Unable to connect MCP Server from AZ Faundry .

Hello @KUMAR, ASHISH

Welcome to Microsoft Q&A .Thank you for reaching out to us.

The error “Name or service not known (kgateway‑e2.az.3pc.att.com:443)” indicates that the Foundry Agent Service is unable to resolve the MCP server hostname through DNS. This failure occurs at the network and name‑resolution layer, before any Model Context Protocol (MCP) handshake, TLS negotiation, or tool enumeration can begin.

Although Private Link Endpoint (PLE) and Private Link Association (PLA) configurations are already in place, Private Link connectivity can function only after DNS resolution succeeds. If the MCP hostname does not resolve to a reachable IP address from the Foundry runtime environment, the connection attempt fails before MCP communication starts.

To confirm if the issue is related to DNS or network connectivity, basic reachability checks can be performed from a virtual machine within the same connected virtual network environment:

1. Validating DNS resolution nslookup kgateway-e2.az.3pc.att.com
2. Validating HTTPS connectivity
   1. curl -v https://kgateway-e2.az.3pc.att.com/mcp
   2. or telnet kgateway-e2.az.3pc.att.com 443

If DNS resolution fails or TCP connectivity cannot be established, the issue must first be addressed at the DNS or networking layer.

When MCP access is configured through Private Link, DNS configuration is a required dependency and must be verified accrodingly as without correct DNS resolution, Private Link connectivity cannot function successfully.

1. Private DNS configuration
   1. A Private DNS zone must exist for the MCP service endpoint.
   2. An A record for kgateway‑e2.az.3pc.att.com must map to the Private Endpoint IP address.
2. Custom or enterprise DNS environments
   1. If custom DNS servers are used, conditional forwarding to Azure DNS (168.63.129.16) should be configured.
   2. Alternatively, the hostname record should be added explicitly so the MCP hostname resolves to the private IP address.

In addition to DNS, outbound network access also needs to be validated:

1. Outbound HTTPS traffic (TCP 443) must be allowed from the Foundry‑connected subnet.
2. Please review and confirm:
   • Network Security Group (NSG) outbound rules
   • Azure Firewall or third‑party firewall rules
   • Enterprise proxy or inspection devices
   • Virtual network peering and routing configuration

Any restriction preventing outbound connectivity to the MCP endpoint can result in the observed behavior.

Once DNS and networking prerequisites are confirmed, MCP configuration can be reviewed by

1. Confirming the MCP server URL is correctly defined: https://kgateway‑e2.az.3pc.att.com:443/mcp
2. Please verify:
   • Hostname spelling
   • Port usage consistency
   • MCP path
   • MCP tool configuration values

After validation, re‑trigger MCP tool enumeration from the Foundry Agent Playground.

In some scenarios, Azure AI Foundry managed runtime components used for MCP tool enumeration may not fully inherit enterprise private DNS resolution behavior. As a result, DNS resolution may succeed from internal virtual machines while MCP enumeration from Foundry continues to fail.

If the MCP hostname is resolvable only through internal DNS, additional DNS integration may be required so the hostname resolves consistently from the Foundry runtime environment.

As a validation step, temporarily exposing the MCP endpoint through one of the following can help isolate the issue

1. A publicly resolvable DNS hostname
2. Azure API Management (APIM)
3. Azure Application Gateway

If MCP tool enumeration succeeds using a publicly resolvable endpoint, this strongly indicates a private DNS visibility limitation rather than an MCP server functionality issue.

The following references might be helpful , please check them out

• Connect to MCP Server Endpoints for agents - Microsoft Foundry | Microsoft Learn
• Azure Private Endpoint private DNS zone values | Microsoft Learn

Please let us know if the above suggestions were helpful.

Thank you

I dont know what the issue is, not able to connect MCP remote sever via Foundry. AZ Infra created all PLE and PLA configuration but still not able to connect .

Dear Team,

As I was checking through the help, I found from the below reference document that we missed to "Set up private networking for Foundry Agent Service".
https://learn.microsoft.com/en-us/azure/foundry/agents/how-to/tools/model-context-protocol?pivots=python
Other reference from the MS help documents:
Private endpoints: Connect to MCP servers that aren't exposed to the public internet. Private MCP requires Standard Agent Setup with private networking and a dedicated MCP subnet within your virtual network.

Query: Are the above action items from reference documents mandatory pre-requisites that we need complete before we connect to the MCP endpoints?

HI Team - Can we have a specialist to join the call and help us to resolve the issue ?