Azure AI Search query-time SharePoint group resolution fails ("No matching identity found")

Hi @Matthew Woolnough

I'm also facing the same issue. Did you find any solution for this? If so could you please share it?

Hello Matthew Woolnough,

Welcome to the Microsoft Q&A and thank you for posting your detailed questions here.

I understand that your Azure AI Search query-time SharePoint group resolution fails with "No matching identity found".

Most of all to answer your question:

Yes, if every documented binding is exactly correct. Azure AI Search 2026-05-01-preview supports SharePoint site-group enforcement at query time by using:

1. permissionFilterOption: "enabled" on the index.
2. UserIds and GroupIds permission-filter fields.
3. spg:-prefixed SharePoint site group IDs in GroupIds.
4. A SharePointSiteUrl field marked with sharepointSiteUrl: true.
5. sharePointConnectorAppRegistration on the index, containing the Entra app ID, tenant ID, and the federated identity credential object ID.
6. A query using x-ms-query-source-authorization so Azure AI Search can resolve the caller’s permissions at query time.

• https://learn.microsoft.com/en-us/azure/search/search-query-access-control-rbac-enforcement, https://learn.microsoft.com/en-us/azure/search/search-indexer-sharepoint-access-control-lists

Meanwhile, the issue is not caused by SharePoint content ingestion or missing indexed ACL metadata. The evidence shows that the SharePoint indexer is already able to ingest content and permission metadata, including spg:-prefixed SharePoint site group IDs. The failure occurs specifically during query-time SharePoint site-group resolution, where Azure AI Search attempts to use the configured sharePointConnectorAppRegistration and federatedCredentialId to resolve the calling user’s SharePoint site group memberships. The index have to contain sharePointConnectorAppRegistration, a SharePointSiteUrl field marked with sharepointSiteUrl: true, and GroupIds containing spg:-prefixed SharePoint group values. - based on the above links.

Therefore, my advice to resolve is to validate the documented bindings once, then escalate to Microsoft backend/Product Group if the configuration is already correct. There is no need to continue recreating managed identities or federated credentials without evidence, because the same federated credential is documented to support SharePoint ACL ingestion and query-time SharePoint site group evaluation.

The required configuration is:

{
  "sharePointConnectorAppRegistration": {
    "applicationId": "<entra-application-client-id>",
    "federatedCredentialId": "<federated-identity-credential-object-id>",
    "tenantId": "<sharepoint-tenant-id>"
  },
  "permissionFilterOption": "enabled"
}

The federatedCredentialId must be the object ID of the federated identity credential on the Microsoft Entra app registration, not the application object ID, not the application client ID, not the managed identity principal ID, and not the federated credential display name.

The index must also include permission-filter fields and the SharePoint site URL field:

[
  {
    "name": "UserIds",
    "type": "Collection(Edm.String)",
    "permissionFilter": "userIds",
    "filterable": true
  },
  {
    "name": "GroupIds",
    "type": "Collection(Edm.String)",
    "permissionFilter": "groupIds",
    "filterable": true
  },
  {
    "name": "SharePointSiteUrl",
    "type": "Edm.String",
    "sharepointSiteUrl": true
  }
]

The indexer or skillset projection must map the SharePoint ACL metadata into every searchable document or chunk:

[
  {
    "sourceFieldName": "metadata_user_ids",
    "targetFieldName": "UserIds"
  },
  {
    "sourceFieldName": "metadata_group_ids",
    "targetFieldName": "GroupIds"
  },
  {
    "sourceFieldName": "metadata_sharepoint_site_url",
    "targetFieldName": "SharePointSiteUrl"
  }
]

So, if integrated vectorization or chunking is used, these fields must be projected onto every chunk through indexProjections.mappings; relying only on normal indexer field mappings is not enough when parent documents are skipped.

The application registration must have the correct API permissions under the correct API surfaces. For SharePoint site-group support, the app must include the required Microsoft Graph permissions and the required SharePoint API permissions, with admin consent granted. If Sites.Selected is used, explicit access must also be granted to every target SharePoint site; admin consent alone does not grant site access. Finally, the query must use the user token in x-ms-query-source-authorization:

POST https://{service}.search.windows.net/indexes/{index}/docs/search?api-version=2026-05-01-preview
Authorization: Bearer {query-token}
x-ms-query-source-authorization: {query-token}
Content-Type: application/json
{
  "search": "*",
  "select": "SharePointSiteUrl,GroupIds",
  "top": 5
}

If this query fails with a federated credential or identity matching error after all the above checks pass, the root cause is no longer a documented customer-side configuration issue. It should be handled as an Azure AI Search service-side query-time SharePoint group resolution issue and escalated to Microsoft support/Product Group with the failed request ID, timestamp, search service name, index name, API version, app registration client ID, federated credential object ID, and confirmation that elevated read shows spg: values in GroupIds.

For production workloads that require full SharePoint permission fidelity, The recommended path is to use a remote SharePoint knowledge source. - https://learn.microsoft.com/en-us/azure/search/search-indexer-sharepoint-access-control-lists, https://argonsys.com/microsoft-cloud/library/sensitivity-labels-preservation-and-sharepoint-acls-in-azure-ai-search/

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

Hi @Matthew Woolnough

Thank you for the detailed testing and configuration information.

Based on the results shared so far, the issue can be narrowed down to the query-time resolution of SharePoint site-group membership rather than the SharePoint indexing or ACL ingestion process.

The important distinction is that the indexer is successfully ingesting the SharePoint permission metadata, including the spg:-prefixed SharePoint group IDs. The failure occurs later, when Azure AI Search attempts to resolve the calling user's SharePoint site-group membership during the query.

For the 2026-05-01-preview API, Microsoft documents the following configuration for this scenario:

permissionFilterOption must be enabled on the index.

The index must contain the UserIds and GroupIds permission-filter fields.

SharePoint site-group IDs must be stored in GroupIds with the spg: prefix.

The index must contain a SharePointSiteUrl field marked with sharepointSiteUrl: true.

The index must contain sharePointConnectorAppRegistration.

The federatedCredentialId in that configuration must be the Object ID of the Federated Identity Credential on the connector application.

The connector application must have the required SharePoint permissions, including User.Read.All for query-time SharePoint site-group resolution, with the required admin consent.

The query must include the user's token through the x-ms-query-source-authorization header so that Azure AI Search can evaluate the caller's permissions.

One important correction/verification is worth highlighting: the federatedCredentialId used by sharePointConnectorAppRegistration is specifically the FIC object ID. It is different from the connector application's Client ID, application Object ID, or the Azure AI Search managed identity's Principal ID.

Because the same behavior has already been reproduced with a minimal test index, I would not recommend repeatedly recreating the index, managed identity, or connector application. Once the above configuration is confirmed, the next useful test is a fresh query against the minimal index using the required x-ms-query-source-authorization header.

If that request still returns "No matching identity found for federated credential ID" after the documented configuration has been verified, the remaining failure is isolated to the query-time SharePoint group-resolution path. At that point, the most useful information for further investigation is the new request ID, exact UTC timestamp, API version, and complete error response from that fresh reproduction. This allows the service-side telemetry to be correlated with the failing request rather than continuing with configuration changes that have already been ruled out.

Reference:

https://learn.microsoft.com/en-us/azure/search/search-query-access-control-rbac-enforcement?utm_source=chatgpt.com

https://learn.microsoft.com/en-us/azure/search/search-indexer-sharepoint-access-control-lists?utm_source=chatgpt.com

https://learn.microsoft.com/en-us/azure/search/search-how-to-index-sharepoint-online?utm_source=chatgpt.com

If the answer is helpful, please do click "Accept the answer” and Yes, this can be beneficial to other community members.