Setting the file. One moment.
Subchapter 10.15
references/resource-intake.mdMarkdown8 KBView on GitHub
For unresolved names/URLs/choices, helpers still receive their documented, resolved JSON inputs. Execute only the applicable branch, not every discovery command on this page.
Search validation is not AI-host readiness. CU () and model (/) selections use their purpose-specific owners below.
AIServicesOpenAIAIServicesBefore expensive enumeration, reuse supplied resource/intent; otherwise ask one USE EXISTING / FIND CANDIDATES / CREATE NEW choice. USE asks only for a missing locator. Only FIND enumerates. CREATE checks its proposed name and necessary region/quota/cost, not existing-service inventory; approval remains separate. Carry intent and resolved IDs/modes through source/KB/CU/model handoffs.
Reuse prompt/session choices. Otherwise use az account show and assume its
default subscription, stating that assumption; an explicit subscription wins.
Pass --subscription <sub> on reads; never silently change CLI context.
Account context and candidate listings are not access/readiness proof.
Exact supplied IDs need exact readback, not enumeration. Only FIND browses relevant types in the known group, else selected subscription. Read all pages within that query, never fan out across subscriptions or enumerate unrelated resource types. Offer choices, not a questionnaire about IDs.
Read Search intake; execute its native
search_intake.py --select surface, not improvised filtering/glue.
Exact ID/name+group skips enumeration. Name/endpoint without group gets only exact
name/type resolution in the selected subscription; do not fetch arbitrary URLs.
FIND uses known RG before selected-subscription fallback; bounded metadata/pages,
five-row presentation and unassessed counts, no megabyte inventory dump.
Explicit choice wins; retain cross-region candidates. Observed source-region
proximity is latency/data movement preference, not Search/CU compatibility.
Never infer location from names, absence/uniqueness from top five, or broaden denial.
Use returned selection_input; users need not copy IDs.
Recheck selected operation, not new-resource hardening defaults. Keys-enabled Search may support Entra; never disable keys/change identity/firewall/ tags to satisfy a template. Actual File CU-MI/Blob/vector/KB-chat MI remains required. Private/UAMI-selected unsupported paths return capability/access blockers, not global compliance failures. Caller-to-Search and Search-to-dependency access are separate; metadata/read proof is not write permission or outbound readiness. No Search/Storage keys or billable readiness probes. The Search owner preserves exact approval boundaries.
Accept https://example.blob.core.windows.net/documents as intake:
account example, container documents. A URL does not identify its Azure
subscription or resource group; the CLI default is only the initial lookup scope.
Also accept separately supplied names/IDs; do not ask again for URL-derived fields.
Also accept https://example.dfs.core.windows.net/documents/onboarding:
account example, filesystem/container documents, directory onboarding.
Keep the observed endpoint type (Blob or DFS); do not infer HNS from the hostname.
Parse locally: HTTPS, exact <account>.blob.core.windows.net or
<account>.dfs.core.windows.net host and an explicit container/filesystem path.
Reject user-info, query/SAS, fragments, custom hosts/ports and
malformed encoding without echoing the input; request a clean locator.
Decode path segments once, preserve case, and reject ambiguous encoded separators,
dot segments and control characters. Never use credentials from a pasted URL or
fetch its content during intake. Do not guess a folder from an individual blob URL.
Resolve the account by exact name/type in the selected subscription:
az resource list --name <account> --resource-type Microsoft.Storage/storageAccounts --subscription <sub>.
Add --resource-group <group> when known. Read the returned exact ARM resource
and verify its account name, corresponding Blob/DFS endpoint and HNS setting.
DFS/ADLS intent requires verified HNS; resolve mismatches rather than silently
converting to Blob. A Blob hostname on an HNS account still uses ADLS rules.
Obtain the Storage
ID/group from that readback; do not invent them from the URL.
If inaccessible or absent from the selected scope, ask for the correct scope/ID;
do not scan every subscription, provision Storage or request broader access automatically.
Keep the supplied container; no container enumeration is needed. If it is unknown,
the Blob owner offers observed containers in the selected account using Entra login.
Only FIND with an unknown account offers Storage-account choices with
az storage account list --subscription <sub>, adding the known group filter.
Choose a returned account before enumerating its containers.
A container locator does not silently select every object. Preserve an explicit
folder choice, or resolve whole-container versus folder scope before inventory.
Ambiguous folder/blob paths need clarification, never automatic slash-appending
or parent-container expansion. Carry endpoint type and verified HNS to the owner:
Blob non-root prefixes end in /; ADLS directories do not. Never append /
merely to turn a file or arbitrary partial prefix into a folder.
No object inventory/download occurs before the data boundary is selected.
Keyword-only skips embedding discovery; other dependencies remain conditional.
Carry the early service choice: supplied account/deployment uses exact reads;
only FIND lists accounts/deployments. CREATE uses required catalog/quota checks,
not an existing-account inventory. Never reopen resolved CU/model selections.
Use typed discovery, not ad hoc
CLI filtering/glue. Exact model IDs first; otherwise
selected RG/subscription only. Choose account before its deployments. Reuse
returned selection_input; show deployment versus model/version and account/region.
CU uses purpose: cu; shared CU ingestion owns necessary
checks and pending drafts, not generic configuration attestations.
Retrieval effort alone never makes a route model-free. Minimal+extractive can
skip chat; minimal+answerSynthesis requires chat-model discovery (purpose: chat).
Keep extraction mode, source embeddings and CU independent. The KB/retrieve owner
verifies API support; this intake does not establish availability or change validators.
For new deployments the native owner uses az cognitiveservices model list and
az cognitiveservices usage list with --location <region> --subscription <sub>
for model/version/SKU/quota before approval. Existing deployments need readback,
not catalogs. Retain capacity/price/residency checks; execute only approved changes.
Return selections without restarting intake. Selection is not mutation approval. Preserve boundaries, complete inventories, fresh pre-write and ownership/access checks. After discovery, batch compatible unresolved Search, processing/search and model/CU choices with recommendations; reuse informed answers. Account selection precedes deployment listing, so do not batch a deployment guess. Keep exact sample-content consent and actual resource/permission/CU/source/KB approvals distinct; no approval of unknown future bodies. Source planners already own exact-name collision checks.
Authorities: failure/conflict/uncertainty only.
Filtered ARM resources (opens in a new tab). Blob resource URIs (opens in a new tab). ADLS filesystem/path (opens in a new tab).