GPT-4 Vision model cannot read images from Azure Blob Storage with SAS token

Other Questions OpenAI
1

Issue Description

I’m trying to use GPT-4 Vision with images stored in Azure Blob Storage but I’m running into access errors. My storage account is set up with a private endpoint within a Virtual Network.

Error Message

When I pass the SAS URL to the model, I receive the following 403 error:

BadRequestError: Error code: 400 - {'error': {'code': 'BadRequest', 'message': 'The provided image url can not be accessed. status code: 403.', 'param': None, 'type': None}}

My Python Implementation

user_message = [
    {
        "role": "user",
        "content": [
            {
                "type": "text", 
                "text": "Process this document image"
            },
            {
                "type": "image_url",
                "image_url": {
                    "url": blob_sas_url
                }
            }
        ]
    }
]

response = openai_client.chat.completions.create(
    model=model_name,
    messages=user_message,
    max_tokens=1000,
    temperature=0.5
)

What I’ve Tried

  • Added private endpoint to the OpenAI resource
  • Confirmed that the SAS token works in the browser
  • Used Base64 encoding as a workaround, which functions correctly

What steps can I take to enable the vision model to access blob URLs directly?

2

Had the exact same problem with my document processing setup. Private endpoints block OpenAI from hitting your blob storage, even with valid SAS tokens. Don’t mess with firewall rules or make your storage public - I built a proxy service inside the same VNet as my storage. It grabs the images and serves them on a public endpoint that OpenAI can reach. Security stays intact. Another option: Azure Function with blob bindings that creates temp public URLs on demand. Process through GPT-4 Vision, then kill the URLs. Both ways skip the base64 mess and keep your storage locked down behind the private endpoint.

3

Same headache here last week! OpenAI’s servers can’t reach your private blob storage even with a valid SAS token. Add OpenAI’s service IP ranges to your storage firewall rules - fixed it for me without making everything public.

4

Yeah, this is super common with private endpoints. OpenAI can’t reach your blob storage when it’s locked down to your VNet.

I’ve hit this same issue multiple times. Making storage public or messing with firewall rules just creates security headaches.

I built an automation that handles everything seamlessly. It grabs images from private blob storage, processes them through GPT-4 Vision, and returns results without exposing anything publicly.

The automation sits in your network, downloads the blob content, converts to base64, sends to OpenAI, then cleans up. Your security stays intact while you get direct API access.

I used Latenode since it handles blob storage connections, base64 conversion, and OpenAI API calls in one workflow. Runs on schedule or webhook triggers so you can process batches or real-time requests.

Way cleaner than managing networking complexity or keeping sensitive images in public storage.