Question

Your team has deployed an Azure AI Foundry hub with a managed virtual network and configured a private endpoint so that all inbound access is restricted to your corporate network. On-premises developers connected through ExpressRoute report that they can reach the Foundry portal by IP address but consistently get name-resolution failures when using the resource's fully qualified domain name. What is the most appropriate action to resolve the connectivity issue?

Accepted Answer

Configure conditional forwarders on the on-premises DNS servers to forward the Foundry public DNS zones to Azure DNS, and ensure the corresponding Azure Private DNS zones are linked to the virtual network.

Answer

Add an inbound network security group (NSG) rule on the private endpoint subnet to allow TCP port 53 from the on-premises network.

Answer

Switch the hub from a private endpoint to a service endpoint so that public DNS resolution is used for the resource.

Answer

Assign a user-assigned managed identity to the hub and grant it the DNS Zone Contributor role on the Private DNS zone.