How to setup call azure ai search knowledge bases on behalf of a user. Required detailed steps for production ready deployment

Welcome to Microsoft Q&A

@Bhaskar Adari I hope you are doing well,

Azure AI Search is connected to a remote SharePoint Knowledge Base, querying on behalf of the user is strictly required. This ensures SharePoint enforces document‑level security trimming so the user only receives search results for files they actually have permission to view.

Possible scenarios to implement;

Entra ID App Registration Register your chatbot in Microsoft Entra ID. Under API Permissions, grant delegated access to Azure AI Search. Configure it to request the scope: https://search.azure.com/.default

Capture the User Token Your chatbot front‑end (Teams, Web Chat, etc.) must authenticate the user at login and pass their Entra ID bearer token to your bot’s backend API.

Token Exchange via Code (OBO flow) In your backend, you cannot use the front‑end token directly against Search. You must exchange it using the On‑Behalf‑Of flow.

In C# or Python, use the OnBehalfOfCredential class from the Azure.Identity SDK.

  Initialize it with your App’s Client ID, Client Secret, Tenant ID, and the `userAssertionToken` (from Step 2).
  
     Pass this credential into the `SearchClient` constructor. The SDK will handle fetching and refreshing the token.
     

Recommended next step Verify that your chatbot’s App Registration has the correct delegated permissions for Azure AI Search. Then review the Azure.Identity SDK documentation for your chosen language to implement OnBehalfOfCredential.

References

Microsoft identity platform and OAuth 2.0 On‑Behalf‑Of flow (learn.microsoft.com in Bing)

Azure Identity client library for .NET – OnBehalfOfCredential (learn.microsoft.com in Bing)

Index data from SharePoint Online – Azure AI Search (learn.microsoft.com in Bing)