Azure AI + machine learning built-in role
Search Index Data Contributor
Provides ordinary read-write access to Azure AI Search index documents and knowledge-base retrieval. Separately, its canonical DataActions include elevated read for investigating permission-filtered query results; that elevated-read workflow and query-time ACL enforcement are preview features. The role has no service-management Actions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 8ebe5a00-799e-43f5-93ac-243d3dce84a7
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (2)
Microsoft.Search/searchServices/indexes/documents/*Microsoft.Search/searchServices/indexes/contentSecurity/elevatedOperations/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
By default, assign on the search service to cover all indexes. For direct document upload and query operations, Azure CLI or PowerShell can scope the role to one index; the portal does not support index-level assignment, and indexers are not restricted by per-index user permissions.
Common use cases (2)
- Upload, merge, update, or delete documents and query an approved search index or retrieve from a knowledge base.
- In an approved preview troubleshooting session, add the elevated-read header to compare a user-filtered result set with all documents and investigate incorrect permission-filtered results.
Prerequisites (2)
- Enable role-based access control on the Azure AI Search service and use a Microsoft Entra user, group, service principal, or managed identity.
- For elevated-read investigation, use the documented preview REST API, permission metadata, query-source authorization token, and explicit elevated-read header; ordinary content read-write does not require that preview workflow.
Best practices (3)
- Assign at a single index with CLI or PowerShell when the application directly accesses only that index.
- Use Search Index Data Reader for query-only applications and reserve preview elevated read for time-bounded investigation, not production query traffic.
- Keep ordinary document loading and querying operationally separate from preview permission-filter troubleshooting.
Security considerations (3)
- Ordinary permissions can read, add, change, and delete index documents. The separate preview elevated-read header can return all documents regardless of permission filters and must be restricted to investigators.
- It cannot modify search object definitions or retrieve admin keys, but a separate Search Service Contributor assignment can create indexers that write across indexes.
- Azure RBAC permissions are cumulative, and an inherited service-level assignment cannot be denied by a narrower index assignment.
Assignment guidance
Assign Search Index Data Contributor to the indexing application or developer at the individual index when possible, or at service scope only when all indexes require read-write access. Approve preview elevated-read use as a separate troubleshooting workflow and never as the ordinary query path.
Related roles (2)
- Search Index Data Reader: Read-only data-plane alternative for querying indexes and retrieving from knowledge bases.
- Search Service Contributor: Creates and manages search objects but does not itself grant ordinary document upload or query access.
Common questions
When should I assign the Search Index Data Contributor Azure role?
Assign Search Index Data Contributor when you need to: Upload, merge, update, or delete documents and query an approved search index or retrieve from a knowledge base.; and In an approved preview troubleshooting session, add the elevated-read header to compare a user-filtered result set with all documents and investigate incorrect permission-filtered results.. Practical scope: By default, assign on the search service to cover all indexes. For direct document upload and query operations, Azure CLI or PowerShell can scope the role to one index; the portal does not support index-level assignment, and indexers are not restricted by per-index user permissions.
What permissions does the Search Index Data Contributor Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.Search/searchServices/indexes/documents/*; and Microsoft.Search/searchServices/indexes/contentSecurity/elevatedOperations/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Search Index Data Contributor Azure role?
Key considerations when assigning Search Index Data Contributor: Ordinary permissions can read, add, change, and delete index documents. The separate preview elevated-read header can return all documents regardless of permission filters and must be restricted to investigators.; It cannot modify search object definitions or retrieve admin keys, but a separate Search Service Contributor assignment can create indexers that write across indexes.; and Azure RBAC permissions are cumulative, and an inherited service-level assignment cannot be denied by a narrower index assignment.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (6)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Connect Using Azure Roles - Azure AI Search | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.
- Query-Time ACL and RBAC Enforcement - Azure AI Search | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.