api-eur.cognitive.microsofttranslator.com with firewall doesn't work

sandervv 21 Reputation points
2026-06-26T06:20:03.38+00:00

I want to point servicenow to translate with Azure. I want to have the translator only pointing to west europe. When I set api-eur.cognitive.microsofttranslator.com in combination with the firewall it doesn't work.

The url https://RESOURCE.cognitiveservices.azure.com/translator/text/v3.0 does work with firewall exceptions.

The resource is placed in west europe. Is the translation only being processed in west europe, or is this global?

Azure Translator in Foundry Tools
0 comments
Answer accepted by question author
Alex Burlachenko 25,290 Reputation points MVP Volunteer Moderator
2026-06-26T08:23:56.9166667+00:00

hi sandervv & thx for sharing urs issue here at Q&A portal,

If firewall is enabled on the Translator resource, use the resource custom endpoint, not api-eur.cognitive.microsofttranslator.com. The working URL is the right pattern https://RESOURCE.cognitiveservices.azure.com/translator/text/v3.0

When u enable selected networks/private endpoints on the resource, Azure gives resource-specific endpoints under Keys and Endpoint > Virtual Network. That’s the endpoint that matches ur firewall/private networking config. MS doc says Translator behind firewalls should use the custom endpoint from the resource networking page https://learn.microsoft.com/en-us/azure/ai-services/translator/text-translation/reference/v3/reference

api-eur.cognitive.microsofttranslator.com is a regional/public Translator endpoint, but it’s not the same as ur resource endpoint w/ firewall rules. So the firewall won’t behave the way u expect there. For data processing, if ur Translator resource is in West Europe and u call the resource endpoint w/ the correct region header, the request is tied to that regional resource. Don’t use the global endpoint if u specifically need regional control.

Make sure u send Ocp-Apim-Subscription-Key: <key> & Ocp-Apim-Subscription-Region: westeurope

https://learn.microsoft.com/en-us/azure/ai-services/translator/how-to/use-firewalls

So pls use the RESOURCE.cognitiveservices.azure.com/translator/text/v3.0 endpoint for firewall/private access. Don’t use api-eur... for that setup.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/

 

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Newest
Most helpful Newest Oldest
  1. SRILAKSHMI C 19,735 Reputation points Microsoft External Staff Moderator
    2026-06-26T10:34:24.25+00:00

    Hello @sandervv

    Thank you for reaching out to Microsoft Q&A.

    From your description, I understand that you're configuring ServiceNow to use Azure AI Translator and want to ensure that translation requests are processed only in West Europe. You've observed the following behavior:

    • https://api-eur.cognitive.microsofttranslator.com does not work when your Azure AI Translator resource has firewall restrictions enabled.
    • https://<RESOURCE>.cognitiveservices.azure.com/translator/text/v3.0 works successfully after configuring the appropriate firewall exceptions.

    Based on the available documentation, this behavior is expected.

    For Azure AI Translator resources that have network access restrictions (such as firewall rules, selected networks, or private endpoints), Microsoft recommends using your resource-specific endpoint, for example:

    https://<RESOURCE>.cognitiveservices.azure.com/translator/text/v3.0

    This endpoint is directly associated with your Azure AI resource and supports:

    Azure Firewall and selected network rules

    • Private Endpoints

    Azure authentication and access controls

    On the other hand, https://api-eur.cognitive.microsofttranslator.com is a shared regional Translator endpoint. Although the hostname indicates the European region, it is not tied to your specific Azure AI resource. Because of this, it does not use the network configuration of your resource in the same way as the custom endpoint.

    With strict firewall configurations, requests to api-eur.cognitive.microsofttranslator.com may fail simply because the destination hostname differs from your resource endpoint and is not covered by your firewall allow list.

    Is translation processed only in West Europe?

    Yes, since your Translator resource is deployed in West Europe and you're using the resource-specific endpoint, translation requests are processed by the Translator service associated with that regional resource. In other words, your requests are routed through your West Europe Translator resource rather than being processed across random global regions.

    The resource region determines where the Translator service for your resource is hosted, and using the custom endpoint ensures that requests are routed through that regional service.

    Why does api-eur.cognitive.microsofttranslator.com behave differently?

    Although api-eur.cognitive.microsofttranslator.com suggests an EU regional endpoint, it is still a different hostname from your Azure resource endpoint.

    If your firewall or network security policies are configured to allow only your Azure AI resource endpoint, requests to the shared regional endpoint will not be permitted unless that hostname is also explicitly allowed. This explains why your resource endpoint succeeds while the regional endpoint does not.

    Recommendation

    If your goal is to:

    Restrict access using Azure Firewall or selected networks,

    Use Private Endpoints,

    Ensure requests are routed through your provisioned Translator resource in West Europe,

    then we recommend continuing to use the resource-specific endpoint:

    https://<RESOURCE>.cognitiveservices.azure.com/translator/text/v3.0

    rather than the shared regional endpoint:

    https://api-eur.cognitive.microsofttranslator.com

    I Hope this helps. Do let me know if you have any further queries.

    Thank you!

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.