Author: DP Staff

If you’re having trouble accessing your original Microsoft Entra tenant, here’s a simple way to solve the issue:

First, understand that sometimes, tenants can become temporarily inaccessible or might seem to disappear from your account. This can happen due to a variety of reasons, such as configuration changes or account issues.

To start, try signing out of your Microsoft account completely. Then, clear your browser’s cache and cookies to ensure no outdated data is causing the problem. After that, sign back into your account and check if the tenant appears in your list of available tenants.

If the tenant still isn’t showing up, it’s a good idea to contact Microsoft Support directly. When reaching out, provide details like your tenant’s onmicrosoft.com domain and explain that you previously had access without any issues. Mention that it appears to have disappeared or is inaccessible now.

Ask the support team to investigate what happened to the tenant and see if they can help restore your access. Usually, they can look into account and tenant settings on their end and resolve any issues.

Following these steps should help you regain access to your original Microsoft Entra tenant. Remember to keep any relevant details handy when contacting support, which will help expedite the process.

If your Azure Database for PostgreSQL Flexible Server experiences unexpected downtime, don’t panic. The first step is to understand that since the issue is caused by the platform itself, Microsoft’s support and backend investigation are your best resources.

Start by checking the Resource Health status for your affected server. This tool provides specific insights into the health of your resource and can help identify if the problem is related to platform maintenance, outages, or other platform issues. If you see an event related to the downtime, the most reliable next step is to open a support request directly from that Resource Health event.

While restarting the server manually might bring the service back temporarily, it won’t reveal what caused the outage. To find the root cause, request a Microsoft backend Root Cause Analysis (RCA) support. This involves asking Microsoft support to investigate their internal logs and telemetry data, which are not accessible through customer-side logs like PostgreSQL logs or activity logs.

Submitting this support request ensures you get detailed insights into what caused the downtime, keeping you better informed and helping prevent similar issues in the future. Remember, the Resource Health tool can tell you if an impact was planned, unplanned, or user-initiated, but only Microsoft’s internal investigation can uncover the exact cause.

If you want more detailed information about Resource Health and how it works, you can review the official documentation here:

• Azure Service Health Resource Health FAQ
• Azure Resource Health Overview

Hopefully, this guidance helps you resolve the issue. Please don’t hesitate to reach out if you have any further questions, need more steps, or clarification. And if you find this information useful, consider not closing the conversation by upvoting or accepting the answer, so others can benefit too.

If you’re seeing an error related to Azure Container Apps not recognizing the OS or architecture from your image, don’t worry—it’s a common issue that isn’t about your Dockerfile being wrong. Usually, the problem stems from how the image was built and uploaded to your Azure Container Registry (ACR).

One common cause is when you build your Docker image using Docker Buildx and push a multi-platform or OCI index image. In these cases, the image’s manifest might not clearly specify that it’s a Linux or amd64 platform. Azure Container Apps expects a straightforward Linux image with a specific platform, commonly linux/amd64.

This often happens if you build your image on a machine with Apple Silicon (like M1, M2, or M3 chips) or if you skip specifying the platform during the build. The pushed image could then be linux/arm64 or a multi-arch manifest, which Azure Container Apps doesn’t recognize correctly, leading to the “invalid operating system” error.

To fix this, you should explicitly build and push the image for the linux/amd64 platform. If you’re using Docker Buildx, add the --platform linux/amd64 flag to your build command:

bash
docker buildx build –platform linux/amd64 -t .azurecr.io/: –push .

If you’re not using Buildx, you can set the platform during the simple Docker build process like this:

bash
docker build –platform linux/amd64 -t .azurecr.io/: .
docker push .azurecr.io/:

After pushing, verify what was uploaded by inspecting the image manifest:

bash
docker manifest inspect .azurecr.io/:

Look for these details in the output:

“os”: “linux”,
“architecture”: “amd64”

If the os field is missing or empty, or if only arm64 is listed, Azure Container Apps won’t accept it and will show the error you’re experiencing.

Additionally, ensure you’re pushing a standard Docker schema v2 image. If you used Buildx with --output type=oci, ACA might not process it correctly. Stick to the default push method described above for better compatibility.

Remember, building and pushing with a clear, specific platform makes all the difference in avoiding these errors. If this helps resolve your issue, please accept the answer so others can find this solution easily. Your support helps the community grow.

Good luck!

If you have a Microsoft Customer Agreement (MCA) and want to transfer a subscription from one billing account to another, even if the accounts are in different tenants, it is possible as long as you have the right billing permissions.

Since you’re the billing owner on both accounts and also own the subscription, the best way to do this is through a billing ownership transfer request from the new billing account.

Here’s how you can do it:

1. First, go to the account you want to transfer the subscription to.

   • Navigate to Cost Management + Billing.
   • Select the target billing account, then go to the billing profile and the invoice section.

2. Next, create a transfer request.

   • Find and click on “Transfer requests.”
   • Hit “Add new request.”
   • Enter the email address of the owner of the current billing account (or your own email if you’re the same person).

3. Approving the transfer.

   • Open the transfer request email you receive.
   • Select the subscription(s) you want to move.
   • Review the details carefully, then confirm the transfer.

4. Finalize the transfer.

   • Once approved, the billing ownership of the subscription will shift to the new billing account.

This process effectively moves the billing responsibility for the subscription to a different account that supports this transfer under the MCA setup.

For more detailed information on moving billing ownership, you can refer to this guide: Transfer Azure product billing ownership to a Microsoft Customer Agreement.

If you found this solution helpful, please consider giving it an upvote and marking it as accepted. Your support helps others in the community find useful answers more easily.

When planning changes to your Azure setup, it’s important to understand what each action does. Moving billing ownership by itself doesn’t affect your Entra directory or your Azure DevOps organization, which means your repositories and Boards will stay the same. However, changing the subscription’s directory can remove important permissions like Azure RBAC assignments, custom roles, service principals, managed identities, Key Vault access, and pipeline service connections. This can cause issues with access and automation.

If you’re merging organizations, the best approach is to keep your current Azure DevOps organization as it is. Instead of trying to merge it directly, connect it to the target company’s Entra tenant. Microsoft does not support a direct organization merge, so this method is recommended. Before making any changes, ensure a team member with Project Collection Administrator permissions is in the target tenant. Then, export your user list, map identities correctly, invite any necessary guest users, and request support to clean up SSH keys if needed. Microsoft suggests reaching out to Support if you need to remap more than 100 users to avoid issues.

It’s also a good idea to pause deployments during this process to prevent disruptions. First, export your existing RBAC roles and service connection inventories. Afterwards, check that all users can sign in, verify group memberships, licenses, pipelines, agent pools, feeds, extensions, and federated credentials are working correctly.

If you’re only transferring billing information, you can leave the directory unchanged, and no other action is needed. But if you are changing the directory, make sure to re-create Azure roles and identity permissions before resuming production to keep everything running smoothly.

If you’re trying to redeem your Azure benefit through the Microsoft Startups Founders Hub but keep hitting a snag, you’re not alone. Many users face the same issue where, after clicking “Complete Azure sign-up,” they’re redirected to create an Azure account but then see a message saying they’re “not eligible for an Azure free account.”

Here’s a simple step-by-step solution that can help you get past this obstacle:

First, make sure you’ve completed all the necessary steps correctly. These include adding a valid Visa credit card, verifying your phone number, and confirming your personal information. These steps are crucial for the redemption process.

If you’ve already done these and still see the eligibility barrier, don’t worry. Often, this message appears because the system is checking whether your account qualifies for the free Azure benefits or if there’s another requirement to activate your startup offer.

A good way to proceed is to check your profile details again. Ensure that your startup’s information, such as your business name, registration number, and contact details, are accurate and up to date in the Microsoft portal. Sometimes, incomplete or inconsistent info can cause eligibility checks to fail.

Next, try clearing your browser cache or switching browsers. Sometimes, old data stored in your browser can interfere with the sign-up process.

If the problem persists, your best bet is to contact Microsoft Support directly. Provide them with the details of your attempt, including any error messages or screenshots. They can verify your eligibility and guide you through any additional steps necessary, whether it involves confirming your startup status or making sure you meet all criteria.

Remember, the process isn’t always instant, but with patience and proper verification, most startups find a way to activate their benefits. Just stay persistent and reach out for help if needed!

If you’ve been having trouble with your Azure SRE Agent not authenticate properly with Azure DevOps from your PME tenant, here’s a simple solution that can help you get things working smoothly again.

The issue often comes down to the account being used during the authentication process. In some cases, the agent might try to use a corporate (Corp) account that doesn’t have the right permissions or isn’t linked correctly to your Azure DevOps repositories. When this happens, the agent won’t be able to discover or add your repositories as expected.

To fix this, make sure the agent uses the correct account—specifically, the account associated with your Azure DevOps project. Once you switch to this correct account, the repositories should be discovered and added successfully. This is exactly what should happen if everything is configured properly.

This approach aligns with the official guidance from Microsoft on cross-account Azure DevOps access and OAuth authorization. You can review the detailed instructions here: Microsoft Docs – Cross-Account Azure DevOps OAuth Authorization.

If you find this information helpful, please consider up-voting or leaving feedback. Sharing your experience can help others in the community facing similar issues.

If you’re facing issues with subnet delegation, Azure CNI, or identity roles in Azure, and your portal shows an InternalServerError, here’s a step-by-step guide to troubleshoot and find a solution.

First, verify that your subnet delegation is set up correctly. The subnet you want to associate with the Azure Container Groups (AGC) must be dedicated and empty. Make sure it is in the same region as your other resources and delegated specifically to “Microsoft.ServiceNetworking/trafficControllers.” Keep in mind that Azure currently supports only one association per subnet, so the mapping needs to be precise.

Next, check your AKS cluster’s configuration. It should be using Azure CNI rather than kubenet. The subnet where your AGC resides must be reachable from your cluster’s virtual network. Additionally, the identity used by the Application Gateway (AG) Controller needs proper permissions. You’ll want to ensure it has the “AppGw for Containers Configuration Manager” role assigned along with network permissions. This role grants data actions that go beyond what Owner or Contributor roles provide.

If you’ve confirmed that all these settings are correct and the parent AGC resource still doesn’t reach a “Succeeded” status, the problem might be beyond Terraform and your portal. In this case, check the Activity Log for hidden details. Sometimes, creating a new AGC in a fresh Virtual Network (VNet) and subnet within the same region can resolve the issue. If that still doesn’t work, open a support ticket with detailed correlation and activity IDs. Ask them to investigate the provisioning process for “Microsoft.ServiceNetworking/trafficControllers” in the West Europe region or your specific location.

Taking these steps should help you troubleshoot the problem effectively. If this guide helps you resolve the issue, please consider accepting it to let others know.

Struggling with permissions can be frustrating, especially if you’re trying to manage resources in a cloud environment. Here’s a simple way to give your team the access they need without overdoing it.

First, make sure the resource group containing the virtual machine has the right permissions set. If you’re just trying to let someone view and browse resources in the portal, assigning them the Reader role at the resource group level is a good starting point. This role allows users to see resource details without making changes.

If your goal is for someone to manage or modify resources within that resource group, then you might consider assigning the Contributor role. However, be careful—this role gives more permissions than just viewing, including the ability to make changes.

It’s best practice to follow the principle of least privilege. This means only giving users the minimum permissions they need to do their job. For example, if the user only needs to update network security group rules through the portal, they’ll need permission to browse certain resources and edit rules. But if they’re making changes via command-line tools or APIs, they might need fewer permissions.

Take the time to understand exactly what actions the user needs to perform, and assign permissions accordingly. This way, your resources stay secure, and your team has just what they need—no more, no less.

If you’ve been using Azure Synapse to connect to a SharePoint Online List with a Linked Service and suddenly it stops working, you’re not alone. Many users have faced similar issues where the connection worked perfectly for years and then suddenly fails across both testing and production environments on the same day.

You might see an error message like this:
“Failed to get metadata of OData service,” with an expected status code of 200 but an actual status code of Unauthorized. Sometimes, you’ll see an error indicating “invalid_request.”

So, what’s going on, and how can you fix this? Here’s a straightforward guide to troubleshoot and resolve the problem.

First, check the sign-in logs of your service principal—ensure they show success. If the logs indicate a successful sign-in, then the authentication process is likely fine from the service’s perspective. You should verify that the resource you’re connecting to is correct, such as Office 365 SharePoint Online. Also, confirm that API endpoints like _api/web and _api/web/lists are accessible and returning data properly.

Next, review the app permissions assigned to your Azure AD app registration. The permissions should include:
– Sites.Read.All
– Sites.Manage.All
– Sites.FullControl.All

These are necessary to access and manage SharePoint data through the API.

You might also run a manual token test to see if you can acquire a SharePoint token using the client credentials grant. If this test is successful and SharePoint responds with a token, then the problem may be related to how the token is used or interpreted by the service.

In some cases, SharePoint may return a message like “Unsupported app only token.” This usually indicates that SharePoint is rejecting the token because of recent changes, such as the retirement of the Azure Container Service (ACS) or SharePoint’s rejection of Entra app-only tokens.

Have you seen failure messages like this after those changes? It’s a common issue when SharePoint online begins enforcing stricter authentication policies or updates its token requirements.

To fix this, you should:

1. Verify your app registration in Azure AD and make sure it has the correct permissions.
2. Check that your app is configured to use the latest authentication standards required by SharePoint Online.
3. If you’re using app-only tokens, consider re-registering your app or updating the app permissions. Sometimes, SharePoint online has shifted to use different token types or authentication flows post-ACS retirement.

It is also helpful to consult with your SharePoint administrator or support to ensure that your app’s registration aligns with current security policies.

If the problem persists after these steps, consider creating a new app registration with fresh permissions and try connecting again. This often resolves issues caused by outdated or misconfigured app settings.

In summary, when your Azure Synapse SharePoint connector suddenly fails, double-check permissions, ensure your app registration is up to date, and verify the use of correct token types as per the latest SharePoint requirements. Staying on top of recent SharePoint and Azure updates will help maintain a smooth connection.

When working with a site collection, it’s important to have the right permissions set up to read data properly. Specifically, you need both “Sites.Selected” and “Sites.Read.All” permissions.

First, “Sites.Selected” is an endpoint that allows an administrator to grant specific permissions—such as Read, Write, or both—to an application for a particular site collection. Think of it as giving the app the keys to access that site.

To get started, develop your application with “Sites.Selected” permission. Once your app is ready, you’ll use the “Sites.Selected” endpoint to give the application Read permission to access the site collection. This way, the app can read data from the site without needing full control.

Make sure to follow these steps carefully to ensure your application has the proper access. If you find this advice helpful, please consider accepting the answer and giving it an upvote. If you have more questions, don’t hesitate to leave a comment.

Also, if you want to receive email updates about this topic, check out the instructions in the official documentation to enable email notifications.

If you’re noticing that your Azure App Service is restarting at about the same time every day, it might seem concerning. However, there’s usually a simple explanation related to how Azure manages its platform and resources.

These daily restarts are most often caused by Azure performing routine platform updates, infrastructure maintenance, or reallocating workers. This isn’t typically a sign that something is wrong with your app or deployment. Instead, it’s part of the normal maintenance process that Azure performs to keep everything running smoothly.

When these updates happen, Azure may restart your site, recreate the application container, or move your app to a different worker. You might see the application start fresh with no errors, the deployment version remains the same, and no activity log entries are generated for a restart. The only clue is that the worker (or the machine powering your app) has changed, and the site begins again without issues.

Since your app is running on a single instance, you might experience a brief downtime during these updates because there’s no other instance to handle traffic temporarily. You may also notice that “SiteStarted” events happen around the same time daily, but no direct actions in the Activity Log, like a restart or deployment, are recorded.

To verify if these restarts are part of normal platform operations, you can use several free tools inside Azure:

– Check “Diagnose and Solve Problems” for insights on web app restarts.
– Review container logs and the live Log Stream to confirm the app starts cleanly each time.
– Monitor activity around the restart times using Azure Monitor for metrics like CPU, Memory, Requests, and HTTP responses.
– Look into “Resource Health” and “Azure Service Health” to see if there are scheduled platform events matching those times.

If minimizing downtime is critical, consider these steps:

– Increase your app to run on at least two instances. This way, if one instance is undergoing maintenance, the other can keep serving your users.
– Enable “Health Check” in your App Service, setting it to a lightweight endpoint that confirms your app’s health. This helps Azure route traffic only to healthy instances during updates.
– Turn on “Always On” if your plan supports it, reducing cold starts and helping your app stay ready during moves or updates.

As for the regular daily restart pattern, Azure doesn’t publish a fixed maintenance schedule, so these restarts are not guaranteed to happen at the same time every day. The fact that your Test and Production environments show the same pattern suggests it’s more likely related to platform processes rather than issues with your app or deployment.

Keep monitoring these restarts with Resource Health and “Diagnose and Solve Problems” tools. If you’re concerned about downtime, scaling your app to multiple instances is the most reliable way to ensure continuous availability during platform updates.

For further details, check Microsoft’s official documentation on managing App Service restarts and best practices for high availability. If you need more personalized help, consider reaching out to Azure Support, especially for recurring issues or significant downtime concerns.

Let us know if this guidance helps or if you have additional questions. And if this advice proves useful, don’t forget to upvote or share so others can benefit too!

If you’re trying to manage the amount of data your Azure Function Apps send to Application Insights and Log Analytics, here’s a simple guide to help you reduce unnecessary telemetry while keeping important information.

First, focus on controlling what data gets sent. Azure Functions automatically use sampling, which reduces the amount of telemetry during busy times. You can customize this to either send more detailed data or cut back further depending on your needs. Adjusting sampling is a good way to find a balance—don’t turn it off completely, especially in production.

Next, you can exclude certain types of noisy data directly in your configuration files. The host.json file lets you filter out the most verbose logs, like request telemetry, which can be very detailed and not always needed. Keep exceptions and critical traces, but suppress the excess noise for smoother monitoring.

Another helpful tip is to set different levels of log detail. In host.json, you can configure log levels so that the logs you care about (like errors and exceptions) are always captured, but less useful info is omitted. For example, set the overall log level to “Warning” but keep specific categories like exceptions at a “Error” or “Information” level.

If your Function App is triggered by high-volume sources like IoT Hubs, it may generate lots of telemetry, so it’s even more important to customize controls for those specific apps. Use sampling and filtering selectively on those apps rather than applying broad changes across all functions.

Now, regarding data caps, both Application Insights and Log Analytics have their own limits. The key point is that they share a total daily ingestion cap, and once either is reached, data stops flowing. The limits are based on gigabytes per day, with a small margin for overflow during high ingestion periods. These caps are designed to prevent unexpected costs and shouldn’t be seen as targets, but rather as safeguards. If multiple Application Insights send data to the same Log Analytics workspace, the shared total cap affects all sources collectively.

To keep your costs under control and avoid hitting these limits, use sampling and filtering to reduce data volume in advance, especially during normal operation. The daily caps act as a safety net for unexpected spikes but aren’t meant to be relied on as your primary data management tool.

Hopefully, this makes managing your telemetry more straightforward. If this solution was helpful, please click the “Yes” button next to the helpful icon, and feel free to reach out with any more questions!

If you’re getting a 500 Internal Server Error when trying to use the Location Based Capability Set – Get API, it usually means your subscription has been blocked from creating resources in that specific region, which in this case is East US. This problem often happens because many users are trying to deploy MySQL Flexible Server in the most popular regions, and there are capacity limits.

To fix this, you can request an increase in your service and subscription limits (quotas) for the East US region. Here’s how you can do it:

1. Go to the Azure Support request page using this link: Create a support request.
2. For the issue type, select Service and subscription limits (quotas).
3. For the quota type, choose Azure Database for MySQL Flexible Server.
4. Click Next to proceed.
5. In the Additional Details tab, click Enter details. Here, choose Region access or Quota increase, then select East US. Fill in any additional information required and click Save.
6. Continue filling out the form, then click Next.
7. Review your request carefully and click Create.

You should get an automated email confirming your request within a few minutes. This process could help you get the quota increase needed to deploy in East US.

If you already have a MySQL Flexible Server in East US and cannot increase the quota, another option is to use Cross Region Restore. This allows you to restore your database to a different region where your quota isn’t limited, and you can continue working without waiting for quota increases.

If you have any questions or need additional assistance, don’t hesitate to comment below. Remember to accept and upvote this answer if it helps you!

Thanks!

Let’s simplify how Azure handles network routing and show you a solution to manage your traffic effectively.

Azure uses a method called Longest Prefix Match to decide how to route traffic. When you set up a Virtual Network (VNet), Azure automatically adds hidden system routes covering the entire address space, and these routes direct traffic internally with a next hop labeled “Virtual Network.” Because these system routes are more specific than your custom route of 0.0.0.0/0, Azure will ignore your rule for traffic within the network and instead route packets directly between subnets.

To manage your internal traffic better without having to create a route for every single subnet, you can set up summarized private IP blocks in your route table. These broader address blocks can override the system routes for your entire network. For example, you can include the common private IP ranges like 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16, and point their routes to your virtual appliance. If your VNet uses the 10.x.x.x range, you can use this with your route table to override the default system route.

If your network is growing, consider using a Hub-and-Spoke architecture. This setup places the third-party appliance in a central Hub VNet, with other workloads in separate Spoke VNets. Because Spoke VNets aren’t linked transitively by default, you can attach a route of 0.0.0.0/0 to the spokes, forcing all traffic between them to go through the Hub Virtual Network and your appliance.

When setting up these broad route rules, be careful to avoid routing loops. Make sure not to attach the route table with the large private range to the subnet where your appliance lives. If the appliance subnet tries to route traffic back to itself, it can cause loops and drop data packets. Keep the appliance on its own dedicated route table to prevent this issue.

If this approach helps solve your problem, please accept the answer so others in the community can benefit from it. Your feedback is greatly appreciated.

If you’ve recently found that your Azure Database for PostgreSQL Flexible Server isn’t accessible, don’t worry—you’re not alone. This issue can happen unexpectedly and may leave you scratching your head about what to do next. Here’s a straightforward step-by-step guide to help you troubleshoot and resolve the problem.

First, check your resource group’s health logs in the Azure portal. Look for any recent messages indicating downtime or unavailability. For example, you might see a message like this: “Your Azure Database for PostgreSQL – Flexible server is currently unavailable. We are working to resolve the problem.” This confirms there’s a service interruption.

Next, review the activity and health event logs for more details. Often, these logs contain information in a structured JSON format. You might see an entry similar to this:

“properties”: {
  “title”: “Unknown Reason”,
  “details”: “”,
  “currentHealthStatus”: “Unavailable”,
  “previousHealthStatus”: “Available”,
  “type”: “Downtime”,
  “cause”: “PlatformInitiated”
}

In this example, the cause is listed as “PlatformInitiated,” which typically indicates that the cloud provider has taken some action affecting the service.

To move forward, start by confirming if there are any ongoing incidents reported by Azure. Check the Azure Status page or the Service Health dashboard within your portal for real-time updates. If there’s an ongoing platform issue, patience is key as Microsoft works to restore normal operations.

If no broader outages are reported, try the following steps:

1. Wait a few minutes and refresh your portal. Sometimes, the service recovers automatically once the platform resolves the underlying problem.

2. Review any recent updates or changes made to your server configuration. Sometimes, configuration errors or network issues can cause temporary unavailability.

3. Check your network settings to ensure there are no firewalls or security groups blocking access.

4. Contact Azure Support if the downtime persists beyond a reasonable period. Provide them with the details from your logs, including the specific error messages and timestamps.

Remember, such unplanned outages are managed by Microsoft, and they generally work quickly to resolve them. Keeping an eye on the status pages and your logs will give you the latest updates. When the service is back up, verify your database’s availability and ensure your applications are functioning as expected.

By following these steps, you’ll better understand the issue and be positioned to handle it efficiently. Most importantly, staying calm and informed helps you navigate these hiccups smoothly.

If you’re experiencing an error when trying to use Azure AI Foundry, your issue might be related to network restrictions rather than missing roles or permissions. Based on recent information from Microsoft, the problem most often occurs when network restrictions block the necessary services that support your evaluation runs.

One common cause is that the evaluation backend service, called ‘raisvc’, can’t communicate with your resources due to strict network rules. If your Azure AI Foundry account is set to block certain networks — specifically with settings like “defaultAction = Deny” — the backend service can’t access the resources it needs, even though your inference calls (like chat completions) may be working through a different path. Microsoft confirms that this specific situation results in a “Forbidden” error.

Here are some clear steps to troubleshoot and fix this issue:

First, check your network configuration by running this command in your terminal or command prompt:

az cognitive services account show –resource-group –name –query “networkAcls”

Replace <your-resource-group> and <your-foundry-account-name> with your actual resource group and account name. This will show how your network access is currently configured.

Next, to test if network restrictions are causing the problem, temporarily change the network setting to allow public access:

az cognitive services account update –resource-group –name –bypass AzureServices –default-action Allow

If your evaluation runs successfully after this adjustment, it confirms that network restrictions are blocking the backend service.

To make a permanent fix, instead of removing restrictions entirely, you should update your network rules to include the evaluation service endpoints. This involves:

• Identifying the specific URLs or IP addresses used by the evaluation backend service.
• Adding those to your allowed networks or IP address ranges.
• Alternatively, configuring a private endpoint for these evaluation services to securely permit communication without broad network exposure.

If network issues aren’t the root of the problem, check your role permissions. The minimum roles required include:

• Azure AI Foundry User (which you already have)
• Cognitive Services OpenAI User (if you’re using Azure OpenAI)
• Storage Blob Data Contributor on your storage account (important if you use Entra ID for authentication)

If you’re using Entra ID for storage, make sure your storage account allows network access (set publicNetworkAccess to Enabled) and that your managed identity has the proper Storage Blob Data Contributor role.

Most of the time, this error comes down to network settings blocking the evaluation backend service rather than permissions. Starting your troubleshooting by inspecting and adjusting your network rules usually solves the issue.

I hope this helps! Feel free to reach out if you run into any more questions.