The recommended way to add document-level access control is using Cloud Ingestion with Azure Data Lake Storage (ADLS) Gen2. This method uses Azure Functions to extract POSIX-style ACLs from files and index them into Azure AI Search.
Workflow
- Store documents in an ADLS Gen2 account with hierarchical namespace enabled.
- Set ACLs on files/folders to control user/group access.
- An Azure AI Search indexer triggers Azure Functions (Document Extractor, Figure Processor, Text Processor) to parse documents and extract ACLs.
- Extracted User IDs (
oids) and Group IDs (groups) are stored in the search index.
Setup Instructions
1. Enable cloud ingestion and ACLs in your environment:
azd env set USE_CLOUD_INGESTION true
azd env set USE_CLOUD_INGESTION_ACLS true
azd env set AZURE_USE_AUTHENTICATION true
azd env set AZURE_ENFORCE_ACCESS_CONTROL true
2. Deploy the application:
azd up
3. Upload documents with ACLs:
You can use the provided script to upload sample data with ACLs:
python scripts/adlsgen2setup.py './data/*' --data-access-control './scripts/sampleacls.json' -v
4. Trigger ingestion:
./scripts/setup_cloud_ingestion.sh
azd env set USE_CLOUD_INGESTION true
azd env set USE_CLOUD_INGESTION_ACLS true
azd env set AZURE_USE_AUTHENTICATION true
azd env set AZURE_ENFORCE_ACCESS_CONTROL true
azd up
python scripts/adlsgen2setup.py './data/*' --data-access-control './scripts/sampleacls.json' -v
./scripts/setup_cloud_ingestion.sh