State the allowed AI endpoint domains in credential name rules - #10372
Conversation
|
Yusuf Qasem (@BenjisCollector) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Yusuf Qasem (@BenjisCollector) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Learn Build status updates of commit 27b93a2: ✅ Validation status: passed
For more details, please refer to the build report. |
|
Randolph West MSFT (@rwestMSFT) Can you review the proposed changes? Important: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
There was a problem hiding this comment.
Pull request overview
Clarifies the “allow list” constraint for external model credential domains by explicitly listing the AI-related allowed endpoint domains and linking readers to the canonical “Allowed endpoints” list for Azure SQL Database and Azure SQL Managed Instance.
Changes:
- Added a NOTE enumerating the allowed AI endpoint domains for Azure SQL DB/MI.
- Added guidance about Azure AI Foundry
*.services.ai.azure.comvs the allowed*.cognitiveservices.azure.comendpoint. - Linked directly to the “Allowed endpoints” section of
sp_invoke_external_rest_endpoint.
| > [!NOTE] | ||
| > On Azure SQL Database and Azure SQL Managed Instance, the allowed domains for AI endpoints are `*.cognitiveservices.azure.com`, `*.api.cognitive.microsoft.com`, and `*.openai.azure.com`. Azure AI Foundry resources also expose a `*.services.ai.azure.com` endpoint, which isn't in the allowed list. Use the `*.cognitiveservices.azure.com` endpoint of the same resource for both `CREDENTIAL` and `LOCATION`. For the full list, see [Allowed endpoints](../../relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md#allowed-endpoints). |
Summary
The Credential name rules for external model section says the URL domain "must be one of those domains included in the allow list" but doesn't say where that list is or what's on it. Readers arriving here for
AI_GENERATE_EMBEDDINGShave no direct path to the constraint.This adds a note naming the AI-relevant allowed domains and linking to Allowed endpoints.
Context
Azure AI Foundry resources surface a
*.services.ai.azure.comhostname that isn't on the allowed list, while the same resource is reachable at*.cognitiveservices.azure.com, which is. SinceCREDENTIALandLOCATIONon this page both take that hostname, stating the allowed domains here saves a reader a hop to another article.