From 27b93a296c8b758ffe15a96671e0f897bf4c8961 Mon Sep 17 00:00:00 2001 From: Yusuf Qasem Date: Wed, 5 Aug 2026 10:40:48 +0300 Subject: [PATCH] State the allowed AI endpoint domains in credential name rules --- docs/t-sql/statements/create-external-model-transact-sql.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/t-sql/statements/create-external-model-transact-sql.md b/docs/t-sql/statements/create-external-model-transact-sql.md index 8ecd94ded1d..a9c14244efa 100644 --- a/docs/t-sql/statements/create-external-model-transact-sql.md +++ b/docs/t-sql/statements/create-external-model-transact-sql.md @@ -200,6 +200,9 @@ The created `DATABASE SCOPED CREDENTIAL` used by an external model must follow t - The credential must point to a path that's more generic than the request URL. For example, a credential created for path `https://northwind.azurewebsite.net/customers` can't be used for the URL `https://northwind.azurewebsite.net`. +> [!NOTE] +> On Azure SQL Database and Azure SQL Managed Instance, the allowed domains for AI endpoints are `*.cognitiveservices.azure.com`, `*.api.cognitive.microsoft.com`, and `*.openai.azure.com`. Azure AI Foundry resources also expose a `*.services.ai.azure.com` endpoint, which isn't in the allowed list. Use the `*.cognitiveservices.azure.com` endpoint of the same resource for both `CREDENTIAL` and `LOCATION`. For the full list, see [Allowed endpoints](../../relational-databases/system-stored-procedures/sp-invoke-external-rest-endpoint-transact-sql.md#allowed-endpoints). + #### Collation and credential name rules [RFC 3986 Section 6.2.2.1](https://www.rfc-editor.org/rfc/rfc3986#section-6.2.2.1) states that "When a URI uses components of the generic syntax, the component syntax equivalence rules always apply; namely, that the scheme and host are case-insensitive." [RFC 7230 Section 2.7.3](https://www.rfc-editor.org/rfc/rfc7230#section-2.7.3) mentions that "all other are compared in a case-sensitive manner."