Error message in Azure chatbot

Question

I create a chatbot where I input some knowledge into it through a blob storage. I had some issues with authentication which were fixed (I want anybody with a link to access the chatbot with no authentication at all). Now that I can access it it does not pull in the data and when I ask a query it replies with the error message: ''Error code: 400 - {'error': {'requestid': 'f4fde4ff-5a28-45d8-988f-bfb4b4eaa629', 'code': 400, 'message': "Invalid AzureCognitiveSearch configuration detected: Call to get Azure Search index failed. Check if you are using the correct Azure Search endpoint and index name. If you are using key based authentication, check if the admin key is correct. If you are using access token authentication or managed identity of Azure OpenAI, check if the Azure Search has enabled RBAC based authentication and if the user identity or Azure OpenAI managed identity has required role assignments to access Azure Search resource [https://aka.ms/aoaioydauthentication]. If the Azure Search resource has no public network access, make sure enable trusted service of Azure Search.\nAzure Search Error: 403, message='Server responded with status 403. Error message: ', url='https://cslsearch.search.windows.net/indexes/azureblob-index2?api-version=2024-03-01-preview'\nServer responded with status 403. Error message: "}}''

Answer 1

Hello Andrei Sanzharov,

Apologies for delay, thanking Moritz Goeke for prompt response. However, to summarize the cause and resolution, I am adding some details:

The 403 Forbidden error you're seeing means your Azure AI Search service is blocking the connection from your chatbot. As Moritz correctly pointed out, this is a permissions issue.

Now, I will share the two most common causes, starting with the one that's easiest to check.

1: Check the Network Firewall

This is a very common reason for a 403 error. Your AI Search service might have a firewall that is blocking access from other Azure services.

1. In the Azure Portal, go to your Azure AI Search resource.
2. On the left menu, find and click on Networking.
3. You will likely see that "Public network access" is set to "Disabled" or "Selected Networks".
4. To fix this, either:

A) Allow Trusted Services (Recommended): Under "Exceptions", check the box for "Allow trusted Microsoft services to access this search service". This is the secure way to let services like Azure OpenAI connect.

B) Enable All Networks: Set "Public network access" to "All networks". This is simpler but less secure.

After changing this setting, wait a minute and test your chatbot again. This often resolves the issue immediately.

2: Check the Authentication Key

If the network settings are correct, the next step is to ensure you're using the correct key. The screenshot provided by Moritz shows you exactly where to look. Your chatbot needs a powerful Admin Key, not a limited Query Key.

1. In your Azure AI Search resource, navigate to the Keys blade on the left menu, just as shown in the screenshot.
2. You will see two Admin Keys (Primary and Secondary). A common mistake that causes a 403 error is accidentally using a Query Key, which doesn't have enough permission for this task.
3. Copy one of the full Admin Keys.
4. Go back to your Azure OpenAI Studio where you configured the chatbot's data source. Edit the connection and paste this Admin Key into the authentication field.

Future suggestion:
Managed Identity - While using the Admin Key works perfectly, the most secure, long-term approach is to use a Managed Identity. This method is passwordless and works by granting permission to the Azure OpenAI service itself, rather than using a key that could be misplaced. If you rebuild your bot in the future, this is the recommended approach.

Add authentication to a bot in Bot Framework SDK
Configure Azure OpenAI with Microsoft Entra ID authentication
Provision an Azure Bot using User Assigned Managed Identity

---

Please feel free to accept the answer and upvote.

Answer 2

Hi Andrei,

Sounds like your chatbot is hitting Azure AI Search but getting blocked when it tries to read the index schema. That happens if you’re using a query key (which can only run searches) instead of an admin key, or if your managed identity doesn’t have the right RBAC role.

• With keys: switch to the Admin key.
• With managed identity: give it Search Service Reader or Contributor on the Search resource, and make sure Search allows public access or "trusted services".

Hope that helps, best regards! :)