microsoft/semantic-kernel · error · ServiceInitializationError

Error: missing Azure Cognitive Search client credentials.

Error message

Error: missing Azure Cognitive Search client credentials.

What it means

Raised in `get_search_index_async_client` when no credentials of any kind can be resolved: `admin_key` is not provided, neither `azure_credential` nor `token_credential` objects are passed, and the `AZURE_COGNITIVE_SEARCH_ADMIN_KEY` env var is unset. Without credentials the `SearchIndexClient` cannot be constructed, so initialization fails with `ServiceInitializationError`.

Source

Thrown at python/semantic_kernel/connectors/memory_stores/azure_cognitive_search/utils.py:66

        service_endpoint = os.getenv(ENV_VAR_ENDPOINT)
    else:
        raise ServiceInitializationError("Error: missing Azure Cognitive Search client endpoint.")

    if service_endpoint is None:
        print(service_endpoint)
        raise ServiceInitializationError("Error: Azure Cognitive Search client not set.")

    # Credentials
    if admin_key:
        azure_credential = AzureKeyCredential(admin_key)
    elif azure_credential:
        azure_credential = azure_credential
    elif token_credential:
        token_credential = token_credential
    elif os.getenv(ENV_VAR_API_KEY):
        azure_credential = AzureKeyCredential(os.getenv(ENV_VAR_API_KEY))
    else:
        raise ServiceInitializationError("Error: missing Azure Cognitive Search client credentials.")

    if azure_credential is None and token_credential is None:
        raise ServiceInitializationError("Error: Azure Cognitive Search credentials not set.")

    sk_headers = {USER_AGENT: "Semantic-Kernel"}

    if azure_credential:
        return SearchIndexClient(endpoint=service_endpoint, credential=azure_credential, headers=sk_headers)

    if token_credential:
        return SearchIndexClient(endpoint=service_endpoint, credential=token_credential, headers=sk_headers)

    raise ValueError("Error: unable to create Azure Cognitive Search client.")


def get_index_schema(vector_size: int, vector_search_profile_name: str) -> list:
    """Return the schema of search indexes.

View on GitHub (pinned to c028a0c7dc)

Solutions

  1. Set `AZURE_COGNITIVE_SEARCH_ADMIN_KEY` (or pass `admin_key=`) for key-based auth.
  2. For AAD/managed identity, pass a `token_credential` such as `DefaultAzureCredential()`.
  3. Ensure `load_dotenv()` sees your `.env` with the key, and that CI injects the secret.
  4. Use an admin (query-key-for-admin) key, not a query-only key, where admin operations are required.

Example fix

// before
get_search_index_async_client(search_endpoint="https://...search.windows.net")  # no creds

// after
# option A: key auth
get_search_index_async_client(
    search_endpoint="https://...search.windows.net",
    admin_key=os.environ["AZURE_COGNITIVE_SEARCH_ADMIN_KEY"],
)
# option B: token credential
from azure.identity import DefaultAzureCredential
get_search_index_async_client(
    search_endpoint="https://...search.windows.net",
    token_credential=DefaultAzureCredential(),
)
Defensive patterns

Strategy: validation

Validate before calling

import os

def acs_creds_resolved(admin_key, azure_credential, token_credential) -> bool:
    return bool(admin_key or azure_credential or token_credential
               or os.getenv("AZURE_COGNITIVE_SEARCH_ADMIN_KEY"))

# assert acs_creds_resolved(...) before building the client

Type guard

def has_acs_credentials(admin_key, azure_credential, token_credential) -> bool:
    import os
    return bool(admin_key or azure_credential or token_credential
               or os.getenv("AZURE_COGNITIVE_SEARCH_ADMIN_KEY"))

Try / catch

from semantic_kernel.exceptions import ServiceInitializationError
try:
    client = get_search_index_async_client(...)
except ServiceInitializationError as e:
    if "credentials" in str(e):
        raise SystemExit("provide admin_key or token_credential or AZURE_COGNITIVE_SEARCH_ADMIN_KEY") from e
    raise

Prevention

When it happens

Trigger: Calling the client factory / store constructor without `admin_key`, `azure_credential`, or `token_credential`, while `AZURE_COGNITIVE_SEARCH_ADMIN_KEY` is absent from the environment and `.env`.

Common situations: Forgetting to set the admin key env var; intending to use managed identity/`DefaultAzureCredential` but not passing a `token_credential`; `.env` not loaded; CI secret not injected; using a read-only query key where an admin key is required.

Related errors

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/7d83ff58077f6354. Report an issue: GitHub.