Security requires that calls from your apps to Azure OpenAI never cross the public internet and never use shared keys. How do you set it up, and how do you prove it works?

Close the public door, open a private one, and replace keys with identities. Set the Foundry (or Azure OpenAI) resource's public network access to Disabled, add a private endpoint in your virtual network, make DNS resolve the resource's usual name to that private IP, and turn off key authentication so callers use Entra ID through managed identities. Then prove it from inside and outside the network. If agents run in Foundry and call your data, their outbound traffic needs its own setup, virtual network injection.

1. Inbound: apps to the model

Clients keep the same endpoint name; DNS inside the network returns the private IP, outside it the public one, which now refuses them.

2. Identity: no shared keys

• Give each app a managed identity and an RBAC role on the resource.
• Disable local (key) authentication on the resource, for example with Set-AzCognitiveServicesAccount -DisableLocalAuth $true.
• In code, pass an Entra ID token provider to the OpenAI client instead of a key.

3. Outbound: agents to your data

Foundry agents reach private data through virtual network injection into a subnet delegated to Microsoft.App/environments, /27 or larger. Private endpoints to Azure AI Search, Storage and Cosmos DB are not created for you. Some agent tools, such as web search and Bing grounding, use public endpoints by design; block them with Azure Policy if the rule is "nothing public". Outbound networking cannot be added to an existing deployment later, so decide before you build.

4. Prove it

# from a VM inside the network: should print a private 10.x address
nslookup my-foundry.openai.azure.com

# from a laptop outside: the call should be refused
curl -s -o /dev/null -w "%{http_code}" https://my-foundry.openai.azure.com/openai/v1/models

And a call with a key should fail once local auth is off.

What interviewers want: public access disabled, a private endpoint with DNS done right, Entra ID with managed identities and keys disabled, the separate outbound story for agents with its subnet rules and public tools, and a test from both sides of the network.