api-eur.cognitive.microsofttranslator.com with firewall doesn't work

Hello @sandervv

Thank you for reaching out to Microsoft Q&A.

From your description, I understand that you're configuring ServiceNow to use Azure AI Translator and want to ensure that translation requests are processed only in West Europe. You've observed the following behavior:

• https://api-eur.cognitive.microsofttranslator.com does not work when your Azure AI Translator resource has firewall restrictions enabled.
• https://<RESOURCE>.cognitiveservices.azure.com/translator/text/v3.0 works successfully after configuring the appropriate firewall exceptions.

Based on the available documentation, this behavior is expected.

For Azure AI Translator resources that have network access restrictions (such as firewall rules, selected networks, or private endpoints), Microsoft recommends using your resource-specific endpoint, for example:

https://<RESOURCE>.cognitiveservices.azure.com/translator/text/v3.0

This endpoint is directly associated with your Azure AI resource and supports:

Azure Firewall and selected network rules

• Private Endpoints

Azure authentication and access controls

On the other hand, https://api-eur.cognitive.microsofttranslator.com is a shared regional Translator endpoint. Although the hostname indicates the European region, it is not tied to your specific Azure AI resource. Because of this, it does not use the network configuration of your resource in the same way as the custom endpoint.

With strict firewall configurations, requests to api-eur.cognitive.microsofttranslator.com may fail simply because the destination hostname differs from your resource endpoint and is not covered by your firewall allow list.

Is translation processed only in West Europe?

Yes, since your Translator resource is deployed in West Europe and you're using the resource-specific endpoint, translation requests are processed by the Translator service associated with that regional resource. In other words, your requests are routed through your West Europe Translator resource rather than being processed across random global regions.

The resource region determines where the Translator service for your resource is hosted, and using the custom endpoint ensures that requests are routed through that regional service.

Why does api-eur.cognitive.microsofttranslator.com behave differently?

Although api-eur.cognitive.microsofttranslator.com suggests an EU regional endpoint, it is still a different hostname from your Azure resource endpoint.

If your firewall or network security policies are configured to allow only your Azure AI resource endpoint, requests to the shared regional endpoint will not be permitted unless that hostname is also explicitly allowed. This explains why your resource endpoint succeeds while the regional endpoint does not.

Recommendation

If your goal is to:

Restrict access using Azure Firewall or selected networks,

Use Private Endpoints,

Ensure requests are routed through your provisioned Translator resource in West Europe,

then we recommend continuing to use the resource-specific endpoint:

https://<RESOURCE>.cognitiveservices.azure.com/translator/text/v3.0

rather than the shared regional endpoint:

https://api-eur.cognitive.microsofttranslator.com

I Hope this helps. Do let me know if you have any further queries.

Thank you!