Head-to-head · updated 13 September 2026
DataShield vs Azure AI Search: who decides what the model actually reads?
Azure AI Search is a good retrieval engine, and it is now sold as something bigger. Microsoft calls it Foundry IQ, "a managed knowledge layer that turns enterprise data into reusable, permission-aware knowledge bases for AI agents." Agentic retrieval plans a query with an LLM, fans out subqueries in parallel, reranks them, and hands your agent grounded answers with citations. It reads Blob, ADLS Gen2, SharePoint, OneLake and the open web. If your content and your agents already live in Azure, this is the default, and it is a fair default.
We do a narrower job one layer down. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Embeddings are generated locally by nomic-embed-text, so no chunk of your corpus leaves the box to become a vector. Every governed tool call is re-checked against the agent's current authority before it runs, and every decision is sealed into a hash chain you can verify without trusting us or Microsoft. Below is the honest split, and Azure wins several rows.
The short version
Pick DataShield when
- The PII inside a permitted document is the problem. A filter picks the document. It does not touch the account number on page four.
- Someone will ask you to prove an agent's log was not edited. Not search it. Prove it. Our chain answers with math. Try the verifier.
- You need to pull an agent's authority mid-session and have the very next tool call fail closed, not wait for an index refresh.
- The stack has to run where you say: your own cloud, your own data center, or a single-tenant server we operate for you.
Pick Azure AI Search when
- Your content is in SharePoint, OneLake or ADLS Gen2, and you want retrieval that honours the caller's Entra identity with no permission code of your own.
- You need retrieval quality at scale: Lucene full text, vectors, hybrid, semantic reranking, facets, synonyms, geo and multimodal queries. That is ten years of work and we have not done it.
- Your agents run in Foundry Agent Service or Copilot Studio. One knowledge base plugs straight into them and into Copilot Studio agents.
- Azure is the compliance boundary your auditors already accepted. Certifications, regions and Private Link come with the subscription.
Bottom line: Azure decides which document an agent may see. We decide what the values inside it look like, and we keep proof of what happened next. In an Azure estate, most buyers run both.
Feature by feature
Competitor cells describe what Microsoft's public docs say as of the date above. If we have mischaracterised something, email support@myorg.ai and we will correct it, credited.
| What matters | DataShield | Azure AI Search | Edge |
|---|---|---|---|
| What reaches the model | Sensitive columns are tokenized at ingest. Values that go into a prompt cross a fail-closed egress gate: a PII or PHI column with no configured treatment is redacted, and a PHI dataset refuses an AI endpoint not marked BAA or ZDR approved. | Permission checks decide which documents come back. The text inside a returned document is passed through as indexed. We found nothing in the docs that redacts or tokenizes a value inside a permitted document. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion or truncation. Browser demo. | Azure Monitor logs, metrics and diagnostics, kept under your Azure retention settings. Useful for operations. We found no cryptographic tamper evidence for retrieval activity. | ◆ |
| Agent authorization | Every governed tool call passes a scope ceiling, an authority tier and a revocation re-check before dispatch. The call fails closed. | Query-time trimming against Entra claims and permission metadata stored in the index. Strong for reads. It is not a decision point for what a tool may do. | ◆ |
| Revocation timing | Authority is revalidated on the call itself, so a revoked agent stops on its next tool call. | Their doc is candid: permission changes in the source system "are only reflected in search results after that metadata is synchronized to the index" by an indexer run, a push update or a Purview refresh. SharePoint changes inherited from a parent scope need an explicit refresh. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes and cannot be quietly deleted from the log. | Purview-enabled indexes offer an elevated read for administrative investigations, in preview. Nothing agent-shaped that we could find. | — |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. The audit chain still verifies afterwards. | Delete the document, reindex, and the chunks go with it. That works, and it is a workflow rather than a key you destroy. | ◆ |
| Tokenization | Deterministic, join-preserving, vault-reversible tokens applied at ingest, plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. | None. Sensitivity labels and ACLs gate the document. The raw value stays in the index and in the answer. | ◆ |
| Embeddings | Local nomic-embed-text at 768 dimensions, stored in Postgres pgvector. Your text never leaves the deployment to be vectorized. | Integrated vectorization calls an embedding model in your Azure subscription. It is inside Azure, and it is still a second service reading every chunk. | ◆ |
| Retrieval engine | Hybrid keyword and vector search over pgvector, with a tsvector keyword leg. Solid, plain, and no semantic reranker. | Classic search plus agentic retrieval: LLM query planning, parallel subqueries, L2 semantic reranking, merged answers with citations and an activity log. Far ahead of us on retrieval craft. | ◇ |
| Content sources | Files, URLs with an SSRF guard, and S3-compatible storage, with PDF, DOCX and EML text extraction. No SharePoint, no OneLake. | Blob, ADLS Gen2, Cosmos DB, SharePoint in Microsoft 365, OneLake, plus remote sources queried live, including public web. | ◇ |
| MCP and agents | More than 200 MCP tools across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens with scope ceilings and meters each call against the agent. | A real MCP surface: a knowledge base is queried by the retrieve action or an MCP endpoint, and the knowledge_base_retrieve tool returns per-reference sensitivity label metadata. Retrieval only, and preview at the time we checked. | ◈ |
| Deployment | Self-hosted in your own cloud or data center, or a dedicated single-tenant server we operate. Docker images for Auth, Ontology, Corpus and Lighthouse. Ed25519 audit-signing keys can live in your own KMS or HSM. HMAC tokenization keys sit in your environment today, not in a KMS. | Azure only. It is a fully managed service in your subscription and region. There is no self-hosted, air-gapped or other-cloud edition at any price. | ◆ |
| Pricing | Published model, scoped instant quote, no sales wall. A self-hosted stack still costs you servers and people. | Dedicated tiers billed per Search Unit per hour, or Serverless billed per compute unit hour plus storage. Agentic retrieval bills on retrieval tokens, and Azure OpenAI bills again for planning and synthesis. Microsoft's worked example is $4.32 for 2,000 agentic retrievals, which is cheap. The public page hides the rates behind the calculator. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. | Shipping since 2014, on Azure's certification and region footprint. The newest permission features are preview, which is worth reading closely. | ◇ |
◆ DataShield leads◇ Azure AI Search leads◈ comparable
Azure AI Search claims are drawn from learn.microsoft.com and the Azure pricing page, last checked 13 September 2026. We link them below rather than work from memory.
Three things you get here that you won't get from a managed retrieval service
The value is gone, not gated
A permission filter answers one question: may this caller open this file? Say yes, and the file's contents go to the model as written, member ID and all. Tokenizing at ingest means the identifier is not there to read. The token still joins across datasets, so analysts keep working, and the raw value comes back only through a privileged, audited vault call. How the data plane works.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job. With DataShield the next governed tool call is re-checked against current authority and fails closed. With index-synced permissions, access ends when the metadata catches up, which Microsoft's own doc says is after the next sync. How Auth does it.
Evidence that survives leaving the cloud
Diagnostic logs live in the tenant that produced them. Our chain is portable: rows commit to the row before, checkpoints are signed and chained, and anyone can verify the file years later on a laptop. That portability is the point for EU AI Act Article 12 and HIPAA §164.312(b) reviewers. Run it in your browser, no signup.
Where Azure AI Search is genuinely stronger
Retrieval, first. Ten years of Lucene work, vectors, hybrid queries, facets, synonyms, geo-search and an L2 semantic reranker add up to something we have not built and are not pretending to. Agentic retrieval is a smart design: an LLM writes subqueries, they run in parallel across knowledge sources, results are reranked and merged, and you get citations plus an activity log showing what was asked. Add the connectors and it gets harder to argue with. SharePoint, OneLake, ADLS Gen2, Cosmos DB and live remote sources, with ACLs and Purview sensitivity labels carried into the index so the caller's Entra token trims results without a line of permission code. Their own list of benefits is honest and correct. If your content is Microsoft content, this saves you months.
The push-back is narrow. Their permission model is about documents, and ours is about values and actions. Once a document clears the check, its contents are grounding data like any other, so the salary column or the MRN in that PDF reaches the model intact. And the checks run on a copy of the permissions, not the live ones. Microsoft writes that permission changes in the source system are reflected only after that metadata is synchronized to the index, and that SharePoint changes inherited from a parent scope need an explicit refresh. For a search box, that lag is fine. For an agent acting on behalf of someone who was deactivated an hour ago, it is the whole question. We also cannot host ourselves out of the biggest limit: Azure AI Search runs on Azure and nowhere else, so a residency or air-gap rule ends the conversation before pricing starts.
Questions worth asking both of us
These are the questions we would want answered if we were the ones buying. Ask them on every call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification tells deletion apart from truncation and from tampering. Try it against a sample chain at /verify. Azure AI Search: logs and metrics flow to Azure Monitor under your retention settings. We found no tamper-evidence mechanism for them. Ask Microsoft to show one.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation lands on the next call. Azure trims results using permission metadata copied into the index, and their doc says changes are reflected only after that metadata is synchronized. Ask how long the gap is for your sources, and whether a parent-scope change in SharePoint needs a manual refresh.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt. Actor identities in the chain are HMAC-committed, so the evidence still verifies once the subject is gone. In Azure you delete the source document and reindex, which removes the chunks. Ask what happens to vectors and cached answers, and who signs off that the deletion ran.
We use agentic retrieval for permission-aware RAG. Doesn't that already solve PII?
It solves a different half. Permission-aware means the caller only gets documents they may open. It does not mean the values inside those documents are treated before an LLM sees them. Ask Microsoft directly: once a document passes the filter, is the PHI inside it sent to the model verbatim? On our side the answer is that governed dataset columns are tokenized at ingest and a fail-closed gate covers anything heading into a prompt. One honest caveat: our document free text is indexed close to raw, apart from a standing sensitive-pattern chunk filter, so column-level governance is our strong half.
Is this an Azure AI Search alternative, or something you run next to it?
Next to it, in nine cases out of ten. Keep Azure for SharePoint and OneLake retrieval, where nothing else comes close. Run us for the governed datasets agents query, for local embeddings when a corpus cannot be vectorized by a service, and for the evidence your regulator will ask for. The tenth case is a hard one: residency, air gap or non-Azure hosting, where Azure AI Search simply cannot be deployed.
Does DataShield have SOC 2?
Not yet, and we will not imply otherwise. Auth is live with a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow, so a small vendor is not a single point of failure. Details on the security page.
- Microsoft's own category line: Foundry IQ is "a managed knowledge layer that turns enterprise data into reusable, permission-aware knowledge bases for AI agents," with Azure AI Search providing "the underlying indexing and retrieval infrastructure." — Microsoft Learn, doc dated 31 Jul 2026
- Permission enforcement runs on metadata copied into the index: "Permission changes in the source system ... are only reflected in search results after that metadata is synchronized to the index through the source-specific mechanism, for example, a subsequent indexer run, a push-API update, or a Purview-driven refresh." SharePoint changes inherited from a parent scope "require an explicit refresh." — Microsoft Learn, doc dated 8 Aug 2026
- Agentic retrieval bills from two services: Azure AI Search for retrieval tokens and Azure OpenAI for query planning and answer synthesis. Microsoft's worked example totals $4.32 for 2,000 agentic retrievals at three subqueries each. — Microsoft Learn, doc dated 2 Jun 2026
- Azure AI Search is "a fully managed, cloud-hosted service." Serverless Developer is preview, has no SLA, does not support migration to or from other tiers, and billing for it began on 13 September 2026. — Microsoft Learn, doc dated 5 Aug 2026
- Security trimming is the generally available path for non-Microsoft identity models: the caller's identity is passed as a filter string and results that fail the match are excluded. — Microsoft Learn, security filters guidance, checked 13 Sep 2026
- Dedicated tiers are billed per Search Unit per hour and Serverless per compute unit hour plus storage. The public pricing page renders the rates as placeholders until you open the region-specific calculator. — Azure pricing, checked 13 Sep 2026
Other head-to-heads
DataShield vs Cortex Search
DataShield vs Snowflake Cortex Search: Cortex Search is fast managed RAG inside Snowflake. We add tokens.
Same marketDataShield vs Bedrock Knowledge Bases
DataShield vs Bedrock Knowledge Bases: AWS runs managed RAG well. DataShield tokenizes before indexing,.
Same marketDataShield vs Databricks Mosaic AI
DataShield vs Databricks Mosaic AI: Agent Bricks and AI Search win retrieval scale and agent tuning. We.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run in your browser: break a live audit chain, revoke an agent mid-session, then ask what your retrieval layer still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →