AI Search Knowledgebase created in MS Foundry: "An unexpected error occurred. Verify role assignments and network access"

Question

AI Search Knowledgebase created in MS Foundry: "An unexpected error occurred. Verify role assignments and network access"

Jason Lee 216

Hi,

In MS Foundry, I created a new Blob storage knowledgebase by doing this.
User's image

When I create an agent to use it, the agent just says "I’m currently having trouble retrieving the latest listings." and the trace says everything was fine
User's image

When I try the knowledge base directly in portal, it says "An unexpected error occurred. Verify role assignments and network access for your search service and other connected resources, then try again" but no other details.
User's image

I'm using RBAC and I verified the Foundry (i.e. Open AI) roles were assigned as per https://learn.microsoft.com/en-us/azure/search/agentic-retrieval-how-to-retrieve, plus added some additional ones just in case.
User's image

How do I diagnose this problem? Any suggestions on solutions?

Thanks in advance!

Adam Zachary 2,025 Reputation points

2025-11-26T19:55:57.14+00:00
I ran into this exact problem before, and the error message in Foundry is unfortunately too generic.

In my case it came down to two things that were easy to miss, even though all the RBAC roles “looked” correct.

First, double-check that the Foundry system-assigned managed identity actually has access on the storage account itself, not just the container. Foundry needs Storage Blob Data Reader at the account or container scope, and the identity has to be the right one. I learned the hard way that I had given the role to my own user or to the wrong identity inside Foundry.

Second, the network settings on the Storage Account or the Search Service will break this silently. If either resource is set to “Selected Networks,” Foundry cannot reach it unless you explicitly add the Search Service’s outbound IPs. This was the root cause for me. The moment I switched Storage back to “Enabled from all networks” just for testing, the knowledge base started working immediately.

After fixing those two things, the error disappeared in Foundry and the agent was able to query the knowledge base normally.

So, in short, the two things I would check right away are:

Make sure the correct Foundry managed identity has Storage Blob Data Reader (or higher) on the storage account or container.

Make sure neither the Storage Account nor the Search Service is blocked by network rules. Open access temporarily, test, then lock it down properly.
Jason Lee 216 Reputation points

2025-11-27T15:18:29.7033333+00:00
Thanks for the assist! Unfortunately, I don't believe my problem is the same as yours.

I double checked my RBAC permissions for my search service...then removed/readded again just to see if the issue was something strange like that. Here's a screenshot where you can see I added extra permissions just in case. I don't think it's a permission issue to BLOB storage since the indexer populates the index correctly.

All my resources are not privately networked yet, so I don't think that's the issue. I double checked just in case.

You mentioned giving Foundry access to the BLOB which I don't have at the moment since I figured only AI Search needs that, but I unsuccessfully tried that anyway just in case.
Sina Salam 26,661 Reputation points Volunteer Moderator

2025-11-28T10:20:54.14+00:00
Hello Jason Lee,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having "an unexpected error occurred, verify role assignments and network access" in your AI Search Knowledgebase created in MS Foundry.

Reading through all the above contributions, to avoid any misconceptions, use the following step-by-step diagnostics and fixes:

Confirm the correct principal and RBAC on Storage and Search by checking if the Foundry project’s system-assigned managed identity (not your user or another identity) and verify roles:

Storage: Storage Blob Data Reader at account or container scope.

Search: Search Index Data Reader on the Search service (or at least on the target index), for read-only retrieval.

Then, in Azure Portal: Storage Account > Access control (IAM) > Assign Storage Blob Data Reader to the Foundry project MI; Search Service > IAM > Assign Search Index Data Reader to the same MI.

Step 2 is to validate network accessibility by checking:

Are Storage and Search set to Selected networks or Public network access disabled? Is the environment using private endpoints/VNet?

Then fix by temporarily enable public access (“Enabled from all networks”) for Storage and Search, then re-test the knowledge base. If it works, the root cause is network rules. And if private access is required, use standard agent with VNet injection; ensure DNS and firewall rules permit Foundry/Agent outbound to Search & Storage. For private Search, create the agent using SDK/REST (portal has limitations behind VNets).

Step 3 is to verify index schema and semantic configuration by check:

Index contains at least one searchable & retrievable text field (Edm.String).

If using vector retrieval, index includes Collection(Edm.Single) vector fields marked searchable.

Semantic configuration exists & is correctly bound if semantic search is enabled.

Then, fix by using Foundry or Search REST/Portal to inspect index definitions; ensure content, title, url (if needed) are present, searchable, retrievable; ensure vector fields & dimensions match model. This resolves many search_tool_server_error symptoms.

Step 4 is to reconnect the knowledge base and agent tool by first checking in Foundry IQ knowledge base and Agent Service tool setup: correct Search endpoint, index name, and authentication method (RBAC via MI or API key). Also fix this by re-create the project connection to Search; if RBAC is complex, test with key-based authentication to isolate identity issues, then revert to RBAC for production.

Step 5 is to force retrieval & use observability by checking if the agent skipping the Search tool and hallucinating due to zero hits or errors? Ans also fix:

In the portal: enable “Always use knowledge” or “Block answers without citations.”

In SDK/REST: set tool_choice: "required" for the Azure AI Search tool.

Use Foundry Observability or App Insights to confirm tool invocation and inspect errors.

Step 6 is to harden for private networks (optional but recommended) by checking if you must keep Selected networks/private endpoints, the portal’s default agent may not work. Then fix by deploy a standard agent with VNet injection; ensure Search and Storage are reachable from that VNet; recreate the connection using SDK/REST.

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.
Jason Lee 216 Reputation points

2025-12-01T19:05:45.3033333+00:00
Thanks for the reply! I just double checked all those items and they're as you stated. Here's some screenshots for confirmation purposes.

Roles that MS Factory system assigned identity has.

Resource is not privately networked as per screenshot in earlier post.

Creating an knowledge base automatically creates the index, indexer, and skill set so it should function correctly. I double checked regardless and they are as you specified. I can also search for results in Search Explorer as you stated.

We're trying to avoid API key for the usual reasons MI is better.

I can't find the option "Always use knowledge". From this other thread, it sounds like I'm not the only one. https://learn.microsoft.com/en-us/answers/questions/5627268/ai-foundry-agents-stopped-searching-the-knowledge

Resources are not yet privately networked as per earlier screenshot.

2 answers

Your answer

Adam Zachary 2,025 Reputation points

2025-11-26T19:55:57.14+00:00

I ran into this exact problem before, and the error message in Foundry is unfortunately too generic.

In my case it came down to two things that were easy to miss, even though all the RBAC roles “looked” correct.

First, double-check that the Foundry system-assigned managed identity actually has access on the storage account itself, not just the container. Foundry needs Storage Blob Data Reader at the account or container scope, and the identity has to be the right one. I learned the hard way that I had given the role to my own user or to the wrong identity inside Foundry.

Second, the network settings on the Storage Account or the Search Service will break this silently. If either resource is set to “Selected Networks,” Foundry cannot reach it unless you explicitly add the Search Service’s outbound IPs. This was the root cause for me. The moment I switched Storage back to “Enabled from all networks” just for testing, the knowledge base started working immediately.

After fixing those two things, the error disappeared in Foundry and the agent was able to query the knowledge base normally.

So, in short, the two things I would check right away are:

Make sure the correct Foundry managed identity has Storage Blob Data Reader (or higher) on the storage account or container.

Make sure neither the Storage Account nor the Search Service is blocked by network rules. Open access temporarily, test, then lock it down properly.
Jason Lee 216 Reputation points

2025-11-27T15:18:29.7033333+00:00

Thanks for the assist! Unfortunately, I don't believe my problem is the same as yours.

I double checked my RBAC permissions for my search service...then removed/readded again just to see if the issue was something strange like that. Here's a screenshot where you can see I added extra permissions just in case. I don't think it's a permission issue to BLOB storage since the indexer populates the index correctly.

All my resources are not privately networked yet, so I don't think that's the issue. I double checked just in case.

You mentioned giving Foundry access to the BLOB which I don't have at the moment since I figured only AI Search needs that, but I unsuccessfully tried that anyway just in case.
Jason Lee 216 Reputation points

2025-12-01T19:05:45.3033333+00:00

Thanks for the reply! I just double checked all those items and they're as you stated. Here's some screenshots for confirmation purposes.

Roles that MS Factory system assigned identity has.

Resource is not privately networked as per screenshot in earlier post.

Creating an knowledge base automatically creates the index, indexer, and skill set so it should function correctly. I double checked regardless and they are as you specified. I can also search for results in Search Explorer as you stated.

We're trying to avoid API key for the usual reasons MI is better.

I can't find the option "Always use knowledge". From this other thread, it sounds like I'm not the only one. https://learn.microsoft.com/en-us/answers/questions/5627268/ai-foundry-agents-stopped-searching-the-knowledge

Resources are not yet privately networked as per earlier screenshot.

Answer 1

I figured out a workaround. I created the KB manually via the Python SDK as discussed in this article https://learn.microsoft.com/en-us/azure/search/agentic-retrieval-how-to-create-knowledge-base?tabs=rbac&pivots=python#create-a-knowledge-base . When I add my manually created KB to my agent, it works. Here's my script which I modified from the original to use a user assigned identity (as Aryan mentioned, system assigned identity is not supported by AI Search yet). Note I had to remove some fields mentioned in the article which are not supported by the SDK yet.

from azure.identity import DefaultAzureCredential
from azure.search.documents.indexes import SearchIndexClient
from azure.search.documents.indexes.models import (
    SearchIndexerDataUserAssignedIdentity,
    KnowledgeBase,
    KnowledgeBaseAzureOpenAIModel,
    KnowledgeSourceReference,
    AzureOpenAIVectorizerParameters,
)

index_client = SearchIndexClient(endpoint = "https://---.search.windows.net", credential = DefaultAzureCredential())

aoai_params = AzureOpenAIVectorizerParameters(
    resource_url = "https://---.openai.azure.com",
    deployment_name = "---",
    model_name = "gpt-5",
    auth_identity = SearchIndexerDataUserAssignedIdentity(resource_id= "/subscriptions/---/resourcegroups/---/providers/Microsoft.ManagedIdentity/userAssignedIdentities/---")
)

knowledge_base = KnowledgeBase(
    name = "----",
    description = "---.",
 
    knowledge_sources = [
        KnowledgeSourceReference(name = "ks-weekend-events"),
    ],
    models = [KnowledgeBaseAzureOpenAIModel(azure_open_ai_parameters = aoai_params)],
 
)

index_client.create_or_update_knowledge_base(knowledge_base)
print(f"Knowledge base '{knowledge_base.name}' created or updated successfully.")

Answer 2

Aryan Parashar 3,380 Microsoft External Staff Moderator

Hi Jason Lee,

I understand the inconvenience this may have caused.

To mitigate this issue quickly, please make sure your authentication type is set to API key as shown below.
User's image

If you want to use Managed Identity, I suggest using User Assigned Identity.

Using both (System Assigned and User Assigned) identities can create issues, as the Managed Identity feature for Search Service is still in preview and the product team is continuously working to make it fully functional.

Please accept this as the answer.

Thank you for reaching out to the Microsoft Q&A Portal.

Jason Lee 216 Reputation points

2025-11-27T17:37:31.1533333+00:00

Thanks for the reply. Unfortunately, removing the system assigned identity and creating a user assigned identity did not resolve the situation. Here's the list of roles assigned to the user assigned identity.

We are trying to avoid using API key since MI/RBAC is more secure....regardless, I just noticed that API key is enabled by default which led me the answer below.
Jason Lee 216 Reputation points

2025-12-01T15:56:17.99+00:00

Thanks for the reply! Please see my self-answer for how it turned out when I tried this. We're trying to not use API key for the usual reasons Managed Identities are preferred.
Aryan Parashar 3,380 Reputation points Microsoft External Staff Moderator

2025-12-04T03:16:15.9266667+00:00

Hi Jason Lee,

Yes, that is the preferred approach.

I appreciate your efforts to avoid using an API key and to use Managed Identities, as that is the more secure method.

Thank you for reaching out to the Microsoft Q&A Portal, we’re here to support you.

Share via

AI Search Knowledgebase created in MS Foundry: "An unexpected error occurred. Verify role assignments and network access"

2 answers

Your answer