Azure Databases built-in role

Semantic Reranker User

Runs Semantic Reranker queries against a registered inference account. It reads the inference account in the control plane and invokes the reranker through a DataAction, but cannot create, update, delete, enable, or disable the inference account.

Control-plane actions (1)

• Microsoft.InferenceService/inferenceAccounts/read

Data-plane actions (1)

• Microsoft.InferenceService/inferenceAccounts/invoke/semanticReranker/action

Excluded actions (2)

• Microsoft.InferenceService/inferenceAccounts/write
• Microsoft.InferenceService/inferenceAccounts/delete

Assignable scopes (1)

• /

Practical scope

Assign on the Azure Cosmos DB account whose Semantic Reranker runtime the identity calls. A resource-group assignment is inherited by every eligible account in that group. This role authorizes reranker invocation only; Cosmos DB item reads use separate native data-plane permissions.

Common use cases (2)

• Allow an application, managed identity, service principal, or user to rerank query results returned from an Azure Cosmos DB for NoSQL container.
• Separate runtime reranker calls from feature enablement and inference-account administration.

Prerequisites (3)

• Semantic Reranker must be enabled for the Azure Cosmos DB account and the Microsoft.InferenceService provider might need registration while the feature is in preview.
• If the caller queries Cosmos DB with Microsoft Entra ID before reranking, also assign native Cosmos DB data-plane permission to read the source items.
• Use a supported Azure Cosmos DB SDK and provide the query results and user search phrase required by the reranking workflow.

Best practices (3)

• Assign this runtime-only role to the application identity on the individual Cosmos DB account instead of using Inference Account Owner.
• Grant the separate Cosmos DB item-read role only on the source data scope the application queries.
• Treat the feature as preview, measure request volume and cost, and review access and feature behavior before production expansion.

Security considerations (3)

• The DataAction permits real inference execution and can process query-result content and incur service usage even though account writes are excluded.
• The role does not grant Cosmos DB item reads; combining it with a native data-plane role determines which source data the caller can retrieve and rerank.
• A parent-scope assignment can authorize runtime calls against multiple inherited accounts.

Assignment guidance

Assign Semantic Reranker User to the runtime caller on the individual Azure Cosmos DB account. Add a separate Cosmos DB Built-in Data Reader or narrower native role for source-item reads, and reserve Inference Account Operator or Owner for principals that enable or administer the feature.

Related roles (3)

• Inference Account Operator: Enables or disables Semantic Reranker but does not allow runtime reranker calls.
• Inference Account Owner: Combines Semantic Reranker configuration with runtime calls and is broader than the runtime-only User role.
• Cosmos DB Built-in Data Reader: Separate native Cosmos DB data-plane role needed when the runtime identity must read source items before reranking.

Editorial sources (5)

• Azure built-in roles for Databases →

  Supports: Description, Security considerations. Retrieved 2026-07-16.

• Understand scope for Azure RBAC →

  Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.

• Best practices for Azure RBAC →

  Supports: Best practices. Retrieved 2026-07-16.

• Semantic Reranker in Azure Cosmos DB for NoSQL →

  Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

• Connect to Azure Cosmos DB for NoSQL using role-based access control and Microsoft Entra ID →

  Supports: Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.

Official Microsoft Learn documentation →