Protecting Custom Skillset API

Azure AI Search is a platform as a service that lets developers integrate search with applications seamlessly.

Before the data is indexed for searching, the need to enrich data(e.g data from unstructured documents like pdf) can be achieved by using in-built or custom skill sets. Custom Web API skill sets help extend the enrichment functionality by implementing the functionality using a Custom Web API endpoint.

Custom skill set API can be hosted on Azure functions. Azure functions would be a good fit for such scenarios, given the event driven nature of the function and pay per usage feature.

Azure functions can be protected by built in authentication (EasyAuth). This a type of azure resource to azure resource authentication scenario.

Additional configuration is required to allow Azure Search indexer to invoke the Custom Skillsets hosted on Azure functions.

Steps:

Enable managed identity for Azure Search

Configure azure function to use [Azure AD] login

(https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad)

Configure Azure Search as known client application of the Azure function

• Navigate to Identity under Settings for Azure search, copy the Object ID:
  

• Navigate to Microsoft Entra ID >Manage > All Applications and search using the copied object ID

• Copy the Application ID from the above step. Navigate to Azure functions and edit authentication. Add the copied Application ID to Allow requests from specific client applications list of the Azure function

This is an important step or you will receive a403 forbidden error.

Configure the custom Skillset

Update skillset configuration (json file) with Id of the azure functions from the previous step in the authresourceId attribute. Note: only the resourceId is required, don't add the scope.

"authresourceId":"<functionAzureAppId>"


{
    "skills": [
      {
        "@odata.type": "#Microsoft.Skills.Custom.WebApiSkill",
        "name": "myCustomSkill",
        "description": "This skill calls an Azure function, which in turn calls TA sentiment",
        "uri": "https://indexer-e2e-webskill.azurewebsites.net/api/DateExtractor?language=en",
"authresourceId":"<functionAzureAppId>"
        "context": "/document",
        "httpHeaders": {
            "DateExtractor-Api-Key": "foo"
        },
        "inputs": [
          {
            "name": "contractText",
            "source": "/document/content"
          }
        ],
        "outputs": [
          {
            "name": "contractDate",
            "targetName": "date"
          }
        ]
      }
  ]
} 

Role Assignment for Azure Search

As a final step, assign a contributor role to Azure Search (using managed identity) on Azure Functions