Azure Data Factory (ADF) Managed Batch Account Endpoint issues.

Question

Azure Data Factory (ADF) Managed Batch Account Endpoint issues.

Ahmed Said Youssef 20

I am attempting to integrate Azure Data Factory with Azure Batch using a private endpoint, specifically through a Managed IR.

I created a Managed Vnet, then used az cli to attempt to connect a batch account using a managed private endpoint:

az datafactory managed-private-endpoint create --factory-name "adf-dev-001" -g "Rg-DEV-001" --mvnet-name default --managed-private-endpoint-name "ep-badev001" --group-id batchAccount --private-link-resource-id /subscriptions/xxxx-xxxx-xxx-xxx-xxx/resourceGroups/rg-dev-001/providers/Microsoft.Batch/batchAccounts/badev001

However the ADF managed endpoint stays in provisioning state for over an hour then fails, and here is the relevant Activity log in the batch account:

{
    "authorization": {
        "action": "Microsoft.Batch/batchAccounts/privateEndpointConnectionProxies/validate/action",
        "scope": "/subscriptions/xxxx-xxxx-xxx-xxx-xxx/resourceGroups/rg-dev-001/providers/Microsoft.Batch/batchAccounts/badev001/privateEndpointConnectionProxies/adf-dev-001.pep-badev001.fb965ee5-13ee-46f8-b2be-ad2dddb10a3c"
    },
    "caller": "606b3011-a9d3-4316-b61e-decee5523930",
    "channels": "Operation",
    "claims": {
        "aud": "https://management.core.windows.net/",
        "iss": "https://sts.windows.net/xxxx-xxxx-xxx-xxx-xxx/",
        "iat": "1750406144",
        "nbf": "1750406144",
        "exp": "1750492844",
        "aio": "k2RgYNCWdhEuuf66erJhXmhSVeMxAA==",
        "appid": "2cf9eb86-36b5-49dc-86ae-9a63135dfa8c",
        "appidacr": "2",
        "http://schemas.microsoft.com/identity/claims/identityprovider": "https://sts.windows.net/xxxx-xxxx-xxx-xxx-xxx/",
        "idtyp": "app",
        "http://schemas.microsoft.com/identity/claims/objectidentifier": "606b3011-a9d3-4316-b61e-decee5523930",
        "rh": "1.AAwAcKBneumMkkaxr794gwa8ZkZIf3kAutdPukPawfj2MBMMAAAMAA.",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "606b3011-a9d3-4316-b61e-decee5523930",
        "http://schemas.microsoft.com/identity/claims/tenantid": "xxxx-xxxx-xxx-xxx-xxx",
        "uti": "s34Ej1mzVUOGgkO49msZAA",
        "ver": "1.0",
        "xms_ftd": "jIz_uivfqkzEJ8iWkmcFae3k1eGoLeGiqikLzawNb5wBZXVyb3Blbm9ydGgtZHNtcw",
        "xms_idrel": "7 12",
        "xms_rd": "0.AVkApv8KBQgCEgEMEhQICRIQZQwcGOqNSk6SejCTk3ovZBIUCAgSEEZIf3kAutdPukPawfj2MBMiJAgDEiBQXAY01Mstow5uTMCEX1nM9DcVruZLpKuffWq-kxlM_A",
        "xms_tcdt": "1395821395"
    },
    "correlationId": "c604090b-67fd-4a99-b3d0-6b36eb34befd",
    "description": "",
    "eventDataId": "0477799c-2ed0-4ee2-85e4-78fb7295b953",
    "eventName": {
        "value": "EndRequest",
        "localizedValue": "End request"
    },
    "category": {
        "value": "Administrative",
        "localizedValue": "Administrative"
    },
    "eventTimestamp": "2025-06-20T12:48:43.9449452Z",
    "id": "/subscriptions/xxxx-xxxx-xxx-xxx-xxx/resourceGroups/rg-dev-001/providers/Microsoft.Batch/batchAccounts/badev001/privateEndpointConnectionProxies/adf-dev-001.pep-badev001.fb965ee5-13ee-46f8-b2be-ad2dddb10a3c/events/0477799c-2ed0-4ee2-85e4-78fb7295b953/ticks/638860205239449452",
    "level": "Error",
    "operationId": "c604090b-67fd-4a99-b3d0-6b36eb34befd",
    "operationName": {
        "value": "Microsoft.Batch/batchAccounts/privateEndpointConnectionProxies/validate/action",
        "localizedValue": "Validates a Private endpoint connection proxy"
    },
    "resourceGroupName": "rg-dev-001",
    "resourroviderName": {
        "value": "Microsoft.Batch",
        "localizedValue": "Microsoft.Batch"
    },
    "resourceType": {
        "value": "Microsoft.Batch/batchAccounts/privateEndpointConnectionProxies",
        "localizedValue": "Microsoft.Batch/batchAccounts/privateEndpointConnectionProxies"
    },
    "resourceId": "/subscriptions/xxxx-xxxx-xxx-xxx-xxx/resourceGroups/rg-dev-001/providers/Microsoft.Batch/batchAccounts/badev001/privateEndpointConnectionProxies/adf-dev-001.pep-badev001.fb965ee5-13ee-46f8-b2be-ad2dddb10a3c",
    "status": {
        "value": "Failed",
        "localizedValue": "Failed"
    },
    "subStatus": {
        "value": "BadRequest",
        "localizedValue": "Bad Request (HTTP Status Code: 400)"
    },
    "submissionTimestamp": "2025-06-20T12:50:18Z",
    "subscriptionId": "xxxx-xxxx-xxx-xxx-xxx",
    "tenantId": "xxxx-xxxx-xxx-xxx-xxx",
    "properties": {
        "statusCode": "BadRequest",
        "serviceRequestId": null,
        "statusMessage": "{\"error\":{\"code\":\"InvalidUri\",\"target\":\"BatchAccount\",\"message\":\"The requested URI does not represent any resource on the server.\\nRequestId:d3dc07e8-716c-4af0-93b2-e17591c84a63\\nTime:2025-06-20T12:48:43.9548057Z\",\"details\":[{\"code\":\"UriPath\",\"message\":\"/subscriptions/xxxx-xxxx-xxx-xxx-xxx/resourceGroups/rg-dev-001/providers/Microsoft.Batch/batchAccounts/badev001/privateEndpointConnectionProxies/adf-dev-001.pep-badev001.fb965ee5-13ee-46f8-b2be-ad2dddb10a3c/validate\"},{\"code\":\"ParseError\",\"message\":\"PrivateEndpointConnectionProxy names can only contain any combination of alphanumeric characters along with dash (-) and underscore (_). The name must be from 1 through 64 characters long\"}]}}",
        "eventCategory": "Administrative",
        "entity": "/subscriptions/xxxx-xxxx-xxx-xxx-xxx/resourceGroups/rg-dev-001/providers/Microsoft.Batch/batchAccounts/badev001/privateEndpointConnectionProxies/adf-dev-001.pep-badev001.fb965ee5-13ee-46f8-b2be-ad2dddb10a3c",
        "message": "Microsoft.Batch/batchAccounts/privateEndpointConnectionProxies/validate/action",
        "hierarchy": "xxxx-xxxx-xxx-xxx-xxx/mg-user-env/mg-dev/mg-OTE-dev/xxxx-xxxx-xxx-xxx-xxx"
    },
    "relatedEvents": []
}

status Message:

{
  "error": {
    "code": "InvalidUri",
    "target": "BatchAccount",
    "message": "The requested URI does not represent any resource on the server.\nRequestId:d3dc07e8-716c-4af0-93b2-e17591c84a63\nTime:2025-06-20T12:48:43.9548057Z",
    "details": [
      {
        "code": "UriPath",
        "message": "/subscriptions/xxxx-xxxx-xxx-xxx-xxx/resourceGroups/rg-dev-001/providers/Microsoft.Batch/batchAccounts/badev001/privateEndpointConnectionProxies/adf-dev-001.pep-badev001.fb965ee5-13ee-46f8-b2be-ad2dddb10a3c/validate"
      },
      {
        "code": "ParseError",
        "message": "PrivateEndpointConnectionProxy names can only contain any combination of alphanumeric characters along with dash (-) and underscore (_). The name must be from 1 through 64 characters long"
      }
    ]
  }
}

Is there a simple way to integrate a batch accoubnt private endpoint using Managed Integration runtime, without making it public or using a self-hosted IR?

Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-06-23T16:50:29.0233333+00:00

@Ahmed Said Youssef

Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

Answer accepted by question author

0 additional answers

Your answer

Chandra Boorla 15,480 Reputation points Microsoft External Staff Moderator

2025-06-23T16:50:29.0233333+00:00

@Ahmed Said Youssef

Just checking in to see if the below answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

As your feedback is valuable and can assist others in the community facing similar issues.

Answer 1

@Ahmed Said Youssef

Thank you for sharing the detailed error logs and setup information.

You're encountering a known limitation when integrating Azure Data Factory with Azure Batch via a managed private endpoint using a Managed VNet Integration Runtime.

Root Cause

The error stems from how ADF auto-generates the name for the private endpoint connection proxy. Azure Batch enforces strict naming rules, the name must be between 1–64 characters and can only include letters, numbers, dashes (-), or underscores (_). However, ADF generates names with dots (.) and long GUIDs (e.g., adf-dev-001.pep-badev001.<GUID>), which violate these rules, causing the request to fail with a 400 BadRequest.

Important Limitation

Also be aware that when a private endpoint is enabled on the Batch account, task authentication tokens are not supported. This means Batch tasks will not be able to use built-in tokens to access services like Azure Storage.

User's image

For additional information, please refer: Use private endpoints with Azure Batch accounts

Recommended Workarounds

Use Self-hosted Integration Runtime (SHIR) - Deploy SHIR inside the same VNet as your Batch account. This avoids using a managed private endpoint altogether and allows secure access.

Use Batch Pools with Managed Identity - To maintain secure access within your tasks when the Batch account is private, configure the Batch pool to use a system-assigned or user-assigned managed identity. Tasks can use this identity to authenticate with other services like Storage, Key Vault, etc.

(Optional) Keep Batch Public with Access Restrictions - If a private endpoint is not strictly required, you can:

Keep the Batch account public,
Restrict access to ADF’s Managed VNet via NSG or IP firewall rules,
Use authentication tokens or managed identity for secure communication.

Conclusion

ADF Managed Private Endpoint currently isn't compatible with Azure Batch due to naming limitations.
Task authentication tokens also don’t work with Batch private endpoints.
SHIR + Managed Identity provides the most reliable and secure integration pattern for private networks.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.

Tony 0 Reputation points

2026-08-10T09:16:56.6366667+00:00

Hi Microsoft,
Has this been official placed on a "Defects" list.
What is the eta on remediation of this defect?

Thanks