Hello everyone,
We have now found a solution to our problem, which I would like to briefly document here. Perhaps it will help someone else who is struggling with a similar issue as we were.
First, let me briefly restate the challenge (which can serve as an example for other similar use cases):
We created an Agent in Azure AI Foundry. We want to use this Agent in a Python Notebook in Fabric (to clarify: this is not about a "Fabric Agent," which is not helpful for our purposes).
The agent uses an LLM (in our case, gpt-4o) and a tool for web search (in our case, Bing Grounding Search).
The agent should perform a web search based on product data from a Lakehouse table (e.g., an EAN number) and enrich the product data in the Lakehouse with the results from the web search.
Our main problem was authenticating the agent in Fabric.
Here is the solution:
The magic word is "Role-Based Access Control" (RBAC).
Requirements:
- An Azure subscription.
- A project in Azure AI Foundry ( https://learn.microsoft.com/en-us/azure/ai-foundry/how-to-create-projects?tabs=ai-foundry&pivots=fdp...)
- An Agent in Azure AI Foundry ( https://learn.microsoft.com/en-us/azure/ai-foundry/agents/quickstart?pivots=ai-foundry-portal)
- An Azure Service Principal at the tenant level (setup is fairly simple, but can only be done by someone with the Cloud Application Administrator role).
- An Azure Key Vault.
Once the prerequisites are met, the following initial steps must be performed:
- Open the project in the Azure Portal and assign the Service Principal the role of "Azure AI User" via "Access Control (IAM)" (this is the crucial step in "Role-Based Access Control").
- In the Azure Portal, create a Client Secret for the Service Principal and store the secret in the Azure Key Vault.
- The following data should also be stored in the Azure Key Vault:
- The Tenant ID.
- The Tlient ID of the Service Principal.
- In addition, you will need the project endpoint and the ID of the Foundry Agent.
The Foundry Agent can now be used in a Python Notebook in Fabric. Below is a code example.
Maybe this helps someone. Feel free to reach out if you have any questions about the procedure described above.
Best regards,
Udo
from azure.ai.projects import AIProjectClient
from azure.identity import ClientSecretCredential
from azure.ai.agents.models import ListSortOrder
# Retrieve secrets from Azure Key Vault using mssparkutils
TENANT_ID = mssparkutils.credentials.getSecret('YOUR-KEY-VAULT-URL','TENANT_ID')
CLIENT_ID = mssparkutils.credentials.getSecret('YOUR-KEY-VAULT-URL','CLIENT_ID')
CLIENT_SECRET = mssparkutils.credentials.getSecret('YOUR-KEY-VAULT-URL','CLIENT_SECRET')
PROJECT_ENDPOINT = 'YOUR-PROJECT-ENDPOINT"
# Define credentials for authentication
credential = ClientSecretCredential(
tenant_id=TENANT_ID,
client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
# Initialize the AI project client with the credentials and endpoint
project = AIProjectClient(credential=credential, endpoint=PROJECT_ENDPOINT)
# Retrieve the specific agent by its ID
agent = project.agents.get_agent('YOUR-AGENT-ID')
# Create a new thread for the conversation
thread = project.agents.threads.create()
print(f"Created thread, ID: {thread.id}")
# Send a message to the agent with the specific query
message = project.agents.messages.create(
thread_id=thread.id,
role="user",
content="Hello Agent"
)
# Create and process a run for the agent to handle the message
run = project.agents.runs.create_and_process(
thread_id=thread.id,
agent_id=agent.id
)
# Check the status of the run and handle accordingly
if run.status == "failed":
print(f"Run failed: {run.last_error}")
else:
# Retrieve and print all messages in the thread in ascending order
messages = project.agents.messages.list(thread_id=thread.id, order=ListSortOrder.ASCENDING)
for message in messages:
if message.text_messages:
print(f"{message.role}: {message.text_messages[-1].text.value}")
