Question

Your team manages an Azure AI Foundry hub that serves three separate projects: a customer-facing chatbot, an internal HR assistant, and a finance analytics tool. The HR assistant must connect to an Azure AI Search index containing sensitive employee records. Compliance requires that this index be accessible only to the HR assistant project and never exposed to the other two projects, while other resources (such as the shared Azure OpenAI model deployment) remain available to all three. How should you configure the Azure AI Search connection?

Accepted Answer

Create the Azure AI Search connection scoped to the individual HR assistant project rather than sharing it at the hub level.

Answer

Create the Azure AI Search connection at the hub level so all projects inherit it, then use RBAC on the search service to block the other two projects.

Answer

Create three identical hub-level connections and assign each a different name so only the HR project uses the correct one.

Answer

Store the search index key in the hub's shared key vault and distribute it only to HR assistant developers.