Implement generative AI and agentic solutions 2.2 Build agents by using Foundry

An agent in Microsoft Foundry Agent Service (standard agent setup with virtual network…

Study guide skill: Integrate agent tools, including APIs, knowledge stores, search, content understanding, and custom functions

Question B1-026

An agent in Microsoft Foundry Agent Service (standard agent setup with virtual network injection) uses the Azure AI Search tool with an existing index. The security team then disables public network access on the search service, and the agent's searches start failing. How should the project connection to the search service be configured?

Select one answer.

  • A Regenerate the search admin key and update the connection
  • B Move the index into the agent's vector store
  • C Use keyless authentication with managed identity (Microsoft Entra ID) for the connection ✓ Correct answer
  • D Switch the connection to a query key

Answer: C

If public network access is disabled on the Azure AI Search resource, the project connection must use managed identity (keyless Microsoft Entra ID authentication) instead of an API key; key-based authentication isn't supported with private virtual networking. A private search service also needs the standard agent setup with virtual network injection, which this agent already uses. Regenerating or switching keys doesn't help, and moving the index into a vector store doesn't fix the connection.

Deep dive

How it works

Turning off public network access on Azure AI Search changes which authentication methods still work for the agent's connection. The Azure AI Search tool page says it twice: if you use a private virtual network with the tool, you must use Microsoft Entra project managed identity (keyless authentication) in the Azure AI Search connection, and key-based authentication isn't supported with private virtual networking. If you disabled public network access on the search resource, configure the connection to use managed identity instead of an API key.

The network side is already in place here. To use a private Azure AI Search tool with your agents, you deploy the standard agent setup with virtual network injection. Without it, the tool can fail to connect to a search service with a private endpoint.

So the fix is the connection's auth type:

  1. Switch the project connection to keyless (managed identity).
  2. On the search service, grant the Foundry account's managed identity the roles the tool's setup lists: Search Index Data Contributor and Search Service Contributor.
  3. Re-test with a question you know is answered in the index, and confirm the reply includes citations.

The other options, and when you'd use them

  • Regenerate the search admin key: A fresh key is still a key. Key-based authentication isn't supported with private virtual networking.
  • Move the index into the agent's vector store: Vector stores are how the file search tool grounds an agent on uploaded files. It's a different tool, and it doesn't fix the connection to your existing index.
  • Switch the connection to a query key: Same problem as the admin key. The page says to use managed identity instead of an API key when public network access is disabled.

Exam tip

"Search is private" + "agent tool fails" = keyless managed identity on the connection (plus standard setup with VNet injection). Any answer that swaps one key for another is wrong.

References

Last reviewed:

Ready to test yourself? The quiz asks this and every other AI-103 question, with instant feedback. Practice this in a quiz →

All Generative AI & agents questions · AI-103 study guide

Thanks for your feedback!