Skip to content

Commit cc95562

Browse files
Roopan-MicrosoftRoopan-Microsoft
authored
Merge pull request #832 from microsoft/pssl-aadauthchanges
refactor: Migrate Azure AI Search from API key to Azure AD authentication
2 parents 9aa0490 + 0e3d8bc commit cc95562

4 files changed

Lines changed: 49 additions & 106 deletions

File tree

‎infra/main.bicep‎

Lines changed: 3 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1330,10 +1330,6 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
13301330
name: 'SUPPORTED_MODELS'
13311331
value: '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
13321332
}
1333-
{
1334-
name: 'AZURE_AI_SEARCH_API_KEY'
1335-
secretRef: 'azure-ai-search-api-key'
1336-
}
13371333
{
13381334
name: 'AZURE_STORAGE_BLOB_URL'
13391335
value: avmStorageAccount.outputs.serviceEndpoints.blob
@@ -1369,13 +1365,7 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
13691365
]
13701366
}
13711367
]
1372-
secrets: [
1373-
{
1374-
name: 'azure-ai-search-api-key'
1375-
keyVaultUrl: keyvault.outputs.secrets[0].uriWithVersion
1376-
identity: userAssignedIdentity.outputs.resourceId
1377-
}
1378-
]
1368+
secrets: []
13791369
}
13801370
}
13811371

@@ -1675,12 +1665,7 @@ module searchServiceUpdate 'br/public:avm/res/search/search-service:0.11.1' = {
16751665
name: take('avm.res.search.update.${solutionSuffix}', 64)
16761666
params: {
16771667
name: searchServiceName
1678-
authOptions: {
1679-
aadOrApiKey: {
1680-
aadAuthFailureMode: 'http401WithBearerChallenge'
1681-
}
1682-
}
1683-
disableLocalAuth: false
1668+
disableLocalAuth: true
16841669
hostingMode: 'default'
16851670
managedIdentities: {
16861671
systemAssigned: true
@@ -1759,7 +1744,6 @@ module aiSearchFoundryConnection 'modules/aifp-connections.bicep' = {
17591744
searchServiceResourceId: searchService.id
17601745
searchServiceLocation: searchService.location
17611746
searchServiceName: searchService.name
1762-
searchApiKey: searchService.listAdminKeys().primaryKey
17631747
}
17641748
dependsOn: [
17651749
aiFoundryAiServices
@@ -1810,12 +1794,7 @@ module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
18101794
roleDefinitionIdOrName: 'Key Vault Administrator'
18111795
}
18121796
]
1813-
secrets: [
1814-
{
1815-
name: 'AzureAISearchAPIKey'
1816-
value: searchService.listAdminKeys().primaryKey
1817-
}
1818-
]
1797+
secrets: []
18191798
enableTelemetry: enableTelemetry
18201799
}
18211800
}
@@ -1865,7 +1844,6 @@ output REASONING_MODEL_NAME string = aiFoundryAiServicesReasoningModelDeployment
18651844
output MCP_SERVER_NAME string = 'MacaeMcpServer'
18661845
output MCP_SERVER_DESCRIPTION string = 'MCP server with greeting, HR, and planning tools'
18671846
output SUPPORTED_MODELS string = '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
1868-
output AZURE_AI_SEARCH_API_KEY string = '<Deployed-Search-ApiKey>'
18691847
output BACKEND_URL string = 'https://${containerApp.outputs.fqdn}'
18701848
output AZURE_AI_PROJECT_ENDPOINT string = aiFoundryAiProjectEndpoint
18711849
output AZURE_AI_AGENT_ENDPOINT string = aiFoundryAiProjectEndpoint

‎infra/main.json‎

Lines changed: 31 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"_generator": {
77
"name": "bicep",
88
"version": "0.40.2.10011",
9-
"templateHash": "16839096090855786967"
9+
"templateHash": "17476534152468179054"
1010
},
1111
"name": "Multi-Agent Custom Automation Engine",
1212
"description": "This module contains the resources required to deploy the [Multi-Agent Custom Automation Engine solution accelerator](https://github.com/microsoft/Multi-Agent-Custom-Automation-Engine-Solution-Accelerator) for both Sandbox environments and WAF aligned environments.\n\n> **Note:** This module is not intended for broad, generic use, as it was designed by the Commercial Solution Areas CTO team, as a Microsoft Solution Accelerator. Feature requests and bug fix requests are welcome if they support the needs of this organization but may not be incorporated if they aim to make this module more generic than what it needs to be for its primary use case. This module will likely be updated to leverage AVM resource modules in the future. This may result in breaking changes in upcoming versions when these features are implemented.\n"
@@ -25441,8 +25441,8 @@
2544125441
},
2544225442
"dependsOn": [
2544325443
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
25444-
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
2544525444
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
25445+
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
2544625446
"logAnalyticsWorkspace",
2544725447
"userAssignedIdentity",
2544825448
"virtualNetwork"
@@ -30521,10 +30521,6 @@
3052130521
"name": "SUPPORTED_MODELS",
3052230522
"value": "[[\"o3\",\"o4-mini\",\"gpt-4.1\",\"gpt-4.1-mini\"]"
3052330523
},
30524-
{
30525-
"name": "AZURE_AI_SEARCH_API_KEY",
30526-
"secretRef": "azure-ai-search-api-key"
30527-
},
3052830524
{
3052930525
"name": "AZURE_STORAGE_BLOB_URL",
3053030526
"value": "[reference('avmStorageAccount').outputs.serviceEndpoints.value.blob]"
@@ -30562,13 +30558,7 @@
3056230558
]
3056330559
},
3056430560
"secrets": {
30565-
"value": [
30566-
{
30567-
"name": "azure-ai-search-api-key",
30568-
"keyVaultUrl": "[reference('keyvault').outputs.secrets.value[0].uriWithVersion]",
30569-
"identity": "[reference('userAssignedIdentity').outputs.resourceId.value]"
30570-
}
30571-
]
30561+
"value": []
3057230562
}
3057330563
},
3057430564
"template": {
@@ -32140,7 +32130,6 @@
3214032130
"containerAppEnvironment",
3214132131
"containerAppMcp",
3214232132
"existingAiFoundryAiServicesProject",
32143-
"keyvault",
3214432133
"searchServiceUpdate",
3214532134
"userAssignedIdentity"
3214632135
]
@@ -42268,15 +42257,8 @@
4226842257
"name": {
4226942258
"value": "[variables('searchServiceName')]"
4227042259
},
42271-
"authOptions": {
42272-
"value": {
42273-
"aadOrApiKey": {
42274-
"aadAuthFailureMode": "http401WithBearerChallenge"
42275-
}
42276-
}
42277-
},
4227842260
"disableLocalAuth": {
42279-
"value": false
42261+
"value": true
4228042262
},
4228142263
"hostingMode": {
4228242264
"value": "default"
@@ -44654,9 +44636,6 @@
4465444636
},
4465544637
"searchServiceName": {
4465644638
"value": "[variables('searchServiceName')]"
44657-
},
44658-
"searchApiKey": {
44659-
"value": "[listAdminKeys('searchService', '2024-06-01-preview').primaryKey]"
4466044639
}
4466144640
},
4466244641
"template": {
@@ -44666,30 +44645,45 @@
4466644645
"_generator": {
4466744646
"name": "bicep",
4466844647
"version": "0.40.2.10011",
44669-
"templateHash": "14874963049736669838"
44648+
"templateHash": "15348022841521786626"
4467044649
}
4467144650
},
4467244651
"parameters": {
4467344652
"aifSearchConnectionName": {
44674-
"type": "string"
44653+
"type": "string",
44654+
"metadata": {
44655+
"description": "Name of the AI Foundry search connection"
44656+
}
4467544657
},
4467644658
"searchServiceName": {
44677-
"type": "string"
44659+
"type": "string",
44660+
"metadata": {
44661+
"description": "Name of the Azure AI Search service"
44662+
}
4467844663
},
4467944664
"searchServiceResourceId": {
44680-
"type": "string"
44665+
"type": "string",
44666+
"metadata": {
44667+
"description": "Resource ID of the Azure AI Search service"
44668+
}
4468144669
},
4468244670
"searchServiceLocation": {
44683-
"type": "string"
44671+
"type": "string",
44672+
"metadata": {
44673+
"description": "Location/region of the Azure AI Search service"
44674+
}
4468444675
},
4468544676
"aiFoundryName": {
44686-
"type": "string"
44677+
"type": "string",
44678+
"metadata": {
44679+
"description": "Name of the AI Foundry account"
44680+
}
4468744681
},
4468844682
"aiFoundryProjectName": {
44689-
"type": "string"
44690-
},
44691-
"searchApiKey": {
44692-
"type": "securestring"
44683+
"type": "string",
44684+
"metadata": {
44685+
"description": "Name of the AI Foundry project"
44686+
}
4469344687
}
4469444688
},
4469544689
"resources": [
@@ -44700,10 +44694,7 @@
4470044694
"properties": {
4470144695
"category": "CognitiveSearch",
4470244696
"target": "[format('https://{0}.search.windows.net', parameters('searchServiceName'))]",
44703-
"authType": "ApiKey",
44704-
"credentials": {
44705-
"key": "[parameters('searchApiKey')]"
44706-
},
44697+
"authType": "AAD",
4470744698
"isSharedToAll": true,
4470844699
"metadata": {
4470944700
"ApiType": "Azure",
@@ -44777,12 +44768,7 @@
4477744768
]
4477844769
},
4477944770
"secrets": {
44780-
"value": [
44781-
{
44782-
"name": "AzureAISearchAPIKey",
44783-
"value": "[listAdminKeys('searchService', '2024-06-01-preview').primaryKey]"
44784-
}
44785-
]
44771+
"value": []
4478644772
},
4478744773
"enableTelemetry": {
4478844774
"value": "[parameters('enableTelemetry')]"
@@ -47908,7 +47894,6 @@
4790847894
"dependsOn": [
4790947895
"[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').keyVault)]",
4791047896
"logAnalyticsWorkspace",
47911-
"searchService",
4791247897
"userAssignedIdentity",
4791347898
"virtualNetwork"
4791447899
]
@@ -48041,10 +48026,6 @@
4804148026
"type": "string",
4804248027
"value": "[[\"o3\",\"o4-mini\",\"gpt-4.1\",\"gpt-4.1-mini\"]"
4804348028
},
48044-
"AZURE_AI_SEARCH_API_KEY": {
48045-
"type": "string",
48046-
"value": "<Deployed-Search-ApiKey>"
48047-
},
4804848029
"BACKEND_URL": {
4804948030
"type": "string",
4805048031
"value": "[format('https://{0}', reference('containerApp').outputs.fqdn.value)]"

‎infra/main_custom.bicep‎

Lines changed: 3 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1365,10 +1365,6 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
13651365
name: 'SUPPORTED_MODELS'
13661366
value: '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
13671367
}
1368-
{
1369-
name: 'AZURE_AI_SEARCH_API_KEY'
1370-
secretRef: 'azure-ai-search-api-key'
1371-
}
13721368
{
13731369
name: 'AZURE_STORAGE_BLOB_URL'
13741370
value: avmStorageAccount.outputs.serviceEndpoints.blob
@@ -1412,13 +1408,7 @@ module containerApp 'br/public:avm/res/app/container-app:0.18.1' = {
14121408
]
14131409
}
14141410
]
1415-
secrets: [
1416-
{
1417-
name: 'azure-ai-search-api-key'
1418-
keyVaultUrl: keyvault.outputs.secrets[0].uriWithVersion
1419-
identity: userAssignedIdentity.outputs.resourceId
1420-
}
1421-
]
1411+
secrets: []
14221412
}
14231413
}
14241414

@@ -1720,12 +1710,7 @@ module searchService 'br/public:avm/res/search/search-service:0.11.1' = {
17201710
name: take('avm.res.search.search-service.${solutionSuffix}', 64)
17211711
params: {
17221712
name: searchServiceName
1723-
authOptions: {
1724-
aadOrApiKey: {
1725-
aadAuthFailureMode: 'http401WithBearerChallenge'
1726-
}
1727-
}
1728-
disableLocalAuth: false
1713+
disableLocalAuth: true
17291714
hostingMode: 'default'
17301715
managedIdentities: {
17311716
systemAssigned: true
@@ -1801,7 +1786,6 @@ module aiSearchFoundryConnection 'modules/aifp-connections.bicep' = {
18011786
searchServiceResourceId: searchService.outputs.resourceId
18021787
searchServiceLocation: searchService.outputs.location
18031788
searchServiceName: searchService.outputs.name
1804-
searchApiKey: searchService.outputs.primaryKey
18051789
}
18061790
dependsOn: [
18071791
aiFoundryAiServices
@@ -1852,12 +1836,7 @@ module keyvault 'br/public:avm/res/key-vault/vault:0.12.1' = {
18521836
roleDefinitionIdOrName: 'Key Vault Administrator'
18531837
}
18541838
]
1855-
secrets: [
1856-
{
1857-
name: 'AzureAISearchAPIKey'
1858-
value: searchService.outputs.primaryKey
1859-
}
1860-
]
1839+
secrets: []
18611840
enableTelemetry: enableTelemetry
18621841
}
18631842
}
@@ -1908,7 +1887,6 @@ output REASONING_MODEL_NAME string = aiFoundryAiServicesReasoningModelDeployment
19081887
output MCP_SERVER_NAME string = 'MacaeMcpServer'
19091888
output MCP_SERVER_DESCRIPTION string = 'MCP server with greeting, HR, and planning tools'
19101889
output SUPPORTED_MODELS string = '["o3","o4-mini","gpt-4.1","gpt-4.1-mini"]'
1911-
output AZURE_AI_SEARCH_API_KEY string = '<Deployed-Search-ApiKey>'
19121890
output BACKEND_URL string = 'https://${containerApp.outputs.fqdn}'
19131891
output AZURE_AI_PROJECT_ENDPOINT string = aiFoundryAiProjectEndpoint
19141892
output AZURE_AI_AGENT_ENDPOINT string = aiFoundryAiProjectEndpoint

‎infra/modules/aifp-connections.bicep‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,27 @@
1+
@description('Name of the AI Foundry search connection')
12
param aifSearchConnectionName string
3+
4+
@description('Name of the Azure AI Search service')
25
param searchServiceName string
6+
7+
@description('Resource ID of the Azure AI Search service')
38
param searchServiceResourceId string
9+
10+
@description('Location/region of the Azure AI Search service')
411
param searchServiceLocation string
12+
13+
@description('Name of the AI Foundry account')
514
param aiFoundryName string
15+
16+
@description('Name of the AI Foundry project')
617
param aiFoundryProjectName string
7-
@secure()
8-
param searchApiKey string
918

1019
resource aiSearchFoundryConnection 'Microsoft.CognitiveServices/accounts/projects/connections@2025-04-01-preview' = {
1120
name: '${aiFoundryName}/${aiFoundryProjectName}/${aifSearchConnectionName}'
1221
properties: {
1322
category: 'CognitiveSearch'
1423
target: 'https://${searchServiceName}.search.windows.net'
15-
authType: 'ApiKey'
16-
credentials: {
17-
key: searchApiKey
18-
}
24+
authType: 'AAD'
1925
isSharedToAll: true
2026
metadata: {
2127
ApiType: 'Azure'

0 commit comments

Comments
 (0)