Fix Azure AI Search Test Connection with Managed Identity

[vivche]

Overview

This PR fixes the "Test Azure AI Search Connection" functionality when using managed identity authentication in Azure public cloud environments. The fix replaces the REST API approach with the Azure Search SDK, which properly handles managed identity authentication.

📖 For detailed technical analysis and implementation details, see:
docs/explanation/fixes/v.0.236.013/AZURE_AI_SEARCH_TEST_CONNECTION_FIX.md

---

🐛 Bug Fix

Azure AI Search Test Connection with Managed Identity

Issue Behavior:
When clicking "Test Azure AI Search Connection" button on the App Settings "Search & Extract" page with managed identity authentication enabled, the test failed with:

NameError: name 'search_resource_manager' is not defined

Even when attempting to define the variable, bearer token authentication didn't work with Azure AI Search's data plane operations.

Fix Azure AI Search Test Connection with Managed Identity

Root Cause:
The old implementation used a REST API approach with manually acquired bearer tokens via DefaultAzureCredential.get_token(). This approach is fundamentally incompatible with how Azure AI Search handles managed identity authentication on the data plane:

• Azure AI Search requires SDK-specific authentication handling
• The service rejects bearer tokens acquired through standard credential flows
• Manual token acquisition bypasses necessary SDK authentication logic
• Different Azure environments require different token scopes that the REST API approach didn't handle correctly

Solution:
Replaced the REST API implementation with SearchIndexClient from the azure.search.documents SDK:

• The SDK automatically handles managed identity authentication
• Properly constructs service endpoints and credentials
• Handles token acquisition and refresh transparently
• Works correctly across all Azure environments (public, government, China)

---

📝 Files Changed

Code Modified:

• application/single_app/route_backend_settings.py - Replaced REST API with SearchIndexClient SDK
• application/single_app/config.py - Version update to 0.236.013

Documentation Added:

• docs/explanation/fixes/v.0.236.013/AZURE_AI_SEARCH_TEST_CONNECTION_FIX.md - Comprehensive fix documentation

---

🔄 Version Update

Updated version from 0.236.011 to 0.236.012

---

🧪 Testing

Tested with:

• ✅ Managed Identity authentication in Azure public cloud
• ✅ Service Principal authentication
• ✅ Valid and invalid Azure AI Search endpoints
• ✅ Connection test returns appropriate success/error messages

Test Environment:

• AZURE_ENVIRONMENT=public in .env
• Azure AI Search with RBAC enabled
• Service principal with "Search Index Data Reader" role

---

🎯 Related Issues

Fixes #611 - Azure AI Search Test Connection failed for public env

This fix is critical for:

• Deployments using managed identity authentication (recommended security practice)
• Azure public cloud environments
• Validating Azure AI Search configuration in admin settings
• Troubleshooting search integration issues

[Copilot]

Pull request overview

This PR primarily fixes the Azure AI Search “Test Connection” path when using managed identity, and also adds related infrastructure and documentation for managed-identity-based Cognitive Services (including Speech).

Changes:

• Reworked _test_azure_ai_search_connection to use the Azure Search SDK (SearchIndexClient) for both key-based and managed-identity auth, aligning behavior with how production search operations authenticate.
• Added Terraform resources and RBAC assignments for a Speech Cognitive Services account with custom subdomain and managed-identity-friendly configuration, plus a how-to guide for Speech with managed identity.
• Bumped the application version in config.py and added detailed fix documentation under docs/explanation/fixes.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
application/single_app/route_backend_settings.py	Replaces the previous REST + manual token logic in _test_azure_ai_search_connection with SearchIndexClient using DefaultAzureCredential for managed identity and AzureKeyCredential for key/APIM scenarios, directly addressing the managed-identity failure.
application/single_app/config.py	Increments VERSION to 0.236.013 to version the Azure AI Search test-connection fix.
deployers/terraform/main.tf	Adds a Speech Cognitive Services account with custom_subdomain_name and assigns appropriate Speech RBAC roles to the user-assigned and system-assigned identities, supporting managed-identity-based Speech usage consistent with the new docs.
docs/explanation/fixes/v.0.236.013/AZURE_AI_SEARCH_TEST_CONNECTION_FIX.md	Documents the root cause and resolution for the Azure AI Search test-connection bug, including environment-specific details and configuration requirements, but currently misstates that there were no config.py changes.
docs/how-to/azure_speech_managed_identity_manul_setup.md	Provides a detailed how-to guide for configuring Azure Speech with managed identity and custom subdomains so that deployments match the updated Terraform resources, though the filename contains a typo.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Bionic711]

@vivche Please resolve the merge conflict then @ me here so I can merge please.