From a58eb622c556336420f0a77591e0fa6913726e68 Mon Sep 17 00:00:00 2001 From: Yusuf Qasem Date: Wed, 5 Aug 2026 10:40:46 +0300 Subject: [PATCH 1/2] Note that *.services.ai.azure.com isn't in the allowed endpoints list --- .../sp-invoke-external-rest-endpoint-transact-sql.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md b/docs/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md index 959452af06c..056446be3ae 100644 --- a/docs/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md +++ b/docs/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md @@ -251,6 +251,9 @@ Only calls to endpoints for the following services are allowed: | Azure Maps | `*.atlas.microsoft.com` | | Azure AI Translator | `api.cognitive.microsofttranslator.com` | +> [!NOTE] +> Azure AI Foundry resources also expose a `*.services.ai.azure.com` endpoint. That domain isn't in the allowed list. Use the `*.cognitiveservices.azure.com` endpoint of the same resource for both the database scoped credential name and the request URL. + [Outbound firewall rules for Azure SQL Database and Azure Synapse Analytics](/azure/azure-sql/database/outbound-firewall-rule-overview) control mechanism can be used to further restrict outbound access to external endpoints. > [!NOTE] From 3f81c7740371f9c5de12e0fdb75993d77255a2f2 Mon Sep 17 00:00:00 2001 From: Randolph West MSFT <97149825+rwestMSFT@users.noreply.github.com> Date: Mon, 10 Aug 2026 18:07:47 -0600 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../sp-invoke-external-rest-endpoint-transact-sql.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md b/docs/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md index 056446be3ae..03fde95843b 100644 --- a/docs/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md +++ b/docs/relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md @@ -252,7 +252,7 @@ Only calls to endpoints for the following services are allowed: | Azure AI Translator | `api.cognitive.microsofttranslator.com` | > [!NOTE] -> Azure AI Foundry resources also expose a `*.services.ai.azure.com` endpoint. That domain isn't in the allowed list. Use the `*.cognitiveservices.azure.com` endpoint of the same resource for both the database scoped credential name and the request URL. +> Azure AI Foundry resources might also expose an endpoint under `services.ai.azure.com` (for example, `https://.services.ai.azure.com`), but that domain isn't in the allowed endpoints list. Use the corresponding `https://.cognitiveservices.azure.com` endpoint for both the database scoped credential name and the request URL. [Outbound firewall rules for Azure SQL Database and Azure Synapse Analytics](/azure/azure-sql/database/outbound-firewall-rule-overview) control mechanism can be used to further restrict outbound access to external endpoints.