Azure Databases built-in role
Semantic Reranker User
Runs Semantic Reranker queries against a registered inference account. It reads the inference account in the control plane and invokes the reranker through a DataAction, but cannot create, update, delete, enable, or disable the inference account.
Role-definition permissions are imported from Microsoft Learn. Practical scope, use cases, prerequisites, best practices, security considerations, assignment guidance, and relationships have been reviewed against the official sources below.
Role definition ID: 6c74a7c5-4a87-40f9-bb03-61e49aecbc78
Control-plane actions (1)
Microsoft.InferenceService/inferenceAccounts/read
Data-plane actions (1)
Microsoft.InferenceService/inferenceAccounts/invoke/semanticReranker/action
Excluded actions (2)
Microsoft.InferenceService/inferenceAccounts/writeMicrosoft.InferenceService/inferenceAccounts/delete
Assignable scopes (1)
/
Practical scope
Assign on the Azure Cosmos DB account whose Semantic Reranker runtime the identity calls. A resource-group assignment is inherited by every eligible account in that group. This role authorizes reranker invocation only; Cosmos DB item reads use separate native data-plane permissions.
Common use cases (2)
- Allow an application, managed identity, service principal, or user to rerank query results returned from an Azure Cosmos DB for NoSQL container.
- Separate runtime reranker calls from feature enablement and inference-account administration.
Prerequisites (3)
- Semantic Reranker must be enabled for the Azure Cosmos DB account and the Microsoft.InferenceService provider might need registration while the feature is in preview.
- If the caller queries Cosmos DB with Microsoft Entra ID before reranking, also assign native Cosmos DB data-plane permission to read the source items.
- Use a supported Azure Cosmos DB SDK and provide the query results and user search phrase required by the reranking workflow.
Best practices (3)
- Assign this runtime-only role to the application identity on the individual Cosmos DB account instead of using Inference Account Owner.
- Grant the separate Cosmos DB item-read role only on the source data scope the application queries.
- Treat the feature as preview, measure request volume and cost, and review access and feature behavior before production expansion.
Security considerations (3)
- The DataAction permits real inference execution and can process query-result content and incur service usage even though account writes are excluded.
- The role does not grant Cosmos DB item reads; combining it with a native data-plane role determines which source data the caller can retrieve and rerank.
- A parent-scope assignment can authorize runtime calls against multiple inherited accounts.
Assignment guidance
Assign Semantic Reranker User to the runtime caller on the individual Azure Cosmos DB account. Add a separate Cosmos DB Built-in Data Reader or narrower native role for source-item reads, and reserve Inference Account Operator or Owner for principals that enable or administer the feature.
Related roles (3)
- Inference Account Operator: Enables or disables Semantic Reranker but does not allow runtime reranker calls.
- Inference Account Owner: Combines Semantic Reranker configuration with runtime calls and is broader than the runtime-only User role.
- Cosmos DB Built-in Data Reader: Separate native Cosmos DB data-plane role needed when the runtime identity must read source items before reranking.
Common questions
When should I assign the Semantic Reranker User Azure role?
Assign Semantic Reranker User when you need to: Allow an application, managed identity, service principal, or user to rerank query results returned from an Azure Cosmos DB for NoSQL container.; and Separate runtime reranker calls from feature enablement and inference-account administration.. Practical scope: Assign on the Azure Cosmos DB account whose Semantic Reranker runtime the identity calls. A resource-group assignment is inherited by every eligible account in that group. This role authorizes reranker invocation only; Cosmos DB item reads use separate native data-plane permissions.
What permissions does the Semantic Reranker User Azure role grant?
The role definition grants 2 combined control-plane and data-plane actions. Representative operations include: Microsoft.InferenceService/inferenceAccounts/read; and Microsoft.InferenceService/inferenceAccounts/invoke/semanticReranker/action. Review the permission sections above for the complete definition and exclusions.
What are the security risks of the Semantic Reranker User Azure role?
Key considerations when assigning Semantic Reranker User: The DataAction permits real inference execution and can process query-result content and incur service usage even though account writes are excluded.; The role does not grant Cosmos DB item reads; combining it with a native data-plane role determines which source data the caller can retrieve and rerank.; and A parent-scope assignment can authorize runtime calls against multiple inherited accounts.. Follow the assignment guidance above and use the narrowest practical scope.
Editorial sources (5)
- Azure built-in roles for Databases →
Supports: Description, Security considerations. Retrieved 2026-07-16.
- Understand scope for Azure RBAC →
Supports: Practical scope, Assignment guidance. Retrieved 2026-07-16.
- Best practices for Azure RBAC →
Supports: Best practices. Retrieved 2026-07-16.
- Semantic Reranker in Azure Cosmos DB for NoSQL →
Supports: Description, Practical scope, Common use cases, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.
- Connect to Azure Cosmos DB for NoSQL using role-based access control and Microsoft Entra ID →
Supports: Practical scope, Prerequisites, Best practices, Security considerations, Assignment guidance, Related roles. Retrieved 2026-07-16.