Unable to configure AzureUSGovernmentCloud audience for AI Search

[clarked-msft]

Context / Scenario

I'm using AI Search as the DataIngestion MemoryDb in AzureUSGovernmentCloud. I'd like to use AzureIdentity auth but I do not see a way to pass the correct token audience to the search client.

What happened?

A token is requested with scope appropriate for commerical, which does not work in gov cloud.

Importance

a fix would make my life easier

Platform, Language, Versions

dotnet

Relevant log output

No response

[dluc]

can you wrap the token in a Azure.Core.TokenCredential object?

var config = new AzureAISearchConfig { Auth = AzureAISearchConfig.AuthTypes.ManualTokenCredential };

TokenCredential token = new ...;
config.SetCredential(token);

var memory = new KernelMemoryBuilder().WithAzureAISearchMemoryDb(config).Build();

or you could use Managed Identities:

var config = new AzureAISearchConfig { Auth = AzureAISearchConfig.AuthTypes.AzureIdentity };
var memory = new KernelMemoryBuilder().WithAzureAISearchMemoryDb(config).Build();

If you use a managed identity, you should be able to configure which identity in your deployment, without the need to configure the client/tenant ID/audience in KM:

• create a managed identity in your preferred tenant/cloud
• configure Azure AI Search to allow access from the managed identity
• configure the .NET app container to use the managed identity when connecting to other services, e.g. when connecting to AI Search
• configure KM to use AzureIdentity (second snippet above)

[clarked-msft]

I need to configure the audience because I'm not in the commercial cloud. The default token audience does not work outside commercial.

I'm sure I could implement a TokenCredential that ignores the scope passed to it but it seems like it would be quite a pain to pass it through, and it would break the normal config pattern.

I am using dependency injection which basically does what you mention for a managed identity. This is the case that does not work. There is not a way to pass an audience to the SearchIndexClient created in AzureAISearchMemory.cs.
AISearch DependencyInjection.cs
AzureAISearchMemory.cs
.net sdk SearchClientOptions.cs