Azure AI Foundry standard agent private network — Agents section returning 503 despite capability host Succeeded

Environment

• Azure AI Foundry account: France Central
• Setup: Standard Agent Setup with BYOR (Bring Your Own Resources)
• Network: private access only, Private Endpoints in place (no public access)
• Deployment: Terraform via the AzAPI provider

What works

• The Foundry portal is accessible from the jumpbox (private DNS resolved correctly)
• assistants?api-version=2024-05-01-preview → 200 {"object":"list","data":[]}
• Project capability host: provisioningState = Succeeded
• BYOR connections bound: threadStorageConnections: ["conn-cosmos"], storageConnections: ["conn-storage"], vectorStoreConnections: ["conn-aisearch"]
• Cosmos containers provisioned: thread-message-store, agent-entity-store, system-thread-message-store
• All DNS endpoints resolve to private IPs (cognitiveservices, services.ai.azure.com, openai, cosmos, blob)

What does not work

The "Agents" section of the Foundry portal loads indefinitely then displays "Error loading your agents."

Direct call from the jumpbox with a valid token (audience https://ai.azure.com):

yaml

Same result with api-version=2025-05-15-preview.

AzureDiagnostics pattern (Log Analytics):

• Projects_Wildcard_Get → 503, responseLength=0, duration ~10–15s (systematic)
• Gets a list of assistants → 200, responseLength=96
• List all notifications of a specific project → 200

Example CorrelationId for a 503: 36b3015b-9f42-4acb-be8f-4e98bc6c2c58

What has been ruled out

• Token/auth issue: correct audience (https://ai.azure.com), same user who accesses the portal
• DNS/network issue: all endpoints resolve to private IPs, TCP 443 reachable
• Missing Cosmos containers: all 3 containers are present
• Missing Storage containers: present
• Capability host state: Succeeded with all connections bound

Question

Why does agents (Projects API, used by the portal) return 503 with an empty body, while assistants (OpenAI-compatible endpoint) works correctly on the same account and the same project?

Does the Azure AI Projects API (Projects_Wildcard_Get) require a distinct initialization process after the capability host is created? Is there a known issue with this endpoint in France Central?

More broadly, has anyone else run into this issue...?

Or do you see any missing steps...? Environment

• Azure AI Foundry account: France Central
• Setup: Standard Agent Setup with BYOR (Bring Your Own Resources)
• Network: private access only, Private Endpoints in place (no public access)
• Deployment: Terraform via the AzAPI provider

What works

• The Foundry portal is accessible from the jumpbox (private DNS resolved correctly)
• assistants?api-version=2024-05-01-preview → 200 {"object":"list","data":[]}
• Project capability host: provisioningState = Succeeded
• BYOR connections bound: threadStorageConnections: ["conn-cosmos"], storageConnections: ["conn-storage"], vectorStoreConnections: ["conn-aisearch"]
• Cosmos containers provisioned: thread-message-store, agent-entity-store, system-thread-message-store
• All DNS endpoints resolve to private IPs (cognitiveservices, services.ai.azure.com, openai, cosmos, blob)

What does not work

The "Agents" section of the Foundry portal loads indefinitely then displays "Error loading your agents."

Direct call from the jumpbox with a valid token (audience https://ai.azure.com):

yaml

Same result with api-version=2025-05-15-preview.

AzureDiagnostics pattern (Log Analytics):

• Projects_Wildcard_Get → 503, responseLength=0, duration ~10–15s (systematic)
• Gets a list of assistants → 200, responseLength=96
• List all notifications of a specific project → 200

Example CorrelationId for a 503: 36b3015b-9f42-4acb-be8f-4e98bc6c2c58

What has been ruled out

• Token/auth issue: correct audience (https://ai.azure.com), same user who accesses the portal
• DNS/network issue: all endpoints resolve to private IPs, TCP 443 reachable
• Missing Cosmos containers: all 3 containers are present
• Missing Storage containers: present
• Capability host state: Succeeded with all connections bound

Question

Why does agents (Projects API, used by the portal) return 503 with an empty body, while assistants (OpenAI-compatible endpoint) works correctly on the same account and the same project?

Does the Azure AI Projects API (Projects_Wildcard_Get) require a distinct initialization process after the capability host is created? Is there a known issue with this endpoint in France Central?

More broadly, has anyone else run into this issue...?

Or do you see any missing steps...?