Comprehensive and Detailed 150 to 250 words of Explanation From Azure AI Apps and Agents Developer/Course Guide/topics:
A common Azure AI Search security-trimming pattern stores the authorization information required to filter each document directly in the search index.
First, add the allowed groups to each index entry . This provides a filterable field describing which Microsoft Entra groups are authorized to access that document.
Second, when a user performs a search, retrieve the user ' s group memberships . Those group identifiers form the user ' s effective document-access context.
Third, supply those groups as a filter with the search request. Azure AI Search can then exclude documents whose allowed-groups field does not intersect with the groups associated with the current user.
Creating one index per group would duplicate documents and significantly increase indexing and operational complexity. Retrieving every group in the tenant is unnecessary; only the current user ' s memberships are relevant. An Entra token authenticates a caller to the Search service but does not by itself implement an arbitrary per-document group ACL field in the classic filtering pattern described by this question.
The resulting solution performs authorization trimming during retrieval, ensuring inaccessible content is not passed to a RAG agent.
Study Guide alignment: build secure retrieval and grounding pipelines for enterprise information . Microsoft Learn
====================
