Merge pull request #275263 from anthonychu/20240513-sessions-update

[Container Apps] Minor updates to sessions

Author: Stacyrch140

articles/container-apps/sessions-code-interpreter.md

@@ -102,7 +102,22 @@ The identifier must be a string that is 4 to 128 characters long and can contain
 
 ### Authentication
 
-Authentication is handled using Microsoft Entra (formerly Azure Active Directory) tokens. Valid Microsoft Entra tokens are generated by an identity belonging to the *Azure ContainerApps Session Creator* or *Contributor* role on the session pool.
+Authentication is handled using Microsoft Entra (formerly Azure Active Directory) tokens. Valid Microsoft Entra tokens are generated by an identity belonging to the *Azure ContainerApps Session Creator* and *Contributor* roles on the session pool.
+
+To assign the roles to an identity, use the following Azure CLI commands:
+
+```bash
+# Assign the Azure ContainerApps Session Creator role using its ID
+az role assignment create \
+    --role "0fb8eba5-a2bb-4abe-b1c1-49dfad359bb0" \
+    --assignee <PRINCIPAL_ID> \
+    --scope <SESSION_POOL_RESOURCE_ID>
+
+az role assignment create \
+    --role "Contributor" \
+    --assignee <PRINCIPAL_ID> \
+    --scope <SESSION_POOL_RESOURCE_ID>
+```
 
 If you're using an LLM framework integration, the framework handles the token generation and management for you. Ensure that the application is configured with a managed identity with the necessary role assignments on the session pool.
 

articles/container-apps/sessions-tutorial-langchain.md

@@ -59,7 +59,7 @@ react_agent = agents.create_react_agent(
 )
 ```
 
-When it needs to perform calculations, the agent uses the *SessionPythonREPLTool* to run the code. The code is executed in a session in the session pool. By default, a random session identifier is generated when you instantiate the tool. If the agent runs multiple Python code snippets, it uses the same session.
+When it needs to perform calculations, the agent uses the *SessionPythonREPLTool* to run the code. The code is executed in a session in the session pool. By default, a random session identifier is generated when you instantiate the tool. If the agent uses the tool to run multiple Python code snippets, it uses the same session. To ensure each end user has a unique session, use a separate agent and tool for each user.
 
 *SessionPythonREPLTool* is available in the [`langchain-azure-dynamic-sessions`](https://pypi.org/project/langchain-azure-dynamic-sessions/) package.
 

articles/container-apps/sessions-tutorial-llamaindex.md

@@ -53,7 +53,7 @@ code_interpreter_tool = AzureCodeInterpreterToolSpec(
 agent = ReActAgent.from_tools(code_interpreter_tool.to_tool_list(), llm=llm, verbose=True)
 ```
 
-When it needs to perform calculations, the agent uses the code interpreter in *AzureCodeInterpreterToolSpec* to run the code. The code is executed in a session in the session pool. By default, a random session identifier is generated when you instantiate the tool. If the agent runs multiple Python code snippets, it uses the same session.
+When it needs to perform calculations, the agent uses the code interpreter in *AzureCodeInterpreterToolSpec* to run the code. The code is executed in a session in the session pool. By default, a random session identifier is generated when you instantiate the tool. If the agent uses the same tool to run multiple Python code snippets, it uses the same session. To ensure each end user has a unique session, use a separate agent and tool for each user.
 
 *AzureCodeInterpreterToolSpec* is available in the [`llama-index-tools-azure-code-interpreter`](https://pypi.org/project/llama-index-tools-azure-code-interpreter/) package.
 

articles/container-apps/sessions-tutorial-semantic-kernel.md

@@ -54,7 +54,7 @@ sessions_tool = SessionsPythonTool(
 kernel.add_plugin(sessions_tool, "SessionsTool")
 ```
 
-When it needs to perform calculations, the agent uses the code interpreter in *SessionsPythonTool* to run the code. The code is executed in a session in the session pool. By default, a random session identifier is generated when you instantiate the tool. If the agent runs multiple Python code snippets, it uses the same session.
+When it needs to perform calculations, the kernel uses the code interpreter in *SessionsPythonTool* to run the code. The code is executed in a session in the session pool. By default, a random session identifier is generated when you instantiate the tool. If the kernel uses the tool to run multiple Python code snippets, it uses the same session. To ensure each end user has a unique session, use a separate kernel and tool for each user.
 
 *SessionsPythonTool* is available in version `0.9.8b1` or later of the [`semantic-kernel`](https://pypi.org/project/semantic-kernel/) package.
 

includes/container-apps/sessions-tutorial-deploy.md

@@ -42,63 +42,65 @@ You then need to configure managed identity for the app and assign it the proper
         --system-assigned
     ```
 
-1. Retrieve the managed identity's principal ID:
-
-    ```bash
-    az containerapp show \
-        --name $CONTAINER_APP_NAME \
-        --resource-group $RESOURCE_GROUP_NAME \
-        --query identity.principalId \
-        --output tsv
-    ```
-
-1. Retrieve the session pool resource ID:
-
-    ```bash
-    az containerapp sessionpool show \
-        --name $SESSION_POOL_NAME \
-        --resource-group $RESOURCE_GROUP_NAME \
-        --query id \
-        --output tsv
-    ```
-
-1. Assign the managed identity the `Azure ContainerApps Session Creator` and `Contributor` roles on the session pool:
-
-    Before you run the following command, replace `<PRINCIPAL_ID>` and `<SESSION_POOL_RESOURCE_ID>` with the values you retrieved in the previous steps.
-
-    ```bash
-    # Assign the Azure ContainerApps Session Creator role using its ID
-    az role assignment create \
-        --role "0fb8eba5-a2bb-4abe-b1c1-49dfad359bb0" \
-        --assignee <PRINCIPAL_ID> \
-        --scope <SESSION_POOL_RESOURCE_ID>
-
-    az role assignment create \
-        --role "Contributor" \
-        --assignee <PRINCIPAL_ID> \
-        --scope <SESSION_POOL_RESOURCE_ID>
-    ```
-
-1. Retrieve the Azure OpenAI account resource ID:
-
-    ```bash
-    az cognitiveservices account show \
-        --name $AZURE_OPENAI_NAME \
-        --resource-group $RESOURCE_GROUP_NAME \
-        --query id \
-        --output tsv
-    ```
-
-1. Assign the managed identity the `Cognitive Services OpenAI User` role on the Azure OpenAI account:
-
-    Before you run the following command, replace `<PRINCIPAL_ID>` and `<AZURE_OPENAI_RESOURCE_ID>` with the values you retrieved in the previous steps.
-
-    ```bash
-    az role assignment create \
-        --role "Cognitive Services OpenAI User" \
-        --assignee <PRINCIPAL_ID> \
-        --scope <AZURE_OPENAI_RESOURCE_ID>
-    ```
+1. For the app to access Azure OpenAI and the session pool, you need to assign the managed identity the proper roles.
+
+    1. Retrieve the managed identity's principal ID:
+
+        ```bash
+        az containerapp show \
+            --name $CONTAINER_APP_NAME \
+            --resource-group $RESOURCE_GROUP_NAME \
+            --query identity.principalId \
+            --output tsv
+        ```
+
+    1. Retrieve the session pool resource ID:
+
+        ```bash
+        az containerapp sessionpool show \
+            --name $SESSION_POOL_NAME \
+            --resource-group $RESOURCE_GROUP_NAME \
+            --query id \
+            --output tsv
+        ```
+
+    1. Assign the managed identity the `Azure ContainerApps Session Creator` and `Contributor` roles on the session pool:
+
+        Before you run the following command, replace `<PRINCIPAL_ID>` and `<SESSION_POOL_RESOURCE_ID>` with the values you retrieved in the previous steps.
+
+        ```bash
+        # Assign the Azure ContainerApps Session Creator role using its ID
+        az role assignment create \
+            --role "0fb8eba5-a2bb-4abe-b1c1-49dfad359bb0" \
+            --assignee <PRINCIPAL_ID> \
+            --scope <SESSION_POOL_RESOURCE_ID>
+
+        az role assignment create \
+            --role "Contributor" \
+            --assignee <PRINCIPAL_ID> \
+            --scope <SESSION_POOL_RESOURCE_ID>
+        ```
+
+    1. Retrieve the Azure OpenAI account resource ID:
+
+        ```bash
+        az cognitiveservices account show \
+            --name $AZURE_OPENAI_NAME \
+            --resource-group $RESOURCE_GROUP_NAME \
+            --query id \
+            --output tsv
+        ```
+
+    1. Assign the managed identity the `Cognitive Services OpenAI User` role on the Azure OpenAI account:
+
+        Before you run the following command, replace `<PRINCIPAL_ID>` and `<AZURE_OPENAI_RESOURCE_ID>` with the values you retrieved in the previous steps.
+
+        ```bash
+        az role assignment create \
+            --role "Cognitive Services OpenAI User" \
+            --assignee <PRINCIPAL_ID> \
+            --scope <AZURE_OPENAI_RESOURCE_ID>
+        ```
 
 1. Retrieve the app's fully qualified domain name (FQDN):
 

includes/container-apps/sessions-tutorial-run-local.md

@@ -19,3 +19,5 @@ ms.author: antchu
 1. Enter `What time is it right now?` in the `message` field and select **Execute**.
 
     The agent responds with the current time. In the terminal, you see the logs showing the agent generated Python code to get the current time and ran it in a code interpreter session.
+
+1. To stop the app, enter `Ctrl+C` in the terminal.