Skip role assignments for free Azure Search SKU (#2848)

[bnodir]

Add conditional guards so Microsoft.Authorization/roleAssignments are only created when principalId is non-empty. Prevents InvalidPrincipalId errors when using the free Azure Search SKU. Fixes #2848

[Copilot]

Pull request overview

This PR adds a conditional guard to prevent role assignment creation when the principalId is empty, specifically addressing issues with the free Azure Search SKU which does not support managed identities.

• Added an if (!empty(principalId)) condition to the role assignment resource in role.bicep

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[pamelafox]

@bnodir Thanks!

I think it would be clearer to add those checks to each role in main.bicep that is assigned to searchService.outputs.systemAssignedPrincipalId

openAiRoleSearchService
visionRoleSearchService
storageRoleSearchService
storageRoleContributorSearchService

I'm guessing it's failing on:
openAiRoleSearchService
As you likely have the other features disabled?

But they could each have the check.

You don't have an issue in searchmanager when it tries to set up the vectorizer?

[bnodir]

@pamelafox Thanks for the detailed breakdown! I’ve applied the changes and added a note in the docs about the free SKU limitation.

[lsiecker]

@pamelafox Thanks for the detailed breakdown! I’ve applied the changes and added a note in the docs about the free SKU limitation.

Was looking for that note last week, after a long search I discovered that limitation! Good to see your contribution!

[pamelafox]

Thanks @bnodir! Approved and merging.