Head-to-head · updated 13 September 2026
DataShield vs Azure AI Search: who decides what the model actually reads?
Azure AI Search is a good search engine. It's now sold as a bigger thing, too. Microsoft calls it Foundry IQ. Their words: "a managed knowledge layer that turns enterprise data into reusable, permission-aware knowledge bases for AI agents." Agentic retrieval plans a query with an LLM. It fans out subqueries at once. Then it reranks them. Your agent gets grounded answers back, with sources. It reads Blob, ADLS Gen2, SharePoint and OneLake. Plus the open web. Do your content and agents live in Azure now? Then this is the default. A fair one, too.
We do a narrower job, one layer down. We tokenize datasets at ingest. Agents query tokenized data over MCP. Turning a token back into real data. That's a privileged step. It's audited each time. nomic-embed-text generates embeddings locally. No chunk of your corpus leaves the box. It becomes a vector, right there. We re-check each checked tool call. Against the agent's current access, before it runs. We seal each decision into a hash chain. You can verify it without trusting us, or Microsoft. Here's the honest split. Azure wins several rows.
The short version
Pick DataShield when
- The PII inside a permitted file is the problem. A filter picks the document. It does not touch the account number. Not on page four.
- Someone will ask you to prove an agent's log was not edited. Not search it. Prove it. Our chain answers with math. Not a promise. Try the verifier.
- You need to pull an agent's access mid-session. The very next tool call should fail closed. It shouldn't wait for an index refresh.
- The stack has to run where you say. Your own cloud, your call. Your own data center, too. Or a single-tenant server we run for you.
Pick Azure AI Search when
- Your content is in SharePoint, OneLake or ADLS Gen2. You want search that honours the caller's Entra identity. No access code of your own. None needed.
- You need retrieval quality at scale. Think Lucene full text, vectors, hybrid, semantic reranking. Facets, synonyms, geo, multimodal queries, too. That's ten years of work. We haven't done it.
- Your agents run in Foundry Agent Service or Copilot Studio. One knowledge base plugs straight into them. Copilot Studio agents, too.
- Azure is the compliance boundary your auditors accepted. Certifications, regions and Private Link come with the subscription. Already built in.
Bottom line: Azure decides which file an agent may see. We decide what the values inside it look like. We keep proof of what happened next, too. In an Azure estate? Most buyers run both.
Feature by feature
Competitor cells describe what Microsoft's public docs say. As of the date above. Did we get a fact wrong? Email support@myorg.ai. We'll correct it, and credit you.
| What matters | DataShield | Azure AI Search | Edge |
|---|---|---|---|
| What reaches the model | We tokenize sensitive columns at ingest. Values headed into a prompt cross a gate. A fail-closed gate, always. We redact any PII or PHI column. Any with no configured rule. A PHI dataset refuses any AI endpoint. Unless it's marked BAA or ZDR approved. | Access checks decide which files come back. Azure passes through the text inside a returned file. As indexed. We found nothing in the docs about it. No redaction, no tokenizing, inside a permitted file. | ◆ |
| Audit evidence | SHA-256 hash chain with Ed25519-signed checkpoints. The checkpoints are themselves chained. Verification names the failure. Tampering, insertion, deletion or truncation. Browser demo. | Azure Monitor logs, metrics and diagnostics. Kept under your Azure retention settings. Useful for operations. We found no math-backed tamper proof for search activity. | ◆ |
| Agent authorization | Every checked tool call passes a scope ceiling. It also passes an access tier. Plus a re-check, before dispatch. The call fails closed. | Query-time trimming. It runs against Entra claims. And access metadata stored in the index. Strong for reads. Not a decision point. Not for what a tool may do. | ◆ |
| Revocation timing | We recheck access on the call itself. A revoked agent stops on its next tool call. | Their doc is candid about the lag. Permission changes in the source system "are only reflected in search results after that metadata is synchronized to the index." That happens by an indexer run, a push update or a Purview refresh. SharePoint changes passed down from a parent scope need a manual refresh, too. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents. It auto-revokes on its own. It can't be quietly deleted from the log. | Purview-enabled indexes offer an elevated read. For admin investigations. Still in preview. Nothing agent-shaped that we could find. | n/a |
| GDPR erasure | Crypto-shred of per-subject key material. Plus ISO 27560 consent receipts too. The audit chain still verifies afterwards. | Delete the file, reindex. The chunks go with it. That works. It's a workflow though, not a key you destroy. | ◆ |
| Tokenization | Deterministic, join-preserving, vault-reversible tokens. Applied at ingest, across data sets. Plus quasi-identifier generalization. Dates become year, decade or age band. ZIPs become 3 or 4 digits. Phones, SSNs and emails get partial masking too. Each column gets a measured score. | None. Sensitivity labels and ACLs gate the file instead. The raw value stays in the index. And in the answer. | ◆ |
| Embeddings | Local nomic-embed-text, at 768 dimensions. Stored in Postgres pgvector. Your text never leaves the deployment. It gets vectorized right there. | Integrated vectorization calls an embedding model. One in your Azure subscription. It's inside Azure, true. But it's still a second service. One that reads every chunk. | ◆ |
| Retrieval engine | Hybrid keyword and vector search, over pgvector. With a tsvector keyword leg, too. Solid, plain, and no semantic reranker. | Classic search, plus agentic retrieval. LLM query planning, parallel subqueries, L2 semantic reranking. Merged answers with sources, and an action log. That's far ahead of us on search craft. | ◇ |
| Content sources | Files, and URLs with an SSRF guard. Plus S3-compatible storage. Plus PDF, DOCX and EML text extraction. No SharePoint. No OneLake either. | Blob, ADLS Gen2, Cosmos DB. SharePoint in Microsoft 365, OneLake. Plus remote sources, queried live. Public web too. | ◇ |
| MCP and agents | More than 200 MCP tools. Across Ontology, Auth, Corpus and Lighthouse. Auth issues MCP tool tokens, with scope ceilings. It meters each call against the agent, too. | A real MCP surface. The retrieve action, or an MCP endpoint. Either queries a knowledge base. The knowledge_base_retrieve tool returns sensitivity label metadata. Per reference. Retrieval only. Still preview, at the time we checked. | ◈ |
| Deployment | Self-hosted. In your own cloud or data center, your call. Or a dedicated single-tenant server. One we run for you. Docker images cover Auth, Ontology, Corpus and Lighthouse. Ed25519 audit-signing keys stay on your instance. They sit in a key directory you control. Kid-keyed rotation fails closed on an unknown key. KMS custody is a built seam in Auth. So is HSM custody. Not a shipped integration. HMAC tokenization keys sit in your environment today. Not in a KMS. | Azure only. It's a fully hosted service. In your subscription and region. No self-hosted edition. No air-gapped or other-cloud edition, at any price. | ◆ |
| Pricing | Published model, a scoped instant quote, no sales wall. A self-hosted stack still costs you something. Servers and people. | Dedicated tiers, billed per Search Unit. Per hour. Or Serverless, billed per compute unit hour plus storage. Agentic retrieval bills on retrieval tokens. Azure OpenAI bills again, for planning and synthesis. Microsoft's sample: $4.32, for 2,000 agentic retrievals. That's cheap. The public page hides the rates. Behind the calculator, though. | ◈ |
| Maturity signals | Auth, Guardian and Lighthouse are all live now. Guardian and Lighthouse have run since April 2026. SOC 2 isn't certified yet. We say so plainly. | Shipping since 2014. On Azure's certification and region footprint. The newest access features are still preview. Worth reading closely. | ◇ |
◆ DataShield leads◇ Azure AI Search leads◈ comparable
We draw Azure AI Search claims from one place. Just learn.microsoft.com. Also the Azure pricing page. Last checked 13 September 2026. We link them below. Not just a paraphrase from memory.
Three things you get here that you won't get from a managed retrieval service
The value is gone, not gated
A permission filter answers one question. May this caller open this file? Say yes. The whole file goes to the model. As written. Member ID and all. Tokenizing at ingest removes the identifier. It isn't there to read. The token still joins across data sets. Analysts keep working. The raw value comes back only one way. Through a privileged, audited vault call. How the data plane works.
Authority that can change mid-flight
An analyst leaves on a Friday. Their agent is 20 minutes into a 40-minute job, unaware. DataShield re-checks the next checked tool call. Against current access, right then. It fails closed. With rules synced to the index, access ends late. Only when the metadata catches up. Microsoft's own doc says that's after the next sync. How Auth does it.
Evidence that survives leaving the cloud
Logs live in the tenant that produced them. Our chain is portable instead. Each row commits to the row before it. We sign and chain checkpoints. Anyone can verify the file years later. Right on a laptop. Two rules care about that portability most. EU AI Act Article 12. HIPAA §164.312(b). Run it in your browser, no signup.
Where Azure AI Search is genuinely stronger
Retrieval, first. Ten years of Lucene work. Vectors, hybrid queries, facets, synonyms, geo-search. Plus an L2 semantic reranker. That adds up to a thing we haven't built. We're not pretending otherwise. Agentic retrieval is a smart design. An LLM writes subqueries. They run at once, across knowledge sources. The engine reranks and merges results. You get sources back, plus an action log. It shows what was asked. Add the connectors. It gets harder to argue with. SharePoint, OneLake, ADLS Gen2, Cosmos DB. Live remote sources, too. ACLs and Purview sensitivity labels carry into the index. The caller's Entra token trims results. No access code of your own, needed. Their own list of benefits is honest and correct. If your content is Microsoft content, it saves you months.
The push-back is narrow, in one line. Their access model is about files. Ours is about values and actions. Once a file clears the check: its contents become grounding data. Plain data, like any other. The salary column, or the MRN in that PDF. It reaches the model intact. And the checks run on a copy. A copy of the access rules. Not the live ones. Microsoft writes it plain. Permission changes in the source system show up late. Only after that metadata syncs to the index. SharePoint changes passed down from a parent scope need a manual refresh, too. For a search box, that lag is fine. For an agent? One acting for someone. Deactivated an hour ago? That's the whole question. We also can't host our way out. Not past the biggest limit. Azure AI Search runs on Azure, and nowhere else. A residency or air-gap rule ends the conversation. Before pricing even starts.
Questions worth asking both of us
These are the questions we'd want answered. If we were buying. Ask them on each call, ours included.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes, it can. Each record commits to the one right before it. We sign and chain each checkpoint. Verification tells deletion from truncation. From tampering, too. Each time. Try it against a sample chain at /verify. Azure AI Search: logs and metrics flow. Straight to Azure Monitor. Under your retention settings. We found no tamper-evidence step for them. Ask Microsoft to show one.
What happens to a revoked agent mid-session?
DataShield re-checks access on each checked tool call, always. A pulled grant bites on the next call. No delay. Azure trims results using access data. Copied into the index. Their doc says changes show up late. Only after that metadata syncs. Ask how long the gap is, for your sources. Ask, too: does a parent-scope change in SharePoint need a manual refresh?
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds the subject's key material. Then it issues an ISO 27560 consent receipt. Actor identities in the chain carry HMAC commitments, not names. The proof still checks out, long after the subject leaves. In Azure, you delete the source file. Then reindex. That removes the chunks. Ask what happens to vectors and cached answers. Ask, too, who signs off that the deletion ran.
We use agentic retrieval for permission-aware RAG. Doesn't that already solve PII?
It solves a different half. Permission-aware means the caller only gets files they may open. It doesn't mean the values inside get treatment. Not before an LLM sees them. Ask Microsoft directly. Once a file passes the filter. Is the PHI inside it sent to the model? Verbatim? On our side, we tokenize checked data set columns. At ingest. A fail-closed gate covers anything heading into a prompt. One honest caveat, though. We index our file free text close to raw. One exception: a standing sensitive-pattern chunk filter. Column-level rules are our strong half.
Is this an Azure AI Search alternative, or something you run next to it?
Next to it, in nine cases out of ten. Keep Azure for SharePoint and OneLake search. Nothing else comes close there. Run us for the checked data sets agents query. Run us, too, for local embeddings. Use them when a service can't vectorize your corpus. Run us for the evidence your regulator will ask for. The tenth case is a hard one. Residency, air gap, non-Azure hosting. You simply can't deploy Azure AI Search there.
Does DataShield have SOC 2?
Not yet. We won't imply otherwise, ever. Auth is live now. It ships with a public threat model. And a verifier anyone can run. Guardian and Lighthouse have both been live since April 2026. Design-partner terms include source escrow. That way, a small vendor stays safe. Never a single point of failure. Details on the security page.
- Microsoft's own category line. Foundry IQ is "a managed knowledge layer that turns enterprise data into reusable, permission-aware knowledge bases for AI agents," with Azure AI Search providing "the underlying indexing and retrieval infrastructure." That's their framing. - Microsoft Learn, doc dated 31 Jul 2026
- Permission enforcement runs on metadata copied into the index. Quoting the doc: "Permission changes in the source system ... are only reflected in search results after that metadata is synchronized to the index through the source-specific mechanism, for example, a subsequent indexer run, a push-API update, or a Purview-driven refresh." SharePoint changes inherited from a parent scope "require an explicit refresh." That's the documented lag. - Microsoft Learn, doc dated 8 Aug 2026
- Agentic retrieval bills from two services. Azure AI Search bills for retrieval tokens. Azure OpenAI bills for query planning and answer synthesis. Microsoft's worked example totals $4.32. That's for 2,000 agentic retrievals, at three subqueries each. - Microsoft Learn, doc dated 2 Jun 2026
- Azure AI Search is "a fully managed, cloud-hosted service." Their words. Serverless Developer is preview. It has no SLA. It doesn't support migration to or from other tiers. Billing for it began on 13 September 2026. - Microsoft Learn, doc dated 5 Aug 2026
- Security trimming is the standard path. For non-Microsoft identity models. The caller's identity is passed as a filter string. Results that fail the match get excluded. - Microsoft Learn, security filters guidance, checked 13 Sep 2026
- Dedicated tiers are billed per Search Unit per hour. Serverless, per compute unit hour plus storage. The public pricing page renders the rates as placeholders. That's until you open the region-specific calculator. - Azure pricing, checked 13 Sep 2026
Other head-to-heads
DataShield vs Cortex Search
DataShield vs Snowflake Cortex Search: Cortex Search is fast. Hosted RAG, inside Snowflake. We add tokens.
Same marketDataShield vs Bedrock Knowledge Bases
DataShield vs Bedrock Knowledge Bases: AWS runs hosted RAG well. DataShield tokenizes before indexing,.
Same marketDataShield vs Databricks Mosaic AI
DataShield vs Databricks Mosaic AI: Agent Bricks wins tuning. AI Search wins search scale. And agent tuning. We.
AllEvery comparison
One honest scorecard per vendor.
See both mechanisms run, right in your browser. Break a live audit chain. Revoke an agent mid-session. Then ask what your search layer still owes you. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →