Setting up optional login and document level access control

[bf-2026]

Hi all,

the setup for authentication seems buggy or the instructions are in the wrong order? Maybe a few of you run into it as well. So that is why I have documented it. If I rerun all commands a few times then it finally works. But here is how the steps are in detail:

First I initialize a project, set environment name

azd init -t azure-search-openai-demo

then I login

azd auth login

1. Enable authentication for the app Run the following command to show the login UI and use Entra authentication by default:

   azd env set AZURE_USE_AUTHENTICATION true

2. Enable access control on your search index

   • If the index does not exist yet:
     Run the prepdocs script.

   ./scripts/prepdocs.ps1

Now it shows a Key error:

[21:31:03] INFO     Loading azd env from C:\Users\DELL\.azure\bf-deepv1\.env, which  load_azd_env.py:28
                    may override existing environment variables                                                             
           INFO     Connecting to Azure services using the azd credential for home tenant                    prepdocs.py:215
Traceback (most recent call last):
  File "C:\Users\DELL\app\backend\prepdocs.py", line 228, in <module>
    OPENAI_HOST = OpenAIHost(os.environ["OPENAI_HOST"])
                             ~~~~~~~~~~^^^^^^^^^^^^^^^
  File "<frozen os>", line 714, in __getitem__
KeyError: 'OPENAI_HOST'

This makes sense, because I haven't set anything regarding the openai key. Now I set my tenant ID, which I get from azure portal under subscriptions:

3. Set the authentication tenant ID
   Specify the tenant ID associated with authentication by running:

azd env set AZURE_AUTH_TENANT_ID <YOUR-TENANT-ID>

Next I run azd up, which also sets my openai key.

azd up

Now I am able to run prepdocs. And then I run azd up again

azd up

[pamelafox]

I'm looking into this, thanks for the report!

[pamelafox]

Hm, I think this may just be a documentation issue- we should only run prepdocs once you've run "azd provision" or "azd up" first. I'll improve the docs.