Secured HR RAG Using FoundryIQ

Setup

az login
azd up

Initialize

cd app

azd env get-values > .env
uv run ops.py
#to validate the knowledge source is ready
uv run test_ops.py 
#to validate the MCP connection
uv run test_mcp_client.py

#to validate the agent mode
uv run test_agent.py

Run Locally

agent-chat API

cd app/api
azd env get-values > .env
uv run agent_api.py 

Gui Chat

cd app/ui
azd env get-values > .env
# edit the .env file and comment out #AGENT_CHAT_API_URL="https://xxxxxx.azurewebsites.net"
uv run streamlit run streamlit_app.py

and open your browser on http://localhost:8501/

Run on Azure

Deploy the agent chat api on appservice

$infra/hooks/update-appservice-container-chat.sh 
🐳 Updating App Service with new container image...
Resource Group: rg-app-iq-dev
App Service Name: chat-agent-hrrag-expj5fw6wfji4
Container Image: acrhrragexpj5fw6wfji4acr.azurecr.io/agent-chat:20260304-130453
Adding AGENT_CHAT_API_APP_CLIENT_SECRET client secret to App Service app settings...

Updating App Service container configuration...
No credential was provided to access Azure Container Registry. Trying to look up...

Restarting App Service to apply changes...

✅ App Service container updated successfully!

App Service URL: https://chat-agent-hrrag-expj5fw6wfji4.azurewebsites.net
Container Image: acrhrragexpj5fw6wfji4acr.azurecr.io/agent-chat:20260304-130453

Deploy the Streamlit UI on appservice

$infra/hooks/update-appservice-container-ui.sh
 Updating App Service with new container image...
Resource Group: rg-app-iq-dev
App Service Name: streamlit-hrrag-expj5fw6wfji4
Container Image: acrhrragexpj5fw6wfji4acr.azurecr.io/streamlit-app:20260304-103922
Adding OAUTH_AZURE_AD_CLIENT_SECRET client secret to App Service app settings...

Updating App Service container image configuration...
No credential was provided to access Azure Container Registry. Trying to look up...

Restarting App Service to apply changes...

✅ App Service container updated successfully!

App Service URL: https://streamlit-hrrag-expj5fw6wfji4.azurewebsites.net
Container Image: acrhrragexpj5fw6wfji4acr.azurecr.io/streamlit-app:20260304-103922

Open the App Service URL

The application

1. Open the application
2. SignIn
3. Select a Knowledge Base
4. Click About Kathleen Young

Depending of the selected knowledge base and the signed in user you can get her salary.

Entra ID Users & Groups

The following users and security groups are provisioned automatically during azd provision:

Groups

Group	Description
ProSwingAll	All ProSwing employees
ProSwingHR	HR department
ProSwingManager	Managers

Users

User	UPN	Groups	Password
Carole King	CaroleKing@<tenant-domain>	ProSwingHR, ProSwingAll	P@ssw0rd1234!
Margaret Miller	MargaretMiller@<tenant-domain>	ProSwingManager, ProSwingAll	P@ssw0rd1234!
Mary Smith	MarySmith@<tenant-domain>	ProSwingAll	P@ssw0rd1234!

az ad signed-in-user show --query "{displayName:displayName, objectId:id, upn:userPrincipalName}" -o table
DisplayName    ObjectId                              Upn
-------------  ------------------------------------  -------------------------------------------
Carole King    7341a000-a8b6-48be-b48f-1b409b3ba577  CaroleKing@MngEnvMCAP729664.onmicrosoft.com

References

https://github.com/microsoft/Conversation-Knowledge-Mining-Solution-Accelerator/tree/main https://miyazaki.cloud/building-secure-ai-retrieval-with-azure-ai-search-and-document-level-access-control/ https://learn.microsoft.com/en-us/azure/ai-foundry/agents/how-to/foundry-iq-connect?view=foundry&tabs=foundry%2Cpython

https://github.com/MicrosoftDocs/azure-ai-docs/blob/main/articles/search/search-document-level-access-overview.md https://learn.microsoft.com/en-us/azure/search/agentic-retrieval-how-to-create-pipeline