Authentication/RBAC

Hi @Craig Colley

Thanks for reaching us regarding the error Azure AI Search resource has disabled RBAC authentication we started checking on it we will share our suggestions ASP

Hi @Craig Colley

Thanks for reaching out regarding the RBAC and indexing issues in Azure AI Studio. The errors indicate that RBAC authentication is disabled on your Azure AI Search resource and that the required managed identities and role assignments are not yet fully configured.

Here’s how you can resolve this and re-enable the “Add your data” option:

Step 1: Enable Managed Identities

• For your Azure OpenAI resource and Azure AI Search (oandmsearch), navigate to Identity > System assigned, set Status to On, and click Save.
• If you don't see the Identity tab, make sure you have Owner or Contributor permissions and that oandmsearch is using the Basic SKU or higher, as the Free tier does not support managed identities.
• Set up managed identities as needed.

Step 2: Enabling RBAC for Azure AI Search

• Navigate to oandmsearch > Settings > Keys, then select Role-based access control (or Both) and click Save.
• Ensure that RBAC is enabled.

Step 3: Assign the necessary roles

• For the OpenAI MI (Object ID: b3e39ac8-71ee-4865-9dc1-6053b235b978):
  • On oandmsearch: assign the Search Index Data Reader and Search Service Contributor roles.
    • On oandmstorage: assign the Storage Blob Data Contributor role.
    • For the AI Search MI (check the Object ID under oandmsearch > Identity):
      • On the OpenAI resource: assign the Cognitive Services OpenAI Contributor role.
        • On oandmstorage: assign the Storage Blob Data Reader role.
        • Assign the necessary roles for Azure OpenAI.
• Connect AI Search to storage.

Step 4: Review Networking Settings (if needed)

• If private endpoints are enabled, make sure "Allow trusted Microsoft services" is enabled in the Networking settings for both oandmsearch and oandmstorage.
• Refer to networking guidance as required.

Step 5: Testing in AI Studio

• Allow 10–15 minutes for role propagation, then refresh AI Studio and use the “Add your data” option in Playground Chat.
• Verify that your user account has the Cognitive Services OpenAI Contributor role on the OpenAI resource.
• Working with your data in Azure OpenAI

Troubleshooting Tips:

• Is oandmsearch currently on the Free tier? If so, consider upgrading to Basic or higher.
• Are all resources, including OpenAI, AI Search, and Storage, located in supported regions? Please check region support.
• If private endpoints are being used, verify VNet/DNS settings and ensure trusted services are configured.
• Check that the data source path in AI Studio is directed to the correct oandmstorage container.
• Are there any other error messages appearing during indexing?

Reference:
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview

https://learn.microsoft.com/en-us/azure/search/search-security-rbac?tabs=roles-portal-admin%2Croles-portal%2Croles-portal-query%2Ctest-portal%2Ccustom-role-portal

https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security

https://learn.microsoft.com/en-us/azure/ai-foundry/

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.

Hi,

I'm still getting a mesage, although seems to be a little differnt:
Failed to validate the selected authentication type. Please resolve the following errors and click next. Learn more about how to fix validation errors 

• The Azure AI Search system assigned managed identity doesn't have required role assignment to Azure OpenAI resource: Cognitive Services OpenAI Contributor. Adding role assignments takes about 10 minutes to take effect.

I have done all of the steps you suggested and left it 10 minutes. It's also worth pointing out that when I am trying to do this add data, I am choosing the Storage blob, and the indexing option is grayed out in the first screen.

Thesea re the roles and profile access I've given based on your inputs:

Edited PII information

roubleshooting Tips:

• Is oandmsearch currently on the Free tier? If so, consider upgrading to Basic or higher.
  • Its basic
• Are all resources, including OpenAI, AI Search, and Storage, located in supported regions? Please check region support.
  • All in West Europe
• If private endpoints are being used, verify VNet/DNS settings and ensure trusted services are configured.
  • They are public
• Check that the data source path in AI Studio is directed to the correct oandmstorage container.
  • HOw do I do this?
• Are there any other error messages appearing during indexing?
  • It's not at the point of indexing, it doesnt pass the 'add data' screen

Hi @Craig Colley

Thank you for your patience and for sharing the detailed role assignments. The error message "The Azure AI Search system assigned managed identity doesn't have required role assignment to Azure OpenAI resource: Cognitive Services OpenAI Contributor" likely points to a propagation delay, as Azure role changes may take 30-60 minutes to apply. Also, the grayed-out indexing option in "Add your data" probably means that an embedding model deployment is missing, which is necessary for vector search (the default for RAG in Azure AI Studio). Since you're on the Basic tier in West Europe with public endpoints and the roles seem correctly assigned, here’s a plan to help resolve the issue and clarify your question about the data source path.

Suggested Steps

1. Re-apply the Cognitive Services OpenAI Contributor role:
   • Sometimes, role propagation can be delayed in Azure's distributed systems:
   • In the Azure portal, navigate to oandmopenai > Access control (IAM).
   • Find the Cognitive Services OpenAI Contributor role assigned to the Azure AI Search MI (oandmsearch, Object ID: XXXXf8da-XXXX-4d97-XXXX-ac9f1fd9XXXX.), remove it, then add it again: Add role assignment > select Cognitive Services OpenAI Contributor > choose Managed identity > select oandmsearch > Save.
   • Wait 30-60 minutes before retrying "Add your data" in Azure AI Studio.
2. Deploying an Embedding Model
   • If the indexing option is grayed out, it usually indicates that there isn’t an embedding model (such as text-embedding-3-small or text-embedding-ada-002) deployed, which is necessary for vector search:
   • Go to Azure OpenAI Studio (or Azure portal > oandmopenai > Model deployments) and check if an embedding model is present.
   • If not, select Deploy model, choose text-embedding-3-small, assign it a name (for example, "embedding-model"), and deploy it.
   • In Azure AI Studio > Playground > Chat > "Add your data," choose this embedding model when prompted.
   • If you only require keyword search, you can turn off vector search in the advanced index settings, but using vector search is recommended.
3. Configure the Blob Storage Data Source Path
   • To set the correct container path:
   • In Azure AI Studio, go to Playground > Chat > "Add your data." Choose Azure Blob Storage, then select your subscription, the resource group (ag-project-rg), and oandmstorage.
   • In the Data source field, provide the container name (like "documents") or a subfolder (such as "documents/myfolder") where your files (PDFs, TXT, etc.) are located. Make sure the container exists in oandmstorage and only contains supported file types under 16MB each.
   • For example, if your files are in a container named "rag-data," enter "rag-data" or "rag-data/subfolder" if they’re stored in a subfolder.
   • Check that the container is not empty, as this may cause validation to fail.
4. Additional Checks
   • Refresh Azure AI Studio by signing out and back in, or clear your browser cache to remove any cached errors.
   • Check MI Status: Make sure the system-assigned MI for oandmsearch is enabled (Azure portal > oandmsearch > Identity > System assigned > Status: On) and that it matches Object ID XXXXf8da-XXXX-4d97-XXXX-ac9f1fd9XXXX.
   • If the issue continues, try using the "Import and vectorize data" wizard in Azure AI Studio to create the index separately, then attach it in "Add your data."
   • As public endpoints are confirmed, no networking changes are required.

Please follow these steps and make sure to wait for role propagation. Could you please confirm the following:

• The name of any deployed embedding model in oandmopenai
• The specific container or folder path you entered in "Add your data"
• Any new error messages that appear after re-applying the role

Reference :
https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

https://learn.microsoft.com/en-us/azure/ai-foundry/openai/concepts/use-your-data?tabs=ai-search%2Ccopilot

https://learn.microsoft.com/en-us/dotnet/ai/quickstarts/build-chat-app?pivots=openai

https://learn.microsoft.com/en-us/azure/ai-foundry/openai/how-to/on-your-data-configuration

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.