Foundry Agent Service: Azure AI Search tool returns "Access denied" with keyless (Entra ID) connection, despite documented RBAC

Hi all,

We're trying to use the built-in Azure AI Search tool on a Foundry prompt agent with keyless (Microsoft Entra ID) auth. Every tool call fails with:

400 tool_user_error: "Access denied. Check your permissions or managed identity access to the search service."

Setup

• Foundry account (new Foundry, Canada East), one project, gpt-4o deployment
• Account identity: system-assigned + user-assigned (the system-assigned one was added specifically for this)
• Azure AI Search: Basic, Canada Central, public network access, no private endpoint, no IP rules, auth mode "Role-based access control and API keys"
• Project connection: category CognitiveSearch, authType AAD, created via ARM REST
• Agent: prompt agent with a single azure_ai_search tool
• SDK: azure-ai-projects 2.4.0 (Python)

The index is populated, and we can query it directly with our own Entra ID token, so the search service and index themselves are fine.

What we've tried

1. Account system-assigned identity: Search Index Data Contributor + Search Service Contributor on the search service (as the "Connect an Azure AI Search index to Foundry agents" doc describes): Access denied
2. Project managed identity: Search Index Data Reader at index scope, then at service scope, then with Search Service Contributor added: Access denied
3. Agent instance identity: Search Index Data Reader at index scope: Access denied
4. Account user-assigned identity: Search Index Data Reader (index scope) + Search Service Contributor: worked exactly once (returned results with url_citation annotations), then failed with Access denied ever since, including after recreating the connection and the agent version

Questions

1. Which identity does the Azure AI Search tool use when the project connection's authType is AAD: the project managed identity, the account's system-assigned identity, the account's user-assigned identity, or the agent identity? The docs say "account system-assigned" in the setup steps and "project managed identity" in the troubleshooting table.
2. What are the minimum roles, and at which scope (service or index)?
3. Is a user-assigned identity on the Foundry account supported for this tool? If both are supported, is there any material difference between using the account's system-assigned identity and a user-assigned one here (behaviour, supported scenarios, or roadmap)?
4. Is authType "AAD" the right value for a keyless CognitiveSearch connection, or does the tool expect a different value (e.g. a project-managed-identity type)?

Thanks!