Not able to connect to azure openai service

A timeout in preprod usually indicates a network path or endpoint configuration problem rather than a model-specific issue.

1. Verify DNS resolution for the Azure OpenAI endpoint.

      nslookup <azure-openai-endpoint>
   

   Expected result: the endpoint resolves correctly. If a private endpoint is configured, the private IP should match the private IP in the DNS configuration of the private endpoint.
2. Test HTTPS connectivity to the resolved private IP on port 443.

      Test-NetConnection <private-ip> -Port 443
   

   Expected result: this succeeds only from a machine on the same private network as the Azure OpenAI resource. If it fails, check these common causes:
   • DNS is resolving incorrectly.
   • The preprod machine is not on the same private network.
   • A customer firewall is blocking port 443.
3. If the workload runs on AKS, check for blocked outbound traffic.
   • Ensure outbound HTTPS traffic on port 443 is allowed to the Azure OpenAI endpoint.
   • Check NSG, firewall, and network policy rules.
   • If using network policies:

          kubectl get networkpolicies -n kube-system
     

4. Check the exact error pattern in logs if available.
   • 401 Unauthorized: managed identity might be missing the Cognitive Services OpenAI User role.
   • 404 Not Found: endpoint URL or deployment name might be wrong.
   • Connection refused or Name resolution failed: DNS or network issue.
   • Token acquisition failed: workload identity configuration issue.
5. If this is an intermittent server-side 500 Unexpected special token error rather than a pure timeout, reduce prompt temperature to less than 1 and use client retry logic. Reattempting the request often succeeds.
6. If the issue is isolated to one Azure region while another region works, it can be a regional service incident. One documented case in East US was mitigated after a service-side issue.

For this preprod timeout scenario, the fastest end-to-end path is:

• Run nslookup on the Azure OpenAI endpoint from preprod.
• Run Test-NetConnection <private-ip> -Port 443 from preprod.
• If that fails, fix DNS, private network routing, NSG/firewall, or proxy rules.
• If connectivity succeeds, verify the endpoint, deployment name, and identity permissions.

References:

• Configure Azure OpenAI networking
• Troubleshoot Container Network Insights Agent on AKS
• Azure OpenAI frequently asked questions
• Azure Open AI service unavailable east-us region - Microsoft Q&A