Add Web Search with Citations to an Agent

Lab overview

Give the agent a way to check current information. In this lab, you ask about the latest Windows 11 update and see the agent answer from training data with no source, then enable the Web search tool, read the cost and compliance-boundary notice that comes with it, and update the agent's instructions to say when the web may be used. You test that the Windows question now comes back with a citation, and that a Contoso policy question still stays inside Azure.

Why you'd do this

A grounded agent is only as current as the documents behind it. Ask it about this month's Windows feature update and it has two bad options: say the documents don't cover it, or answer from training data that is months out of date and present it as fact. The baseline at the start of this lab shows the second one, and it's the more dangerous failure because the answer sounds fine. Web search gives the agent a third option: look it up, and show where it looked.

You removed Web search in labs 5 and 6 for a reason, and the notice you'll read when you turn it back on explains why it's not a default. Grounding with Bing is billed separately per query, and more importantly, the text of a query leaves the Azure compliance boundary. For a help desk assistant that also knows about Project Falcon and internal password policy, that's a real risk: without guidance, the agent could send a user's internal question to a public search engine. That's why enabling the tool and scoping it are done together in this lab, never one without the other.

The instruction update is the scoping. It tells the agent exactly when the web is allowed (current Microsoft releases and service issues), to cite what it finds, and never to include Contoso information in a search. The two tests afterward are the proof: the Windows question comes back with a citation and a Web search label under the response, and the password question comes back with neither, because the agent answered it from the policy documents. Reading those labels is how you audit which tool answered, and it's a habit worth keeping once agents have several tools.

Saving produces version 3 of the agent. For certification prep, this is agent tools and grounding in AI-103, and the responsible AI and data-boundary considerations that run through both AI-901 and AI-103.

Lab details

• Agent: contoso-helpdesk-agent, version 3
• Tool Added: Web search (Grounding with Bing)
• Instruction Change: web search allowed for current Microsoft releases and service issues only; no Contoso confidential information
• Test Prompts: latest Windows 11 feature update, password expiration policy
• Verification: Web search label and citation on the Windows answer; none on the policy answer

Learning objectives

1. Explain why an uncited answer about current events can't be trusted.
2. Enable the Web search tool and describe its cost and data-boundary implications.
3. Update agent instructions to scope when web search may be used.
4. Verify which tool answered a question and confirm internal questions stay internal.

Exam relevance

• AI-901 — Microsoft Azure AI Fundamentals — AI agents and their components, grounding with your own data.
• AI-103 — Developing AI Apps and Agents on Azure — create a prompt agent in Foundry Agent Service, agent instructions, tools, and versions.

How this lab fits into the project

This is lab 8 of 12 in the Contoso Knowledge Assistant project. Contoso's IT help desk fields the same policy questions all day, so over this series you'll build an AI agent that answers them from the company's own documents, then ground it, secure it, evaluate it, monitor it, and publish it to Teams. This lab adds the agent's third and last knowledge path, the public web, and the instructions that keep it from being used for anything internal.

Step-by-step instructions

1. Show the gap and get a baseline:
   • In the Foundry portal, click Build, then click contoso-helpdesk-agent on the Agents page.
   • In the chat box, type What is Contoso's password expiration policy? and click send.
   • Note the answer of 120 days.
   • Click the new chat icon, type What is the latest Windows 11 feature update, and when was it released?, and click send.
   • Note that the agent answers from its training data, with no citation and no tool used.
2. Add the Web search tool:
   • In the Tools section, click Add.
   • Click the Web search toggle to turn it on.
   • Note the notice that Web search uses Grounding with Bing, which has additional costs.
   • Also note that customer data will flow outside the Azure compliance boundary.
   • Note that Web search now appears in the Tools section alongside File search.
3. Update the instructions:
   • Click the Online Notepad browser tab, press Ctrl+A, then Ctrl+C.
   • Click the Microsoft Foundry browser tab.
   • Scroll to the bottom of the Instructions field and click inside it.
   • Press Ctrl+V to paste the updated instructions, which add: For questions about current Microsoft product releases or service issues, use web search and cite your sources. Never include Contoso confidential information in a web search.
   • Click Save and note that the agent is now on version 3.
4. Test web search:
   • Click the new chat icon, type What is the latest Windows 11 feature update, and when was it released?, and click send.
   • Note that the agent now answers with current information.
   • Note the citation under the answer and the Web search label under the response, showing which tool was used.
5. Confirm policy questions stay internal:
   • Click the new chat icon, type What is Contoso's password expiration policy?, and click send.
   • Note that the agent still answers 120 days from the policy documents.
   • Note that there is no Web search label under this response.
   • Click Microsoft Foundry in the upper left to return to the home page.