Skip to content

Troubleshoot connectivity problems

Run tests from an affected client and, when possible, a known-good client.

1. Check the endpoint

For private access, confirm:

  • the Private Endpoint exists;
  • its connection status is Approved;
  • the private IP has not changed;
  • the client has a route to its subnet;
  • network security controls permit the connection.

Test TCP connectivity without sending credentials:

nc -vz <service-hostname> 443

2. Check DNS

nslookup <service-hostname>

For private access, the result must be the Private Endpoint private IP. If the result is NXDOMAIN, public, or stale, check the private zone, records, VNet links, custom DNS, and conditional forwarding.

Microsoft documents common causes in Private Endpoint DNS resolution.

3. Check TLS

SERVICE_HOSTNAME="<deployment-service-hostname>"

openssl s_client \
  -connect "${SERVICE_HOSTNAME}:443" \
  -servername "${SERVICE_HOSTNAME}" \
  -verify_return_error </dev/null

Check certificate dates, subject alternative names, intermediate certificates, and client trust. A successful check ends with Verify return code: 0 (ok).

Common results:

Result Investigate
Name or service not known DNS name, resolver, private zone, or forwarding
Timeout or refused connection Route, firewall, Private Endpoint, endpoint health, or port
unable to get local issuer certificate Missing intermediate or client trust anchor
Hostname mismatch Wrong DNS name or certificate subject alternative name
Expired certificate Certificate renewal and managed action status

Do not disable certificate verification as a fix.

4. Check authentication

Only after TLS works, confirm the account is active and has the intended roles. Test in a private browser session to exclude stale cookies.

If the same failure remains after these checks, get support with redacted results.