Azure AI + machine learning built-in role
Search Service Contributor
Provides full Azure AI Search service administration and search-object management, including indexes, indexers, data sources, skillsets, aliases, synonym maps, debug sessions, knowledge bases, authentication, networking, and admin keys. The imported role definition records its wildcard as control-plane Actions and no DataActions, while Search documentation describes the resulting endpoint object-management capability separately from document content access.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 7ca78c08-252a-4471-8644-bb5ff32d4ba0
Control-plane actions (7)
Microsoft.Authorization/*/readMicrosoft.Insights/alertRules/*Microsoft.ResourceHealth/availabilityStatuses/readMicrosoft.Resources/deployments/*Microsoft.Resources/subscriptions/resourceGroups/readMicrosoft.Search/searchServices/*Microsoft.Support/*
Data-plane actions (0)
None — this role grants no data-plane (data access) actions.
Excluded actions (0)
None
Assignable scopes (1)
/
Practical scope
Assign on the individual Azure AI Search service. A resource-group or subscription assignment is inherited by every search service below the scope and extends service, object, key, authentication, and network administration to all of them.
Common use cases (2)
- Create and configure a search service and create, run, or manage indexes, indexers, data sources, skillsets, knowledge bases, and other search objects.
- Configure service authentication, network security, private connections, quotas, and service administration without directly granting ordinary document upload or query access.
Prerequisites (2)
- An Azure AI Search service must exist or the principal must be responsible for creating and configuring it.
- Assign Search Index Data Contributor and Search Index Data Reader separately when the same developer must load and query documents.
Best practices (3)
- Limit this role to trusted search administrators and assign directly on the service.
- Keep document loading and querying on the data roles, and use Reader for control-plane inspection without service changes.
- Use separate search services for strict index isolation because a Service Contributor can create indexers that write to any index on the service.
Security considerations (3)
- The role can retrieve and regenerate admin keys, change authentication and network settings, and create indexers that write to indexes across the service.
- It does not directly grant ordinary document upload, query, or knowledge-base retrieval through DataActions, but admin keys provide a separate full data-plane credential path.
- A parent-scope assignment grants high-impact administration across multiple inherited search services.
Assignment guidance
Assign Search Service Contributor on the individual search service to administrators or development automation that manage service configuration and search objects. Add the two Search Index Data roles only when document loading and querying are also required, and protect admin-key access.
Related roles (3)
- Search Index Data Contributor: Adds read-write index-content access and elevated read but not search object administration.
- Search Index Data Reader: Adds read-only index query and knowledge-base retrieval.
- Reader: Read-only control-plane alternative for service properties, metrics, object definitions, roles, and policies without admin keys or changes.
Common questions
When should I assign the Search Service Contributor Azure role?
Assign Search Service Contributor when you need to: Create and configure a search service and create, run, or manage indexes, indexers, data sources, skillsets, knowledge bases, and other search objects.; and Configure service authentication, network security, private connections, quotas, and service administration without directly granting ordinary document upload or query access.. Practical scope: Assign on the individual Azure AI Search service. A resource-group or subscription assignment is inherited by every search service below the scope and extends service, object, key, authentication, and network administration to all of them.
What permissions does the Search Service Contributor Azure role grant?
The role definition grants 7 combined control-plane and data-plane actions. Representative operations include: Microsoft.Authorization/*/read; Microsoft.Insights/alertRules/*; Microsoft.ResourceHealth/availabilityStatuses/read; Microsoft.Resources/deployments/*; Microsoft.Resources/subscriptions/resourceGroups/read; and Microsoft.Search/searchServices/*. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Search Service Contributor Azure role?
Key considerations when assigning Search Service Contributor: The role can retrieve and regenerate admin keys, change authentication and network settings, and create indexers that write to indexes across the service.; It does not directly grant ordinary document upload, query, or knowledge-base retrieval through DataActions, but admin keys provide a separate full data-plane credential path.; and A parent-scope assignment grants high-impact administration across multiple inherited search services.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for AI + machine learning - Azure RBAC | Microsoft Learn →
Supports: Description, Practical scope, Security considerations. Retrieved 2026-07-17.
- Steps to assign an Azure role - Azure RBAC | Microsoft Learn →
Supports: Prerequisites, Assignment guidance. Retrieved 2026-07-17.
- Understand scope for Azure RBAC | Microsoft Learn →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-17.
- Best practices for Azure RBAC | Microsoft Learn →
Supports: Best practices, Assignment guidance. Retrieved 2026-07-17.
- Connect Using Azure Roles - Azure AI Search | Microsoft Learn →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-17.