Azure AI + machine learning built-in role
Search Index Data Reader
Provides read-only Azure AI Search content access for search, lookup, autocomplete, suggestions, and knowledge-base retrieval. The imported definition contains one document-read DataAction and no service-management Actions.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 1407120a-92aa-4202-b7e9-c0e197c71c8f
Control-plane actions (0)
None — this role grants no control-plane management actions.
Data-plane actions (1)
Microsoft.Search/searchServices/indexes/documents/read
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the search service for all indexes or use Azure CLI or PowerShell to assign on one index. The portal does not support index-level assignments; broader inherited assignments remain cumulative.
Common use cases (2)
- Allow an application or user to query an approved index without loading or modifying documents.
- Retrieve from an approved Azure AI Search knowledge base with Microsoft Entra authorization.
Prerequisites (2)
- Enable role-based access control on the Azure AI Search service and configure the application for Microsoft Entra token authentication.
- The index or knowledge base must already exist and contain the content the principal is authorized to retrieve.
Best practices (3)
- Assign at a single index with CLI or PowerShell when the caller should not query every index on the service.
- Use this role instead of Data Contributor for query-only applications.
- Apply document-level access control when users share an index but should receive different result sets.
Security considerations (3)
- The DataAction exposes every document available at the assigned index or service scope unless document-level controls further filter results.
- The role cannot load documents, change object definitions, retrieve admin keys, or use the Data Contributor elevated-read operation.
- A broader inherited role remains effective and cannot be denied by a narrower index assignment.
Assignment guidance
Assign Search Index Data Reader to the query or retrieval identity at the individual index when possible, or at service scope only when it may read all indexes. Add Data Contributor only for document writes and Service Contributor only for object administration.
Related roles (2)
- Search Index Data Contributor: Adds document writes, deletes, and elevated read for investigation.
- Search Service Contributor: Manages the search service and object definitions without ordinary document query access.
Common questions
When should I assign the Search Index Data Reader Azure role?
Assign Search Index Data Reader when you need to: Allow an application or user to query an approved index without loading or modifying documents.; and Retrieve from an approved Azure AI Search knowledge base with Microsoft Entra authorization.. Practical scope: Assign on the search service for all indexes or use Azure CLI or PowerShell to assign on one index. The portal does not support index-level assignments; broader inherited assignments remain cumulative.
What permissions does the Search Index Data Reader Azure role grant?
The role definition grants 1 combined control-plane and data-plane actions. Representative operations include: Microsoft.Search/searchServices/indexes/documents/read. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Search Index Data Reader Azure role?
Key considerations when assigning Search Index Data Reader: The DataAction exposes every document available at the assigned index or service scope unless document-level controls further filter results.; The role cannot load documents, change object definitions, retrieve admin keys, or use the Data Contributor elevated-read operation.; and A broader inherited role remains effective and cannot be denied by a narrower index assignment.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Connect Using Azure Roles - Azure AI Search | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.