Bugfix/govcloud document intelligence, ai search, content safety managed identity authentication

[Xeelee33]

Updated the Document Intelligence, Content Safety, and AI Search client initialization and usage to authenticate successfully using Managed Identity instead of Key-based authentication in Government and Custom cloud contexts.

Document Intelligence and Content Safety

Credential Scope
Document Intelligence and Content Safety client initialization in Government or other custom clouds requires the use of a custom credential scope that must be specified. Reference: https://learn.microsoft.com/en-us/azure/developer/python/sdk/azure-sdk-sovereign-domain#using-pre-defined-sovereign-cloud-constants.

The Government credential scope for Cognitive Services is https://cognitiveservices.azure.us/.default. Reference: https://learn.microsoft.com/en-us/azure/search/retrieval-augmented-generation-overview?tabs=docs#example-code-for-a-rag-workflow.

Document Intelligence Module and API Version
In the current code, the document intelligence client is created either the Document Intelligence Client from the azure-ai-documentintelligence package (most current) if using APIM or Managed Identity or the Document Analysis Client from the azure-ai-formrecognizer package, which only supports API versions up to 2023-10-31. When attempting to connect to Document Intelligence via the azure-ai-documentintelligence package (at least in Government cloud) the API version defaults to 2023-07-30-preview and throws an error, as that API version was never available in Gov cloud. Instead, the officially documented generally available API version of 2024-11-30 needs to be specified in the client creation.

Ensuring the client is being consistently created with the correct version leads to another issue - the 2024-11-30 API version of Document Intelligence requires files to be sent in JSON, IO[bytes] or AnalyzeDocumentRequest. Additionally, it does not accept keyword arguments like the earlier versions do. Since I assume the code works as written in commercial for the DocumentIntelligenceClient I changed the key-based auth client to DocumentIntelligence for all clouds so it uses the same package/API regardless of authentication method. It might be worth updating the DI code for commercial to comply with the most current GA version as well, but I don't have access to a Commercial tenant to test changes.

Content Safety RBAC
If the app's managed identity is set to Cognitive Services Contributor as currently specified, testing the service throws the error

The principal lacks the required data action Microsoft.CognitiveServices/accounts/ContentSafety/text:analyze/action to perform POST /contentsafety/text:analyze operation.

The Built-in Role that has the "Microsoft.CognitiveServices/accounts/ContentSafety/*" under dataActions is Azure AI Developer. Testing proved that this role allows the app to authenticate to the service and perform the necessary actions.

AI Search

AI Search appears to authenticate via managed identity similarly to Video Indexer in that it acquires a token from a specific resource manager (aka audience) and then sends an API request using the token. The AI Search audience/resource manager for Government cloud is https://search.azure.us. Documentation for specifying audience in the client creation: https://learn.microsoft.com/en-us/azure/search/keyless-connections?tabs=python%2Cazure-cli#update-source-code-to-use-defaultazurecredential

AI Search RBAC
Because the app's managed identity needs sufficient access to obtain a token from ARM the app's identity needs the Contributor role on the service. In order for the Search Python SDK to perform actions on the indexes, the app service's identity must also be assigned the Search Index Data Contributor role. There may be lesser or custom roles able to do this, but the combination of these two roles is what finally worked in my tests.

AI Search Connection Test
The _test_azure_ai_search_connection function had code for creating a ContentSafety client instead of the Search client, so I updated the function with code for to create a Search client instead.

Video Indexer RBAC README

I neglected to update the README with the required role for Managed Identity authentication in my other pull request with the actual code changes to get MI to work in Government cloud, so rectifying that here.

Pictures

Document Intelligence

Before

After

Content Safety

Before

After

AI Search

Before

After

[paullizer]

Amazing work and write up!

Before approving I want to talk through the Doc intel changes. I will reach out on 8/20.