@@ -41,6 +41,12 @@ To set up a pipeline that connects Azure AI Search to Foundry Agent Service via
 
 ::: zone pivot="csharp"
 
++ If you [call the MCP endpoint through the Azure OpenAI Responses API](#authenticate-to-the-mcp-endpoint), you need:
+
+  + A deployed LLM and the **Cognitive Services OpenAI User** role (or an API key) on the Foundry resource. You can reuse the LLM and resource specified in your knowledge base, if applicable.
+
+  + The [`Azure.AI.OpenAI`](https://www.nuget.org/packages/Azure.AI.OpenAI) and [`Azure.Identity`](https://www.nuget.org/packages/Azure.Identity) packages.
+
 + Required [`Azure.Search.Documents`](https://www.nuget.org/packages/Azure.Search.Documents) package:
 
   + For 2026-05-01-preview features, the latest preview package: `dotnet add package Azure.Search.Documents --prerelease`
@@ -51,6 +57,12 @@ To set up a pipeline that connects Azure AI Search to Foundry Agent Service via
 
 ::: zone pivot="python"
 
++ If you [call the MCP endpoint through the Azure OpenAI Responses API](#authenticate-to-the-mcp-endpoint), you need:
+
+  + A deployed LLM and the **Cognitive Services OpenAI User** role (or an API key) on the Foundry resource. You can reuse the LLM and resource specified in your knowledge base, if applicable.
+
+  + The [`openai`](https://pypi.org/project/openai/) and [`azure-identity`](https://pypi.org/project/azure-identity/) packages.
+
 + Required [`azure-search-documents`](https://pypi.org/project/azure-search-documents/#history) package:
 
   + For 2026-05-01-preview features, the latest preview package: `pip install --pre azure-search-documents`
@@ -1744,30 +1756,211 @@ To avoid this behavior, index large source documents as smaller chunks with stab
 
 In Azure AI Search, each knowledge base is a standalone MCP server that exposes the `knowledge_base_retrieve` tool. Any MCP-compatible client, including [Foundry Agent Service](/azure/ai-foundry/agents/overview), [GitHub Copilot](https://github.com/features/copilot), [Claude](https://claude.ai), and [Cursor](https://cursor.com), can invoke this tool to query the knowledge base.
 
-### MCP endpoint format
+### Authenticate to the MCP endpoint
 
-Each knowledge base has an MCP endpoint at the following URL.
+Each knowledge base has an MCP endpoint at the following URL:
 
 ```
-https://<your-service-name>.search.windows.net/knowledgebases/<your-knowledge-base-name>/mcp?api-version=<api-version>
+https://<your-search-service>.search.windows.net/knowledgebases/<your-knowledge-base>/mcp?api-version=<api-version>
 ```
 
 The API version you specify determines what the connection returns. With `2026-05-01-preview`, the knowledge base can return synthesized answers when the underlying knowledge base is configured with an LLM and a compatible reasoning effort. With `2026-04-01`, retrieval is always minimal and extractive, and the connection returns grounding data only.
 
-### Authenticate to the MCP endpoint
+How you authenticate to this endpoint depends on your MCP client. When you use the Azure OpenAI Responses API with the `knowledge_base_retrieve` MCP tool, you authenticate both the Responses API call to Azure OpenAI and the MCP request to Azure AI Search. If your MCP client calls this endpoint directly, you authenticate only to Azure AI Search.
+
+For Azure AI Search authentication, use one of the following methods:
+
++ [Pass a bearer token](#use-a-bearer-token-for-mcp-authentication) in the `Authorization` header (recommended)
++ [Pass an admin key](#use-an-admin-key-for-mcp-authentication) in the `api-key` header
+
+> [!NOTE]
+> MCP clients configure custom headers differently. For example, [Foundry Agent Service](/azure/ai-foundry/agents/how-to/foundry-iq-connect) injects headers through project connections, while clients such as [GitHub Copilot](https://docs.github.com/en/copilot/how-tos/provide-context/use-mcp/extend-copilot-chat-with-mcp) require headers in MCP server JSON.
+
+### Use a bearer token for MCP authentication
+
+The recommended method for MCP authentication is a bearer token, which avoids storing sensitive keys in configuration files. The identity behind the token must have the **Search Index Data Reader** role assigned on the search service. For more information, see [Connect your app to Azure AI Search using identities](search-security-rbac-client-code.md).
+
+:::zone pivot="csharp"
+
+```csharp
+#pragma warning disable OPENAI001
+
+using Azure.AI.OpenAI;
+using Azure.Core;
+using Azure.Identity;
+using OpenAI.Responses;
+using System;
+using System.Collections.Generic;
+
+string openAiEndpoint = Environment.GetEnvironmentVariable("AZURE_OPENAI_ENDPOINT")!; // Example: https://<your-resource-name>.openai.azure.com
+string mcpServerUrl = Environment.GetEnvironmentVariable("AZURE_SEARCH_MCP_ENDPOINT")!; // Example: https://<your-search-service>.search.windows.net/knowledgebases/<your-knowledge-base>/mcp?api-version=<api-version>
+DefaultAzureCredential credential = new();
+
+// Create the Azure OpenAI Responses client
+AzureOpenAIClient azureClient = new(new Uri(openAiEndpoint), credential);
+ResponsesClient openAIClient = azureClient.GetResponsesClient();
+
+// Get a bearer token for Azure AI Search
+string searchToken = credential.GetToken(
+    new TokenRequestContext(new[] { "https://search.azure.com/.default" })
+).Token;
+
+// Configure the MCP tool for knowledge base retrieval
+McpTool mcpTool = ResponseTool.CreateMcpTool(
+    serverLabel: "search_kb",
+    serverUri: new Uri(mcpServerUrl),
+    headers: new Dictionary<string, string>
+    {
+        ["Authorization"] = $"Bearer {searchToken}",
+    },
+    allowedTools: new McpToolFilter { ToolNames = { "knowledge_base_retrieve" } },
+    toolCallApprovalPolicy: new McpToolCallApprovalPolicy(
+        GlobalMcpToolCallApprovalPolicy.NeverRequireApproval)
+);
+
+// Build the response request with the MCP tool attached
+CreateResponseOptions options = new()
+{
+    Model = "MODEL_NAME",
+    InputItems =
+    {
+        ResponseItem.CreateUserMessageItem(
+            "What causes the strongest nighttime brightness patterns in this dataset?")
+    },
+    Tools = { mcpTool }
+};
+
+ResponseResult response = await openAIClient.CreateResponseAsync(options);
+Console.WriteLine(response.GetOutputText());
+```
+
+**Reference:** [Use the Azure OpenAI Responses API](/azure/foundry/openai/how-to/responses?tabs=csharp#authentication)
+
+:::zone-end
+
+:::zone pivot="python"
+
+```python
+import os
+from azure.identity import DefaultAzureCredential, get_bearer_token_provider
+from openai import AzureOpenAI
+
+openai_endpoint = os.environ["AZURE_OPENAI_ENDPOINT"] # Example: https://<your-resource-name>.openai.azure.com
+mcp_server_url = os.environ["AZURE_SEARCH_MCP_ENDPOINT"] # Example: https://<your-search-service>.search.windows.net/knowledgebases/<your-knowledge-base>/mcp?api-version=<api-version>
+credential = DefaultAzureCredential()
+
+# Create token providers for Azure OpenAI and Azure AI Search
+openai_token_provider = get_bearer_token_provider(
+    credential, "https://cognitiveservices.azure.com/.default"
+)
+search_token_provider = get_bearer_token_provider(
+    credential, "https://search.azure.com/.default"
+)
+
+# Create the Azure OpenAI client
+client = AzureOpenAI(
+    azure_endpoint=openai_endpoint,
+    azure_ad_token_provider=openai_token_provider,
+    api_version=os.environ["OPENAI_API_VERSION"], # Example: 2025-04-01-preview
+)
+
+# Create a response using the MCP tool configuration
+response = client.responses.create(
+    model="MODEL_NAME",
+    input="What causes the strongest nighttime brightness patterns in this dataset?",
+    tools=[
+        {
+            "type": "mcp",
+            "server_label": "search_kb",
+            "server_url": mcp_server_url,
+            "allowed_tools": ["knowledge_base_retrieve"],
+            "headers": {
+                "Authorization": f"Bearer {search_token_provider()}"
+            },
+            "require_approval": "never",
+        }
+    ],
+)
+
+print(response.output_text)
+```
+
+**Reference:** [Use the Azure OpenAI Responses API](/azure/foundry/openai/how-to/responses?tabs=python#authentication)
+
+:::zone-end
+
+:::zone pivot="rest"
+
+```http
+// This code snippet is currently unavailable.
+```
 
-The MCP endpoint requires authentication through custom headers. You have two options:
+:::zone-end
 
-+ **(Recommended)** Pass a bearer token in the `Authorization` header. The identity behind the token must have the **Search Index Data Reader** role assigned on the search service. This approach avoids storing keys in configuration files. For more information, see [Connect your app to Azure AI Search using identities](search-security-rbac-client-code.md).
+### Use an admin key for MCP authentication
 
-+ Pass an admin key in the `api-key` header. An admin key provides full read-write access to the search service, so use it with caution. For more information, see [Connect to Azure AI Search using API keys](search-security-api-keys.md).
+An admin key grants full read-write access to the search service, so use it only in development environments or when a bearer token isn't available. For more information, see [Connect to Azure AI Search using API keys](search-security-api-keys.md).
 
 > [!TIP]
-> Each MCP client configures custom headers differently. For example:
->
-> + In [Foundry Agent Service](/azure/ai-foundry/agents/how-to/foundry-iq-connect), you configure authentication through a project connection and add the MCP tool to an agent. The service automatically injects the required headers on MCP requests.
->
-> + In [GitHub Copilot](https://docs.github.com/en/copilot/how-tos/provide-context/use-mcp/extend-copilot-chat-with-mcp) and similar clients, you configure headers in the MCP server JSON, such as `mcp.json`.
+> The following example shows only the header that differs from the bearer token example. For the full setup, see [Use a bearer token for MCP authentication](#use-a-bearer-token-for-mcp-authentication).
+
+:::zone pivot="csharp"
+
+```csharp
+#pragma warning disable OPENAI001
+
+using OpenAI.Responses;
+using System;
+using System.Collections.Generic;
+
+string mcpServerUrl = Environment.GetEnvironmentVariable("AZURE_SEARCH_MCP_ENDPOINT")!; // Example: https://<your-search-service>.search.windows.net/knowledgebases/<your-knowledge-base>/mcp?api-version=<api-version>
+string searchAdminKey = Environment.GetEnvironmentVariable("AZURE_SEARCH_ADMIN_KEY")!; // Example: <your-search-admin-key>
+
+McpTool mcpTool = ResponseTool.CreateMcpTool(
+    serverLabel: "search_kb",
+    serverUri: new Uri(mcpServerUrl),
+    headers: new Dictionary<string, string> { ["api-key"] = searchAdminKey },
+    allowedTools: new McpToolFilter { ToolNames = { "knowledge_base_retrieve" } },
+    toolCallApprovalPolicy: new McpToolCallApprovalPolicy(
+        GlobalMcpToolCallApprovalPolicy.NeverRequireApproval)
+);
+```
+
+**Reference:** [Use the Azure OpenAI Responses API](/azure/foundry/openai/how-to/responses?tabs=csharp#authentication)
+
+:::zone-end
+
+:::zone pivot="python"
+
+```python
+import os
+
+mcp_server_url = os.environ["AZURE_SEARCH_MCP_ENDPOINT"] # Example: https://<your-search-service>.search.windows.net/knowledgebases/<your-knowledge-base>/mcp?api-version=<api-version>
+search_admin_key = os.environ["AZURE_SEARCH_ADMIN_KEY"] # Example: <your-search-admin-key>
+
+tools = [
+    {
+        "type": "mcp",
+        "server_label": "search_kb",
+        "server_url": mcp_server_url,
+        "allowed_tools": ["knowledge_base_retrieve"],
+        "headers": {"api-key": search_admin_key},
+        "require_approval": "never",
+    }
+]
+```
+
+**Reference:** [Use the Azure OpenAI Responses API](/azure/foundry/openai/how-to/responses?tabs=python#authentication)
+
+:::zone-end
+
+:::zone pivot="rest"
+
+```http
+// This code snippet is currently unavailable.
+```
+
+:::zone-end
 
 ## Review the MCP response
 

@@ -3,23 +3,16 @@ items:
   tocHref: /azure/
   topicHref: /azure/index
   items:
-  - name: Search
+  - name: Azure AI Search
+    tocHref: /azure/search/             # show this crumb on pages whose URL starts with this tocHref
+    topicHref: /azure/search/index      # page that opens when you select this crumb
+  - name: Azure AI Search
     tocHref: /azure/reliability
-  - name: Foundry Tools
-    tocHref: /azure/ai-services/
-    topicHref: /azure/ai-services/index
-    items:
-    - name: Azure AI Search
-      tocHref: /azure/search/
-      topicHref: /azure/search/index
+    topicHref: /azure/search/index
 - name: Azure
   tocHref: /legal/
   topicHref: /azure/index
   items:
-  - name: Foundry Tools                # Original doc set name
-    tocHref: /legal/cognitive-services/    # Destination doc set route
-    topicHref: /azure/ai-services/index    # Original doc set route
-    items:
-    - name: Azure AI Search                  # Original doc set name
-      tocHref: /legal/search/    # Destination doc set route
-      topicHref: /azure/search/index      # Original doc set route
+  - name: Azure AI Search
+    tocHref: /legal/search/
+    topicHref: /azure/search/index 

@@ -4,7 +4,7 @@ description: Set up a SharePoint in Microsoft 365 indexer to automate indexing o
 ms.reviewer: gimondra
 ms.service: azure-ai-search
 ms.topic: how-to
-ms.date: 07/07/2026
+ms.date: 07/23/2026
 ai-usage: ai-assisted
 ms.custom:
   - ignite-2025
@@ -148,48 +148,57 @@ The SharePoint in Microsoft 365 indexer uses a Microsoft Entra application for a
 
 1. Sign in to the [Azure portal](https://portal.azure.com).
 
-1. Search for or navigate to **Microsoft Entra ID**, and then select **Add** > **App registration**. 
+1. Search for or navigate to **Microsoft Entra ID**.
+
+1. On the **Overview** page, select **+ Add** > **App registration**.
 
-1. Select **+ New registration**:
     1. Enter a name for your app.
-    1. Select **Single tenant**.
-    1. Skip the URI designation step. No redirect URI required.
+    1. Select **Single tenant only - *tenant name***.
+    1. Skip the URI designation step. No redirect URI is required.
     1. Select **Register**.
 
-1. On the navigation pane under **Manage**, select **API permissions**, and then **Add a permission**. Select **Microsoft Graph**.
+1. From the left pane, select **Manage** > **API permissions**.
+
+1. Select **+ Add a permission**, and then select **Microsoft Graph**.
+
+    + If your indexer uses application API permissions, select **Application permissions**.
 
-    + If your indexer uses application API permissions, choose **Application** permissions.
-      - For standard indexing, select:
-        - `Files.Read.All`
-        - `Sites.Read.All`
+      + For standard indexing, select:
+
+        + `Files.Read.All`
+        + `Sites.Read.All`
         
         :::image type="content" source="media/search-howto-index-sharepoint-online/application-api-permissions.png" alt-text="Screenshot of application API permissions." lightbox="media/search-howto-index-sharepoint-online/application-api-permissions.png":::
 
-      - If you're enabling [ACL ingestion (preview)](search-indexer-sharepoint-access-control-lists.md), the required permissions depend on which item types (document library files, list items, ASPX pages) and group types (Microsoft Entra vs. SharePoint site groups) you index. See [Permissions by ACL scenario](search-indexer-sharepoint-access-control-lists.md#permissions-by-acl-scenario) before completing this step. For the cross-scenario summary, see [Choose your permissions setup](#choose-your-permissions-setup).
+      + If you're enabling [ACL ingestion (preview)](search-indexer-sharepoint-access-control-lists.md), the required permissions depend on which item types (document library files, list items, ASPX pages) and group types (Microsoft Entra vs. SharePoint site groups) you index. Before you complete this step, see [Permissions by ACL scenario](search-indexer-sharepoint-access-control-lists.md#permissions-by-acl-scenario). For the cross-scenario summary, see [Choose your permissions setup](#choose-your-permissions-setup).
 
-          Using application permissions means that the indexer accesses the SharePoint site in a service context. So when you run the indexer, it has access to all content in the SharePoint tenant, which requires tenant admin approval. A client secret or secretless configuration is also required for authentication. Setting up the authentication mechanism is described later in this article under [authentication modes for application API permissions only](#available-authentication-methods-for-application-api-permissions-only).
+        Using application permissions means the indexer accesses the SharePoint site in a service context. Therefore, when you run the indexer, it has access to all content in the SharePoint tenant, which requires tenant admin approval. A client secret or secretless configuration is also required for authentication. Setting up the authentication mechanism is described later in this article under [Available authentication methods for application API permissions only](#available-authentication-methods-for-application-api-permissions-only).
 
-    + If the indexer uses delegated API permissions, select **Delegated permissions** and then select `Delegated - Files.Read.All`, `Delegated - Sites.Read.All`, and `Delegated - User.Read`.
+    + If your indexer uses delegated API permissions, select **Delegated permissions**, and then select:
 
+      + `Files.Read.All`
+      + `Sites.Read.All`
+      + `User.Read`
 
       :::image type="content" source="media/search-howto-index-sharepoint-online/delegated-api-permissions.png" alt-text="Screenshot showing delegated API permissions." lightbox="media/search-howto-index-sharepoint-online/delegated-api-permissions.png":::
 
       Delegated permissions allow the search client to connect to SharePoint under the security identity of the current user.
 
-1. Give admin consent.
-
-    Tenant admin consent is required when using application API permissions. Some tenants are locked down in such a way that tenant admin consent is required for delegated API permissions as well. If either of these conditions apply, you need to have a tenant admin grant consent for this Microsoft Entra application before creating the indexer.
+1. Select **Grant admin consent for *tenant name***.
 
+    Tenant admin consent is required when using application API permissions. Some tenants are locked down in such a way that tenant admin consent is also required for delegated API permissions. If either condition applies, a tenant administrator must grant consent for this Microsoft Entra application before creating the indexer.
 
     :::image type="content" source="media/search-howto-index-sharepoint-online/aad-app-grant-admin-consent.png" alt-text="Screenshot showing Microsoft Entra app grant admin consent." lightbox="media/search-howto-index-sharepoint-online/aad-app-grant-admin-consent.png":::
 
-1. Select the **Authentication** tab.
+1. From the left pane, select **Manage** > **Authentication (Preview)**.
 
-1. Set **Allow public client flows** to **Yes**, and then select **Save**.
+1. On the **Redirect URI configuration** tab, select **+ Add Redirect URI**.
 
-1. Select **+ Add a platform**, and then **Mobile and desktop applications**. Check `https://login.microsoftonline.com/common/oauth2/nativeclient`, and then select **Configure**.
+    1. Select **Mobile and desktop applications**.
+    1. Select the `https://login.microsoftonline.com/common/oauth2/nativeclient` redirect URI.
+    1. Select **Configure**.
 
-    :::image type="content" source="media/search-howto-index-sharepoint-online/aad-app-authentication-configuration.png" alt-text="Screenshot showing Microsoft Entra app authentication configuration." lightbox="media/search-howto-index-sharepoint-online/aad-app-authentication-configuration.png" :::
+1. On the **Settings** tab, enable the **Allow public client flows** toggle, and then select **Save**.
 
 1. Configure the indexer [authentication method](#available-authentication-methods-for-application-api-permissions-only) according to your solution needs.