configuration issues.

​
Evaluation run remains in progress until it times out

An evaluation run can remain In progress because the network isolation setup is incomplete, required private endpoints aren’t configured while public network access is disabled, or the project’s managed identity doesn’t have permission to update the run status. To resolve the issue:
  1. Verify that network injection and subnet delegation are configured as described in Configure network isolation for Microsoft Foundry. If you only need evaluation capabilities, compare your deployment with the evaluation-only setup template (15a).
  2. If public network access is disabled, verify that the required private endpoints are configured and approved, and that private DNS resolves the resource endpoints from the network that was injected to Foundry project.
  3. Ensure the Foundry project has capability host setup. We do need the capability host both at Foundry account and project level. If you didn’t setup Foundry project level capability host use the bicep template add-project-capability-host to setup.
  4. Verify that the project’s managed identity has the Foundry User role at the Foundry resource scope.
  5. For a large dataset, run an evaluation against a smaller representative subset. If the smaller run completes, reduce the dataset size or split the dataset across multiple evaluation runs.

​
Evaluation run fails to start with a 403 error

The error states that network access is disabled, public network access is disabled but the evaluation service can’t reach one or more required resources through the VNet. Error: Public access is disabled. Please configure private endpoint. To resolve the issue:
  1. Identify the resource hostname in the error details or evaluation diagnostics.
  2. Verify that network injection and subnet delegation are configured for evaluation.
  3. Verify that the private endpoint for the affected resource is configured and approved.
  4. Verify that private DNS resolves the hostname and that network rules allow access from within the VNet.
  5. Retry the evaluation run after the network configuration changes take effect.
For other 403 errors, verify the RBAC assignments for the user who starts the run and for the project’s managed identity. For more evaluation-specific issues, see Troubleshoot evaluation and observability issues.

​
Custom DNS doesn’t resolve private endpoints

If you define a custom DNS server for a virtual network, the system doesn’t automatically query private DNS zones linked to that virtual network. The custom DNS settings override the name resolution order. To enable custom DNS to resolve the private zone, use an Azure DNS Private Resolver in a virtual network linked to the private zone. For configuration guidance, see Centralized DNS architecture. If your custom DNS server runs on an Azure virtual machine, configure a conditional forwarder for the private zone. Set the forwarder’s destination to the Azure DNS IP address, 168.63.129.16.