Forum Discussion
Azure AI Search in Data agents not working
Hi,
I have followed the instructions on the documentation but nothing has helped.
I have assigned Search Index Data Contributor, Search Index Data Reader, and even Search Service Contributor role to my account.
I have set the API Access control to Both, not just Role-based access control.
Then, I have added two indexes to the data agent and have tried both semantic search and simple search. Neither of them worked. I don't get an error either.
6 Replies
Hi sahinad ,
Thank you for reaching out to Microsoft Community.When you test Azure AI Search yourself, it runs under your user identity. However, when a Microsoft Fabric Data Agent queries Azure AI Search, it does not use your account. Instead, the request is made using the Microsoft Fabric Workspace Managed Identity (a service principal).
Azure AI Search allows the request, but because the correct identity doesn’t yet have the required access (or cannot read retrievable fields), it may return only the document key instead of actual content. This results in queries appearing to succeed without returning meaningful data.Locate the Fabric Workspace Managed Identity. Copy the Object ID of the workspace identity. This identity appears as a service principal, not a user.
Grant Permissions to This Identity in Azure AI SearchIn the Azure portal: Azure AI Search > Access Control (IAM) > Add Role Assignment
Assign the roles to the Fabric Managed Identity not to your user:
Search Index Data Reader – allows the Data Agent to query indexes
Search Service Contributor – required when using semantic search features
Hope this helps.
Chaithra E.I reviewed the official Microsoft documentation for Fabric Data Agent and Azure AI Search again:
https://learn.microsoft.com/en-us/fabric/data-science/data-agent-ai-search-index
It clearly states that the Data Agent sends the user’s identity to Azure AI Search and instructs assigning roles to “your user or service principal.” There is no mention of a mandatory requirement to grant permissions to the Fabric Workspace Managed Identity for query execution.
Given that this requirement does not appear anywhere in the published documentation and in fact contradicts it. I’m trying to understand where this guidance is coming from.
If there is official documentation supporting this workspace managed identity requirement, please share the link. Otherwise, it seems you may be introducing constraints that Microsoft itself hasn’t documented.
I’ll proceed according to the official documentation unless there is a verifiable source stating otherwise.
Hi sahinad ,
Thank you for taking a closer look at the documentation and for calling this out, you are correct that the Data Agent article focuses on the user context during setup. The behavior you’re seeing comes from how Fabric executes outbound calls at runtime, which is described in the broader Fabric and Azure AI Search identity/security documentation rather than on that single page. At configuration time, your signed-in user is validated (control plane). However, when the Data Agent actually runs a query against Azure AI Search, the call is issued by the Fabric service workload, which authenticates using the workspace’s managed identity for outbound access to Azure resources (data plane). That identity must also be granted RBAC access to the Search service.
You can find this model explained across the following Microsoft references:
This means the call to Azure AI Search is originating from the Fabric workspace runtime, not from the interactive user session.
Reference: Workspace outbound access protection overview - Microsoft Fabric | Microsoft LearnReferance: Azure security baseline for Azure AI Search | Microsoft Learn
This is exactly how service-to-service calls are authorized.
Reference: Configure a managed identity - Azure AI Search | Microsoft Learn
The RBAC article clarifies that Azure Search distinguishes between:
Control plane > resource configuration
Data plane > querying/index access
Reference: Connect using Azure roles - Azure AI Search | Microsoft Learn
Fabric configuration (adding the index, validating connection) happens in the control plane context of your user. But the actual query execution is a data-plane operation, which is authorized based on the calling identity (the workspace runtime).
RBAC Is the Mechanism Used to Authorize Querying Index Data and it recommends assigning roles when using Entra authentication instead of keys:
Assign data-plane roles such as Search Index Data Reader and Search Service Contributor.
Those are exactly the roles required for a service identity to query an index.
Reference: Service Configuration in the Azure portal - Azure AI Search | Microsoft LearnIn practice, both need access:
Your user (to configure the connection).
The Fabric workspace managed identity (to execute queries at runtime).If helpful, you can validate this by checking Azure AI Search diagnostic logs to see which object ID is issuing the query.
Kind regards,
Chaithra E.
Hi sahinad ,
We’d like to follow up regarding the recent concern. Kindly confirm whether the issue has been resolved, or if further assistance is still required. We are available to support you and are committed to helping you reach a resolution.
Thank you.The issue hasn't been resolved.
Hi sahinad ,
Thank you for your patience.
At this point, we recommend reviewing the Microsoft guidance on troubleshooting indexer behavior, as it outlines how to identify issues that may not surface as explicit errors: Indexer errors and warnings - Azure AI Search | Microsoft Learn
This document explains how indexers can complete successfully while still logging warnings or skipping content, which can result in queries returning incomplete or unexpected results.
If the issue persists after validating the steps in this article, we kindly ask you to raise a support ticket so the engineering team can investigate further. Since this scenario spans multiple services (Azure AI Search, APLI, and Microsoft Fabric, currently in preview), and we’re unable to reproduce the behavior in our environment, a support case will allow for deeper, tenant-level diagnostics.
Need help in raising Support ticket: https://learn.microsoft.com/en-us/power-bi/support/create-support-ticket
Kind regards,
Chaithra E
