Plan and manage an Azure AI solution 1.3 Manage, monitor, and secure AI systems

You deploy Foundry Agent Service with the Standard Setup with private networking, using…

Study guide skill: Configure security, including managed identity, private networking, keyless credentials, and role policies

Question B8-008

You deploy Foundry Agent Service with the Standard Setup with private networking, using virtual network injection and your own Storage, Azure AI Search, and Azure Cosmos DB resources, which are marked private. Agents can't reach those three resources. What should you do first?

Select one answer.

  • A Wait, because private endpoints to these resources are created automatically with the Foundry resource
  • B Create private endpoints for the Azure AI Search, Storage, and Azure Cosmos DB resources separately on their resource pages ✓ Correct answer
  • C Move the agent subnet to a public IP address range
  • D Reuse the agent subnet of another Foundry resource that already reaches these services

Answer: B

Private endpoints to Azure AI Search, Azure Storage, and Azure Cosmos DB aren't auto-created when you deploy the Foundry resource, so you create them separately. The agent subnet can't be shared by multiple Foundry resources, and public IP ranges can't be used for the delegated agent subnet.

Deep dive

How it works

With Standard Setup with private networking, Foundry Agent Service uses virtual network injection and your own Storage, Azure AI Search and Azure Cosmos DB resources. One step is easy to miss: Microsoft's note says private endpoints to Azure AI Search, Azure Storage and Azure Cosmos DB are NOT auto-created when you deploy your Foundry resource. You create them separately on their resource pages in the Azure portal. That's the first thing to check when agents can't reach the private resources.

Two subnet rules from the same page explain why the other fixes don't apply:

  • Agent subnet exclusivity: the agent subnet can't be shared by multiple Foundry resources.
  • You can't use public IP ranges (such as 44.x.x.x) for the Agent Service delegated subnet.

The other options, and when you'd use them

  • Wait for automatic creation: They aren't auto-created. Waiting won't help.
  • Move the agent subnet to a public range: Public IP ranges can't be used for the delegated agent subnet.
  • Reuse another resource's agent subnet: The agent subnet can't be shared across multiple Foundry resources.

Exam tip

Standard Setup + private BYO resources: create the private endpoints for Search, Storage and Cosmos DB yourself. Agent subnet: one per Foundry resource, private address space only.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Plan and manage questions · AI-103 study guide

Thanks for your feedback!