docs: use keyless Entra ID auth for Azure AI Search setup; fix Lesson… - #710
Open
Konstantinos Passadis | Azure MVP | MCT (passadis) wants to merge 19 commits into
Open
Conversation
… 05 prerequisites
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 6, 2026 22:10
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (4)
00-course-setup/README.md:235
bash|powershellisn’t a recognized language identifier in GitHub-flavored Markdown, so these code fences won’t render with expected syntax highlighting and may confuse copy/paste expectations. Consider splitting into separatebashandpowershellblocks (or usebashplus an explicit PowerShell variant below) so each shell’s syntax is clearly presented.
00-course-setup/AzureSearch.md:89- Using
DefaultAzureCredential()can add noticeable latency and/or confusing failures in some learner environments because it probes multiple credential sources (managed identity, environment, shared cache, etc.) before Azure CLI; in non-interactive contexts it can also produce noisy auth errors. Since the course flow already standardizes onaz login, consider switching docs toAzureCliCredentialfor determinism, or explicitly configuringDefaultAzureCredentialto exclude interactive/shared cache credentials to reduce ambiguity.
from azure.identity import DefaultAzureCredential
00-course-setup/AzureSearch.md:99
- Using
DefaultAzureCredential()can add noticeable latency and/or confusing failures in some learner environments because it probes multiple credential sources (managed identity, environment, shared cache, etc.) before Azure CLI; in non-interactive contexts it can also produce noisy auth errors. Since the course flow already standardizes onaz login, consider switching docs toAzureCliCredentialfor determinism, or explicitly configuringDefaultAzureCredentialto exclude interactive/shared cache credentials to reduce ambiguity.
# Keyless (recommended): uses your `az login` identity via Entra ID RBAC.
# Requires the "Search Service Contributor" and "Search Index Data Contributor" roles.
credential = DefaultAzureCredential()
00-course-setup/AzureSearch.cs:18
- The fallback comment suggests adding
using Azure;inline, butusingdirectives must be placed at the top of the file in C#. Consider adjusting the comment to explicitly instruct moving/addingusing Azure;at the top (and swapping the credential line), so learners don’t try to paste it at line 17 and end up with a compilation error.
// Keyless (recommended): uses your `az login` identity via Entra ID RBAC.
// Requires the "Search Service Contributor" and "Search Index Data Contributor" roles.
var credential = new DefaultAzureCredential();
// Fallback (key-based auth):
// using Azure;
// var credential = new AzureKeyCredential(Environment.GetEnvironmentVariable("AZURE_SEARCH_API_KEY")!);
Co-authored-by: passadis <53148138+passadis@users.noreply.github.com>
Co-authored-by: passadis <53148138+passadis@users.noreply.github.com>
Finish Azure Search docs review feedback for keyless auth guidance
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 7, 2026 00:19
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (5)
00-course-setup/AzureSearch.md:52
- Step 3 still tells learners to copy the query key, but the samples in this guide create/update indexes and upload documents (which require RBAC roles or an admin key). This is inconsistent with the new keyless-first guidance and can lead to auth failures if someone follows the query-key step.
3. **(Recommended) Enable keyless access with Microsoft Entra ID (RBAC):**
```bash
00-course-setup/AzureSearch.md:90
- The Python sample now imports
AzureCliCredentialfromazure-identity, but the install command only installsazure-search-documents. Without also installingazure-identity, the sample will fail at import time.
import os
from azure.identity import AzureCliCredential
from azure.search.documents import SearchClient
00-course-setup/AzureSearch.cs:2
- This sample uses a floating
Azure.Identity@1.*reference. Most other file-based .NET samples in this repo pin Azure.Identity to a specific version, which keeps the samples reproducible and avoids unexpected breaks from SDK updates.
#:package Azure.Search.Documents@11.*
#:package Azure.Identity@1.*
00-course-setup/AzureSearch.md:138
- The embedded
AzureSearch.cssnippet also uses a floatingAzure.Identity@1.*reference; pinning the version (as other .NET samples do) makes the docs more reproducible and matches the repository’s existing patterns.
```csharp
#:package Azure.Search.Documents@11.*
#:package Azure.Identity@1.*
#:property PublishAot=false
.env.example:29
- This comment says keyless auth uses
AzureCliCredential, but the course and the .NET sample in this PR useDefaultAzureCredential(which may use Azure CLI under the hood). Referring to onlyAzureCliCredentialis misleading for non-Python readers.
# Azure AI Search (Optional - Lessons 05 and 16 fall back to in-memory search)
AZURE_SEARCH_SERVICE_ENDPOINT="https://..."
# Optional: use a key instead of Entra ID / AzureCliCredential (keyless is recommended)
AZURE_SEARCH_API_KEY="..."
- Standardize on DefaultAzureCredential across Python/.NET/.env for consistency - Add azure-identity to Python pip install so the keyless sample imports cleanly - Fix Step 3 to reference the admin key (fallback) instead of the query key - Pin Azure.Identity package version for reproducible .NET samples - Clarify C# fallback comment (using directive belongs at top of file) - Use valid separate bash/powershell fenced code blocks in README
…fallback, azure-identity install, pinned version - Step 3 now references the admin key (fallback) instead of the query key, since the samples create indexes and upload documents - Python sample uses DefaultAzureCredential for consistency with .NET/.env; pip install adds azure-identity - Pin Azure.Identity package version in the embedded .NET snippet
…e to DefaultAzureCredential - Replace invalid `bash|powershell` language identifiers with valid `bash` fences (GitHub-flavored Markdown) - Update the "Why keyless?" note to reference DefaultAzureCredential, matching the Python/.NET samples and .env.example
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 7, 2026 19:00
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (3)
00-course-setup/AzureSearch.md:66
- The endpoint export in this key-based fallback block also uses
--query "endpoint", whichaz search service showtypically doesn’t return. This will leaveAZURE_SEARCH_SERVICE_ENDPOINTempty and break the SDK samples.
#### Store both endpoint and API key for Azure AI Search instance to environment variables.
```bash
# zsh/bash
00-course-setup/AzureSearch.md:56
az search service showdoes not expose anendpointfield, so this command will typically export an empty value. The service URL is derived fromproperties.hostName(e.g.,https://<service>.search.windows.net).
This issue also appears on line 63 of the same file.
export AZURE_SEARCH_SERVICE_ENDPOINT=$(az search service show -g <resource-group> -n <service-name> --query "endpoint" -o tsv)
00-course-setup/README.md:254
- This sentence says the course uses the same
DefaultAzureCredentialpattern in all notebooks, but the repo contains a mix ofDefaultAzureCredentialandAzureCliCredentialusage. Wording it as “all” is inaccurate and could confuse learners who see both styles across lessons.
> **Why keyless?** Admin keys grant full write access to your search service and can leak via `.env` files. With RBAC, your `az login` identity is used instead — the same `DefaultAzureCredential` pattern all course notebooks already use. See [Connect to Azure AI Search using roles](https://learn.microsoft.com/azure/search/search-security-rbac).
`az search service show` has no `endpoint` field, so `--query "endpoint"` returned empty and left AZURE_SEARCH_SERVICE_ENDPOINT unset. Build the URL from properties.hostName instead, in all three places (RBAC block + bash/powershell fallback).
The repo mixes AzureCliCredential and DefaultAzureCredential across lessons, so "the same DefaultAzureCredential pattern all course notebooks already use" was inaccurate. Reword to reference the keyless Entra ID pattern (AzureCliCredential / DefaultAzureCredential) used elsewhere in the course.
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 8, 2026 18:23
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (3)
00-course-setup/AzureSearch.md:69
- In the key-based fallback snippet,
concat()isn’t supported in Azure CLI JMESPath queries, so this endpoint export will fail. Build the URL in the shell instead (prefixhttps://outside the--query).
export AZURE_SEARCH_SERVICE_ENDPOINT=$(az search service show -g <resource-group> -n <service-name> --query "concat('https://', properties.hostName)" -o tsv)
00-course-setup/AzureSearch.md:57
az ... --queryuses JMESPath, which doesn’t support aconcat()function. As written, this command will fail and won’t setAZURE_SEARCH_SERVICE_ENDPOINT. Build the URL in the shell instead (prefixhttps://outside the--query).
This issue also appears on line 69 of the same file.
# az search service show has no "endpoint" field; build the URL from properties.hostName.
export AZURE_SEARCH_SERVICE_ENDPOINT=$(az search service show -g <resource-group> -n <service-name> --query "concat('https://', properties.hostName)" -o tsv)
```
00-course-setup/AzureSearch.md:77
- This PowerShell example has nested double quotes around
--query "properties.hostName", which breaks parsing and results in a syntax error. Use string concatenation (or escape the quotes) so theazcommand runs correctly.
# PowerShell
# az search service show has no "endpoint" field; build the URL from properties.hostName.
$env:AZURE_SEARCH_SERVICE_ENDPOINT = "https://$(az search service show -g <resource-group> -n <service-name> --query "properties.hostName" -o tsv)"
$env:AZURE_SEARCH_API_KEY = $(az search service admin-key list -g <resource-group> --search-service-name <service-name> --query "primaryKey" -o tsv)
…d PowerShell quoting in AzureSearch.md
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 9, 2026 17:10
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (6)
00-course-setup/AzureSearch.md:78
- Same issue in the PowerShell snippet:
az search service admin-key listuses--service-name, but the CLI expects--search-service-name. This will fail when copy/pasted.
# az search service show has no "endpoint" field; build the URL from the service name.
$env:AZURE_SEARCH_SERVICE_ENDPOINT = "https://<service-name>.search.windows.net"
$env:AZURE_SEARCH_API_KEY = $(az search service admin-key list -g <resource-group> --service-name <service-name> --query "primaryKey" -o tsv)
```
00-course-setup/AzureSearch.md:57
- The guide claims
az search service showhas noendpointfield and instructs building the URL manually. Azure CLI returns anendpointproperty, so this is misleading and makes it harder to copy/paste the correct endpoint.
# az search service show has no "endpoint" field; build the URL from the service name.
export AZURE_SEARCH_SERVICE_ENDPOINT="https://<service-name>.search.windows.net"
00-course-setup/AzureSearch.md:70
- In the key-based fallback,
az search service admin-key listis invoked with--service-name, but the command expects--search-service-name. As written, users will hit an argument error.
This issue also appears on line 75 of the same file.
# az search service show has no "endpoint" field; build the URL from the service name.
export AZURE_SEARCH_SERVICE_ENDPOINT="https://<service-name>.search.windows.net"
export AZURE_SEARCH_API_KEY=$(az search service admin-key list -g <resource-group> --service-name <service-name> --query "primaryKey" -o tsv)
```
00-course-setup/README.md:192
- This section says the notebooks authenticate using
AzureCliCredential, but at least Lesson 05 usesDefaultAzureCredential(which can use the Azure CLI sign-in during local dev). Updating this wording avoids confusion for learners comparing the docs to the notebook code.
> **Why `az login`?** The notebooks authenticate using `AzureCliCredential` from the `azure-identity` package. This means your Azure CLI session provides the credentials — no API keys or secrets in your `.env` file.
00-course-setup/README.md:232
- This paragraph implies Lessons 5 and 16 can be backed by Azure AI Search via keyless (Entra ID/RBAC) setup, but the Lesson 16 notebook currently switches to Azure AI Search only when both
AZURE_SEARCH_SERVICE_ENDPOINTandAZURE_SEARCH_API_KEYare set (it usesAzureKeyCredential). The docs should reflect that key-based auth is currently required for the Lesson 16 notebook, even if RBAC is the recommended approach for production code.
The Lesson 5 (Agentic RAG) and Lesson 16 notebooks run out of the box with an **in-memory knowledge base** — no extra Azure resources needed. If you want to back them with a real **Azure AI Search** resource, enable keyless (Entra ID / RBAC) access as follows:
.env.example:30
- The Azure AI Search block marks
AZURE_SEARCH_API_KEYas optional and recommends keyless auth, but the Lesson 16 notebook currently requiresAZURE_SEARCH_API_KEYto enable Azure AI Search (otherwise it falls back to in-memory). Tweaking this comment would prevent confusion.
# Azure AI Search (Optional - Lessons 05 and 16 fall back to in-memory search)
AZURE_SEARCH_SERVICE_ENDPOINT="https://..."
# Optional: use a key instead of Entra ID (keyless via DefaultAzureCredential is recommended)
AZURE_SEARCH_API_KEY="..."
…ntial wording - README + .env.example: Lesson 16 enables Azure AI Search only when endpoint AND key are set (key-based); RBAC recommended for production
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 9, 2026 18:01
… Search - README: notebooks use AzureCliCredential/DefaultAzureCredential (Step 3 + Why az login callout) - README: Azure AI Search intro notes Lesson 16 uses key-based auth (endpoint AND key); RBAC recommended for production - README: AZURE_SEARCH_API_KEY table row now marked required with the endpoint for Lesson 16
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (4)
00-course-setup/AzureSearch.md:71
az search service admin-key listuses--search-service-name(per Azure CLI docs). Using--service-namewill fail, so the bash example should keep the correct parameter name.
# az search service show has no "endpoint" field; build the URL from the service name.
export AZURE_SEARCH_SERVICE_ENDPOINT="https://<service-name>.search.windows.net"
export AZURE_SEARCH_API_KEY=$(az search service admin-key list -g <resource-group> --service-name <service-name> --query "primaryKey" -o tsv)
```
00-course-setup/AzureSearch.md:78
az search service admin-key listexpects--search-service-name(not--service-name). The PowerShell snippet should match the Azure CLI’s actual parameter name to avoid a copy/paste failure.
# az search service show has no "endpoint" field; build the URL from the service name.
$env:AZURE_SEARCH_SERVICE_ENDPOINT = "https://<service-name>.search.windows.net"
$env:AZURE_SEARCH_API_KEY = $(az search service admin-key list -g <resource-group> --service-name <service-name> --query "primaryKey" -o tsv)
```
00-course-setup/README.md:233
- This section instructs learners to enable keyless (Entra ID/RBAC) to “back” Lessons 5 and 16 with Azure AI Search, but the current Lesson 16 notebook uses
AzureKeyCredential(os.environ["AZURE_SEARCH_API_KEY"])and only enables Search when both endpoint + API key are set. As written, users may follow the RBAC steps and still find Lesson 16 continues to use in-memory search unless they also provide an admin key.
## Optional Setup: Azure AI Search (Lessons 5 and 16)
The Lesson 5 (Agentic RAG) and Lesson 16 notebooks run out of the box with an **in-memory knowledge base** — no extra Azure resources needed. If you want to back them with a real **Azure AI Search** index, note that the **Lesson 16 notebook currently uses key-based authentication**: it switches from in-memory search to Azure AI Search only when **both** `AZURE_SEARCH_SERVICE_ENDPOINT` **and** `AZURE_SEARCH_API_KEY` are set, and otherwise stays on in-memory search — so to run it against a real index you must set the admin key as well. Keyless authentication with Microsoft Entra ID (RBAC) is the recommended approach for your own production code, consistent with the `az login` flow used everywhere else in this course.
00-course-setup/README.md:252
- The table marks
AZURE_SEARCH_API_KEYas “Optional”, but (per the current Lesson 16 notebook logic) the key is required to switch Lesson 16 from in-memory search to Azure AI Search. Consider clarifying that it’s required for Lesson 16 as implemented, and optional only when you’re using the keyless/RBAC approach in the setup guide.
| Variable | Where to find it |
|----------|-----------------|
| `AZURE_SEARCH_SERVICE_ENDPOINT` | Azure portal → your **Azure AI Search** resource → **Overview** → URL |
| `AZURE_SEARCH_API_KEY` | Required (with the endpoint) to enable Azure AI Search in the Lesson 16 notebook, which uses key-based auth. Azure portal → **Settings** → **Keys** → primary admin key |
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 9, 2026 18:44
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (1)
00-course-setup/README.md:168
- The setup guide states “All notebooks … so there are no API keys to manage”, but some course materials still rely on API keys (for example, Lesson 15 browser-use reads
AZURE_OPENAI_API_KEY). This wording is misleading for learners and should be softened to “most notebooks”, with a brief callout that a few lessons/optional integrations use keys.
All notebooks authenticate through your **Azure CLI sign-in** — using `AzureCliCredential` or `DefaultAzureCredential` (both pick up your `az login` session) from the `azure-identity` package — so there are no API keys to manage. This requires you to be signed in via the Azure CLI.
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 9, 2026 18:58
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (5)
00-course-setup/AzureSearch.md:78
- Same as the bash snippet above: prefer
az search admin-key show --service-name ...for the fallback key-based flow to avoid depending on the legacyaz search service admin-keysubcommand.
# PowerShell
# az search service show has no "endpoint" field; build the URL from the service name.
$env:AZURE_SEARCH_SERVICE_ENDPOINT = "https://<service-name>.search.windows.net"
$env:AZURE_SEARCH_API_KEY = $(az search service admin-key list -g <resource-group> --search-service-name <service-name> --query "primaryKey" -o tsv)
```
00-course-setup/README.md:244
- The role assignment example uses a
<search-service-resource-id>placeholder but doesn’t show how to derive it, which makes the copy/paste path fail for most learners. Consider inlining theaz search service show ... --query id -o tsvsubstitution so the snippet is runnable as-is.
az role assignment create --assignee <your-user-or-principal-id> --role "Search Service Contributor" --scope <search-service-resource-id>
az role assignment create --assignee <your-user-or-principal-id> --role "Search Index Data Contributor" --scope <search-service-resource-id>
00-course-setup/AzureSearch.cs:2
Azure.Identity@1.13.*is an older minor line (and 1.13.1 is flagged as deprecated on NuGet). Using1.*will keep the sample on the latest 1.x patch/minor with security fixes while staying within the same major version.
#:package Azure.Search.Documents@11.*
#:package Azure.Identity@1.13.*
00-course-setup/AzureSearch.md:70
- The fallback key-based snippet uses
az search service admin-key list --search-service-name .... The current Azure CLI docs also exposeaz search admin-key show --service-name ..., which avoids relying on the legacy subcommand and keeps parameter naming consistent with otheraz searchcommands.
This issue also appears on line 74 of the same file.
# az search service show has no "endpoint" field; build the URL from the service name.
export AZURE_SEARCH_SERVICE_ENDPOINT="https://<service-name>.search.windows.net"
export AZURE_SEARCH_API_KEY=$(az search service admin-key list -g <resource-group> --search-service-name <service-name> --query "primaryKey" -o tsv)
00-course-setup/AzureSearch.md:141
- The embedded .NET sample pins
Azure.Identity@1.13.*, which is an older minor line (and 1.13.1 is flagged deprecated on NuGet). Consider loosening this to1.*so learners get current 1.x fixes without changing majors.
#:package Azure.Search.Documents@11.*
#:package Azure.Identity@1.13.*
#:property PublishAot=false
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 9, 2026 20:27
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (5)
00-course-setup/AzureSearch.md:70
- Same issue as above in the key-based fallback snippet: hardcoding
https://<service-name>.search.windows.netcan be wrong outside the public cloud. UsehostNamefromaz search service showto construct the endpoint consistently.
# az search service show has no "endpoint" field; build the URL from the service name.
export AZURE_SEARCH_SERVICE_ENDPOINT="https://<service-name>.search.windows.net"
export AZURE_SEARCH_API_KEY=$(az search admin-key show -g <resource-group> --service-name <service-name> --query "primaryKey" -o tsv)
00-course-setup/AzureSearch.md:77
- The PowerShell fallback snippet also hardcodes the public cloud endpoint. Using
hostNamefromaz search service showmakes the instructions work in sovereign clouds and avoids mismatches if the service hostname differs from the service name.
# az search service show has no "endpoint" field; build the URL from the service name.
$env:AZURE_SEARCH_SERVICE_ENDPOINT = "https://<service-name>.search.windows.net"
$env:AZURE_SEARCH_API_KEY = $(az search admin-key show -g <resource-group> --service-name <service-name> --query "primaryKey" -o tsv)
00-course-setup/README.md:377
- The SSL workaround warning was weakened; it no longer explicitly states this should never be used in production. Because
connection_verify=Falsedisables TLS certificate validation, the docs should clearly discourage production use.
> **⚠️ Warning:** Disabling SSL verification (`connection_verify=False`) reduces security by skipping certificate validation. Use this only as a temporary workaround in development environments.
00-course-setup/AzureSearch.md:58
- The endpoint is currently derived by assuming the public cloud DNS suffix (
https://<service-name>.search.windows.net). This can be incorrect for sovereign clouds or nonstandard hostnames. Prefer pullinghostNamefromaz search service showand building the URL from that output.
This issue also appears in the following locations of the same file:
- line 68
- line 75
# az search service show has no "endpoint" field; build the URL from the service name.
export AZURE_SEARCH_SERVICE_ENDPOINT="https://<service-name>.search.windows.net"
```
00-course-setup/README.md:232
- This section warns that Lesson 16 currently requires key-based auth, but the numbered steps immediately below walk through RBAC enablement/role assignment (which learners might assume is sufficient to run Lesson 16 keyless). Consider explicitly labeling the RBAC steps as applying to the optional setup-guide samples / your own code, while calling out that Lesson 16 still requires setting the admin key today.
The Lesson 5 (Agentic RAG) and Lesson 16 notebooks run out of the box with an **in-memory knowledge base** — no extra Azure resources needed. If you want to back them with a real **Azure AI Search** index, note that the **Lesson 16 notebook currently uses key-based authentication**: it switches from in-memory search to Azure AI Search only when **both** `AZURE_SEARCH_SERVICE_ENDPOINT` **and** `AZURE_SEARCH_API_KEY` are set, and otherwise stays on in-memory search — so to run it against a real index you must set the admin key as well. Keyless authentication with Microsoft Entra ID (RBAC) is the recommended approach for your own production code, consistent with the `az login` flow used everywhere else in this course.
Konstantinos Passadis | Azure MVP | MCT (passadis)
left a comment
Konstantinos Passadis | Azure MVP | MCT (passadis)
left a comment
Author
There was a problem hiding this comment.
I addressed the RBAC-scope clarification and restored the explicit warning that disabling TLS verification must never be used in production.
I did not apply the three hostName suggestions. The sovereign-cloud concern is valid, but the proposed command is not compatible with the Azure CLI schemas I verified:
Azure CLI 2.74 exposes neither hostName nor endpoint from az search service show.
The current generated CLI schema adds a flattened endpoint property, but still does not expose hostName.
Therefore, --query hostName could return an empty value and break the setup instructions. I retained the explicit endpoint construction for compatibility. Once the course can require a CLI version that reliably exposes endpoint, the examples can switch to --query endpoint.
Konstantinos Passadis | Azure MVP | MCT (passadis)
requested a lite review from Copilot
August 9, 2026 20:40
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.
Suppressed comments (2)
00-course-setup/AzureSearch.md:77
- Same issue in the PowerShell snippet:
az search admin-key show/--service-nameis not the current Azure CLI syntax for admin keys. Useaz search service admin-key listwith--search-service-nameand queryprimaryKey.
$env:AZURE_SEARCH_API_KEY = $(az search admin-key show -g <resource-group> --service-name <service-name> --query "primaryKey" -o tsv)
00-course-setup/AzureSearch.md:70
- The Azure CLI command used to fetch the Azure AI Search admin key appears incorrect. The
az search admin-key showsubcommand/flags don’t match the current Azure CLI syntax; use theaz search service admin-key listcommand group (and--search-service-name) to retrieveprimaryKey.
This issue also appears on line 77 of the same file.
export AZURE_SEARCH_API_KEY=$(az search admin-key show -g <resource-group> --service-name <service-name> --query "primaryKey" -o tsv)
Author
I’m leaving these snippets unchanged.The current Azure CLI reference documents az search admin-key show --resource-group --service-name as a valid GA command for retrieving primary and secondary admin keys. It also documents az search service admin-key list, so both forms are supported. The existing syntax is therefore correct, and changing it would merely reverse the previous review update.References: https://learn.microsoft.com/cli/azure/search/admin-key#az-search-admin-key-show |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
AZURE_SEARCH_SERVICE_ENDPOINTandAZURE_SEARCH_API_KEY, but the notebook never uses Azure AI Search: it runs entirely against the in-memoryTRAVEL_KNOWLEDGE_BASEdict and only validatesAZURE_AI_PROJECT_ENDPOINT/AZURE_AI_MODEL_DEPLOYMENT_NAME. Learners are told to obtain an admin API key for a paid resource the lesson never touches..envfile", yet00-course-setup/README.mdandAzureSearch.mdinstruct copying the primary admin key into.env.Changes
05-agentic-rag/.../05-python-agent-framework.ipynb— fix the prerequisites cell; note that no Azure AI Search resource is required, with a link to the optional setup guide (source notebook only; translations are auto-generated).00-course-setup/README.md— replace the Lesson 5 section with an optional, keyless-first Azure AI Search section (RBAC enablement + role assignments), key auth marked as optional fallback.00-course-setup/AzureSearch.md+AzureSearch.cs— keyless-first (DefaultAzureCredential) Python/.NET samples with the key-based flow retained as a labeled fallback..env.example— mark the Azure AI Search block optional and the API key as fallback-only.Verification
Docs-only change. CLI commands and role names (
--auth-options aadOrApiKey,Search Service Contributor,Search Index Data Contributor) verified against current Microsoft Learn: Connect using roles, keyless quickstart. Notebook validated as nbformat-4 JSON.This contribution was AI-assisted and reviewed/verified by the author.