Forum Discussion
Azure AI Search in Data agents not working
I reviewed the official Microsoft documentation for Fabric Data Agent and Azure AI Search again:
https://learn.microsoft.com/en-us/fabric/data-science/data-agent-ai-search-index
It clearly states that the Data Agent sends the user’s identity to Azure AI Search and instructs assigning roles to “your user or service principal.” There is no mention of a mandatory requirement to grant permissions to the Fabric Workspace Managed Identity for query execution.
Given that this requirement does not appear anywhere in the published documentation and in fact contradicts it. I’m trying to understand where this guidance is coming from.
If there is official documentation supporting this workspace managed identity requirement, please share the link. Otherwise, it seems you may be introducing constraints that Microsoft itself hasn’t documented.
I’ll proceed according to the official documentation unless there is a verifiable source stating otherwise.
Hi sahinad ,
Thank you for taking a closer look at the documentation and for calling this out, you are correct that the Data Agent article focuses on the user context during setup. The behavior you’re seeing comes from how Fabric executes outbound calls at runtime, which is described in the broader Fabric and Azure AI Search identity/security documentation rather than on that single page. At configuration time, your signed-in user is validated (control plane). However, when the Data Agent actually runs a query against Azure AI Search, the call is issued by the Fabric service workload, which authenticates using the workspace’s managed identity for outbound access to Azure resources (data plane). That identity must also be granted RBAC access to the Search service.
You can find this model explained across the following Microsoft references:
This means the call to Azure AI Search is originating from the Fabric workspace runtime, not from the interactive user session.
Reference: Workspace outbound access protection overview - Microsoft Fabric | Microsoft Learn
Referance: Azure security baseline for Azure AI Search | Microsoft Learn
This is exactly how service-to-service calls are authorized.
Reference: Configure a managed identity - Azure AI Search | Microsoft Learn
The RBAC article clarifies that Azure Search distinguishes between:
Control plane > resource configuration
Data plane > querying/index access
Reference: Connect using Azure roles - Azure AI Search | Microsoft Learn
Fabric configuration (adding the index, validating connection) happens in the control plane context of your user. But the actual query execution is a data-plane operation, which is authorized based on the calling identity (the workspace runtime).
RBAC Is the Mechanism Used to Authorize Querying Index Data and it recommends assigning roles when using Entra authentication instead of keys:
Assign data-plane roles such as Search Index Data Reader and Search Service Contributor.
Those are exactly the roles required for a service identity to query an index.
Reference: Service Configuration in the Azure portal - Azure AI Search | Microsoft Learn
In practice, both need access:
Your user (to configure the connection).
The Fabric workspace managed identity (to execute queries at runtime).
If helpful, you can validate this by checking Azure AI Search diagnostic logs to see which object ID is issuing the query.
Kind regards,
Chaithra E.