Foundry Agent cannot resolve Azure AI Search MCP endpoint ("Name or service not known")

Question

Foundry Agent cannot resolve Azure AI Search MCP endpoint ("Name or service not known")

70351079 0

Environment:

Microsoft Foundry (New Foundry experience)
Azure AI Search Knowledge Base
MCP endpoint generated by Foundry IQ

Error:

Error encountered while enumerating tools from remote server.

Endpoint:

https://ai-search-cooh-ts-brd-mvc.search.windows.net/knowledgebases/historical-loe-v2/mcp

Message:

Name or service not known.

The host name could not be resolved from the selected network path.

Screenshot 2026-09-08 103424

Karnam Venkata Rajeswari 5,255 Reputation points Microsoft External Staff Moderator

2026-09-08T16:59:38.5833333+00:00
Hello @70351079 ,

Welcome to Microsoft Q&A .Thank you for reaching out to us.

The MCP endpoint structure appears consistent with the expected Foundry IQ Knowledge Base endpoint format. However, the Knowledge Base name and API version should also be confirmed against the generated endpoint.

The message "Name or service not known" indicates that the Agent runtime cannot resolve the Azure AI Search hostname through the selected network path. This occurs before MCP tool enumeration, authentication, Knowledge Base retrieval, or GPT-4o invocation begins.

Please check if the following steps help-

Confirming the Agent networking setup

Please confirm whether Standard Agent Setup with private networking is configured.

Private MCP connectivity requires a supported private networking configuration.

If Basic Agent Setup is configured, the private MCP endpoint may not be reachable through the intended private path.

Validating Azure AI Search networking

Start by reviewing the Public Network Access setting.

Confirm that a Private Endpoint exists when private-only access is required.

Verify that the Private Endpoint connection status is Approved.

Confirm that the Agent runtime network and Search Private Endpoint network have the required connectivity.

Validating Private DNS

Confirm that the private DNS zone privatelink.search.windows.net exists.

Confirm that the Search service record points to the expected private IP address.

Verify that the zone is linked to the VNet associated with the Agent runtime.

If custom DNS, Azure Firewall DNS Proxy, VPN, ExpressRoute, or corporate DNS forwarding is configured, confirm that private Search DNS queries are forwarded correctly.

Testing DNS and HTTPS connectivity From a resource using the closest available DNS and network path, run: Resolve-DnsName ai-search-cooh-ts-brd-mvc.search.windows.net or nslookup ai-search-cooh-ts-brd-mvc.search.windows.net For a private endpoint configuration, the hostname should resolve to the expected private IP address. After successful resolution, test TCP port 443: Test-NetConnection ai-search-cooh-ts-brd-mvc.search.windows.net -Port 443 If DNS succeeds but port 443 fails, review VNet peering, NSGs, firewalls, routing, and Private Endpoint configuration.

Validating the Capability Host

Confirm that the required Capability Host configuration is provisioned and healthy for both the Foundry account and project.

This should be treated as a secondary runtime-networking validation rather than a confirmed root cause.

Performing an optional isolation test If security policy permits, temporarily allow public network access on Azure AI Search and retry the Agent request. A successful result would strongly indicate an issue with private DNS, Private Endpoint configuration, routing, or the Agent private networking path. The original security configuration should be restored after testing. If the behavior changes to an HTTP 401 or 403 error after DNS connectivity is restored, the next step would be to review the project managed identity configuration and Azure AI Search data-plane permissions.

The following references might be helpful , please check them out

Connect Agents to Foundry IQ Knowledge Bases - Microsoft Foundry | Microsoft Learn

Connect agents to MCP server endpoints - Microsoft Foundry | Microsoft Learn

How to configure network isolation for Microsoft Foundry - Microsoft Foundry | Microsoft Learn

Set Up Private Inbound Connectivity - Foundry IQ | Microsoft Learn

Troubleshoot private endpoint connectivity failures - Azure | Microsoft Learn

Please let us know if the response was helpful

Thank you
Karnam Venkata Rajeswari 5,255 Reputation points Microsoft External Staff Moderator

2026-09-09T19:37:14.5666667+00:00
Hello @70351079 ,

Thank you for sharing the latest retrieval error and the network configuration details.

Please check if the following helps

The 403 response confirms that the knowledge base request is reaching Azure AI Search, but the Search retrieval runtime cannot currently access the GPT-4o deployment while public network access is disabled. The existing private endpoint on the Foundry resource supports inbound access from connected networks, but Azure AI Search requires its own supported outbound private connection to the model resource. This behavior aligns with the documented private outbound connectivity requirements for Foundry IQ

Please complete the following checks:

Confirming the Azure AI Search managed identity

Ensure that the system-assigned managed identity is enabled on ai-search-cooh-ts-brd-mvc.

Note the identity's object ID for the role assignment check.

Configuring shared private access from Azure AI Search On ai-search-cooh-ts-brd-mvc, create a shared private link targeting:

Target resource: ai-foundry-resource-cooh-ts

Resource type: Microsoft.CognitiveServices/accounts

Group ID: openai_account

The openai_account group ID is required because Azure AI Search reaches model inference through the Azure OpenAI endpoint type

Approving the generated private endpoint connection After creating the shared private link:

Open the private endpoint connections for ai-foundry-resource-cooh-ts.

Locate the new connection generated by Azure AI Search.

Approve the connection.

Confirm that the shared private link shows Provisioning state as Succeeded and Connection state as Approved

The existing approved private endpoint pe-foundry-cooh-ts does not replace the separate connection generated by the Azure AI Search shared private link. The documented workflow requires both creation of the shared private link and approval of the generated connection on the target Foundry resource.

Validating model authorization Assign the Cognitive Services User role to the system-assigned managed identity of ai-search-cooh-ts-brd-mvc at the ai-foundry-resource-cooh-ts resource scope. Private networking provides the connection path, while this role allows the Search identity to call the model inference endpoint.

Reviewing the trusted-services setting The current private outbound guidance states that the openai_account shared private link does not carry every ingestion-time model call. Therefore, "Allow Azure services on the trusted services list" must remain enabled for the documented configuration. his setting is different from enabling general public network access. Public network access can remain disabled, while the trusted-services exception permits supported Azure service traffic. If organizational policy also blocks the trusted-services exception, please share that policy outcome because the documented private retrieval configuration cannot be completed exactly as described without this setting. The current guidance explicitly notes that a "403 Public access is disabled" error can occur even when shared private links and private endpoints are approved if the trusted-services bypass is disabled Direct DNS or TCP tests cannot be run from the managed Azure AI Search retrieval runtime. The supported validation is to confirm the shared private link and generated connection are approved, verify the Search managed identity role, review the trusted-services setting, and then retry: POST /knowledgebases/historical-loe-v2/retrieve These checks should establish the supported Search-to-model path and help determine whether the remaining issue is related to private connectivity, authorization, or the trusted-services policy

The following references might be helpful

Set up private outbound connectivity for Foundry IQ

Configure Azure AI Search shared private links

Review the private agentic retrieval architecture

Configure managed identities for Azure AI Search

Configure role-based access for Azure AI Search

Please let us know if the response was helpful

Thank you

2 answers

Your answer

Answer 1

Hi Team,

I am requesting assistance with private network connectivity between Azure AI Search and the GPT-4o deployment used by a Foundry IQ knowledge base.

The historical LOE knowledge source and knowledge base were created successfully and both show as Active. However, retrieval fails when Azure AI Search attempts to invoke the GPT-4o model.

Confirmed backend error

POST /knowledgebases/historical-loe-v2/retrieve HTTP 403 Forbidden Could not complete model action. The model endpoint returned status code '403' (Forbidden). Public access is disabled. Please configure private endpoint.

Relevant resources

Azure AI Search service: ai-search-cooh-ts-brd-mvc

Knowledge base: historical-loe-v2

Foundry/OpenAI resource: ai-foundry-resource-cooh-ts

Model deployment: gpt-4o

Model endpoint: ai-foundry-resource-cooh-ts.openai.azure.com

Foundry private endpoint: pe-foundry-cooh-ts

OpenAI private endpoint IP shown in DNS configuration: 10.19.200.125

Configuration already verified

Public network access on the Foundry resource is disabled, as required by IQVIA policy.

The policy prevents enabling public access for testing: Cognitive Services accounts should disable public network access.

The Foundry private endpoint connection is Approved.

Private endpoint DNS entries exist for the Foundry Cognitive Services, OpenAI, and services.ai endpoints.

The Azure AI Search knowledge source and knowledge base are Active.

The failure occurs specifically when Azure AI Search invokes the GPT-4o model during knowledge retrieval.

Request

Could you please review and configure the supported private network path from Azure AI Search to the Foundry/OpenAI model endpoint? Specifically, please verify:

DNS resolution from the Azure AI Search agentic-retrieval runtime to ai-foundry-resource-cooh-ts.openai.azure.com resolves through the appropriate private DNS configuration.

Network connectivity from the Azure AI Search retrieval runtime to the Foundry/OpenAI private endpoint on TCP 443. Hi Team, I am requesting assistance with private network connectivity between Azure AI Search and the GPT-4o deployment used by a Foundry IQ knowledge base. The historical LOE knowledge source and knowledge base were created successfully and both show as Active. However, retrieval fails when Azure AI Search attempts to invoke the GPT-4o model. Confirmed backend error POST /knowledgebases/historical-loe-v2/retrieve HTTP 403 Forbidden Could not complete model action. The model endpoint returned status code '403' (Forbidden). Public access is disabled. Please configure private endpoint. Relevant resources
- Azure AI Search service: ai-search-cooh-ts-brd-mvc
- Knowledge base: historical-loe-v2
- Foundry/OpenAI resource: ai-foundry-resource-cooh-ts
- Model deployment: gpt-4o
- Model endpoint: ai-foundry-resource-cooh-ts.openai.azure.com
- Foundry private endpoint: pe-foundry-cooh-ts
- OpenAI private endpoint IP shown in DNS configuration: 10.19.200.125
Configuration already verified
- Public network access on the Foundry resource is disabled, as required by IQVIA policy.
- The policy prevents enabling public access for testing: Cognitive Services accounts should disable public network access.
- The Foundry private endpoint connection is Approved.
- Private endpoint DNS entries exist for the Foundry Cognitive Services, OpenAI, and services.ai endpoints.
- The Azure AI Search knowledge source and knowledge base are Active.
- The failure occurs specifically when Azure AI Search invokes the GPT-4o model during knowledge retrieval.
Request Could you please review and configure the supported private network path from Azure AI Search to the Foundry/OpenAI model endpoint? Specifically, please verify:
1. DNS resolution from the Azure AI Search agentic-retrieval runtime to ai-foundry-resource-cooh-ts.openai.azure.com resolves through the appropriate private DNS configuration.
2. Network connectivity from the Azure AI Search retrieval runtime to the Foundry/OpenAI private endpoint on TCP 443.

Answer 2

This error indicates a DNS/network path problem to the Azure AI Search knowledge base MCP endpoint, not a tool-schema issue.

Use this checklist:

Verify the MCP endpoint format
- The search service endpoint must be the Azure AI Search service URL.
- The knowledge base name must exactly match the knowledge base created in Azure AI Search.
- For the knowledge base MCP endpoint, use API version 2026-08-01-preview.
Check whether the endpoint is private or depends on private DNS
- If the Azure AI Search service or MCP path is reachable only through a private endpoint, Foundry agent connectivity depends on the selected network path, DNS, firewall rules, and private endpoint configuration.
- Ensure private endpoints exist for all Azure services the MCP tools access.
- Verify firewall rules permit agent-to-service traffic.
Validate DNS resolution from the Foundry network path
- The error text explicitly says the host name could not be resolved from the selected network path.
- If the search service was previously or is currently configured with a private endpoint, DNS can resolve the service to a private IP that the agent path cannot reach.
- In that case, review private endpoint connections and private DNS configuration for Azure AI Search.
Check authorization after DNS is fixed
- If the next error becomes 401 or 403, confirm the project managed identity has Search Index Data Reader on the search service.
- If the connection writes to indexes, also assign Search Index Data Contributor.
- If creating or deleting the project connection fails with 403 from Azure Resource Manager, confirm the user or service principal has permissions on the Microsoft Foundry resource and project.
- If using keyless authentication, confirm sign-in is to the correct tenant and subscription.
Confirm the agent is configured to use the knowledge base tool
- Ensure the MCP tool is configured.
- Ensure allowed_tools includes knowledge_base_retrieve.
If using private MCP generally in Foundry Agent Service
- Private MCP connectivity requires Standard Agent Setup with private networking.
- Basic agent setup does not support private MCP endpoints.

A practical interpretation for this specific error:

Name or service not known means Foundry is failing before authentication, during hostname resolution.
Focus first on Azure AI Search endpoint correctness, private endpoint/private DNS state, and whether the selected Foundry network path can resolve and reach the search service hostname.

References: