You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/search/search-index-azure-sql-managed-instance-with-managed-identity.md
+18-19Lines changed: 18 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.service: azure-ai-search
9
9
ms.custom:
10
10
- ignite-2023
11
11
ms.topic: conceptual
12
-
ms.date: 05/29/2025
12
+
ms.date: 06/04/2025
13
13
---
14
14
15
15
# Set up an indexer connection to Azure SQL Managed Instance using a managed identity
@@ -18,7 +18,7 @@ This article describes how to set up an Azure AI Search indexer connection to [S
18
18
19
19
You can use a system-assigned managed identity or a user-assigned managed identity (preview). Managed identities are Microsoft Entra logins and require Azure role assignments to access data in SQL Managed Instance.
20
20
21
-
Before learning more about this feature, it's recommended that you understand what an indexer is and how to set up an indexer for your data source. More information can be found at the following links:
21
+
Before learning more about this feature, we recommended that you understand what an indexer is and how to set up an indexer for your data source. More information can be found at the following links:
@@ -29,30 +29,29 @@ Before learning more about this feature, it's recommended that you understand wh
29
29
30
30
* Microsoft Entra admin role on SQL Managed Instance:
31
31
32
-
To assign read permissions on SQL Managed Instance, you must be an Azure Global Admin with a SQL Managed Instance. See [Configure and manage Microsoft Entra authentication with SQL Managed Instance](/azure/azure-sql/database/authentication-aad-configure) and follow the steps to provision a Microsoft Entra admin (SQL Managed Instance).
32
+
To assign read permissions on SQL Managed Instance, you must be an Azure Global Admin with a SQL Managed Instance. See [Configure and manage Microsoft Entra authentication with SQL Managed Instance](/azure/azure-sql/database/authentication-aad-configure) and follow the steps to provision a Microsoft Entra admin (SQL Managed Instance).
33
33
34
-
*[Configure a public endpoint and network security group in SQL Managed Instance](search-how-to-index-sql-managed-instance.md) to allow connections from Azure AI Search. Connecting through a Shared Private Link when using a managed identity isn't currently supported.
34
+
*[Configure a public endpoint and network security group in SQL Managed Instance](search-how-to-index-sql-managed-instance.md) to allow connections from Azure AI Search. Connecting through a shared private link when using a managed identity isn't currently supported.
35
35
36
-
## 1 - Assign permissions to read the database
36
+
## Assign permissions to read the database
37
37
38
38
Follow these steps to assign the search service system managed identity permission to read the SQL Managed database.
39
39
40
40
1. Connect to your SQL Managed Instance through SQL Server Management Studio (SSMS) by using one of the following methods:
41
41
42
42
-[Configure a point-to-site connection from on-premises](/azure/azure-sql/managed-instance/point-to-site-p2s-configure)
43
-
-[Configure an Azure VM](/azure/azure-sql/managed-instance/connect-vm-instance-configure)
43
+
-[Configure an Azure virtual machine](/azure/azure-sql/managed-instance/connect-vm-instance-configure)
44
44
45
45
1. Authenticate with your Microsoft Entra account.
46
46
47
47
:::image type="content" source="./media/search-index-azure-sql-managed-instance-with-managed-identity/sql-login.png" alt-text="Showing screenshot of the Connect to Server dialog.":::
48
48
49
-
1. From the left pane, locate the SQL database you are using as data source for indexing and right-click it. Select **New Query**.
49
+
1. From the left pane, locate the SQL database you're using as data source for indexing and right-click it. Select **New Query**.
50
50
51
51
:::image type="content" source="./media/search-index-azure-sql-managed-instance-with-managed-identity/new-sql-query.png" alt-text="Showing screenshot of new SQL query.":::
52
52
53
-
1. In the T-SQL window, copy the following commands and include the brackets around your search service name. Click on**Execute**.
53
+
1. In the T-SQL window, copy the following commands and include the brackets around your search service name. Select**Execute**.
54
54
55
-
56
55
```sql
57
56
CREATE USER [insert your search service name here or user-assigned managed identity name] FROM EXTERNAL PROVIDER;
58
57
EXEC sp_addrolemember 'db_datareader', [insert your search service name here or user-assigned managed identity name];
@@ -68,9 +67,9 @@ sp_droprolemember 'db_datareader', [insert your search service name or user-assi
68
67
DROP USER IF EXISTS [insert your search service name or user-assigned managed identity name];
69
68
```
70
69
71
-
## 2 - Add a role assignment
70
+
## Add a role assignment
72
71
73
-
In this step, you'll give your Azure AI Search service permission to read data from your SQL Managed Instance.
72
+
In this step, you give your Azure AI Search service permission to read data from your SQL Managed Instance.
74
73
75
74
1. In the Azure portal, navigate to your SQL Managed Instance page.
76
75
1. Select**Access control (IAM)**.
@@ -86,15 +85,15 @@ In this step, you'll give your Azure AI Search service permission to read data f
86
85
87
86
:::image type="content" source="./media/search-index-azure-sql-managed-instance-with-managed-identity/add-role-assignment.png" alt-text="Showing screenshot of the member role assignment.":::
88
87
89
-
## 3 - Create the data source
88
+
## Create the data source
90
89
91
90
Create the data source and provide a system-assigned managed identity.
92
91
93
92
### System-assigned managed identity
94
93
95
-
The [REST API](/rest/api/searchservice/data-sources/create), Azure portal, and the [.NET SDK](/dotnet/api/azure.search.documents.indexes.models.searchindexerdatasourceconnection) support system-assigned managed identity.
94
+
The [REST API](/rest/api/searchservice/data-sources/create), Azure portal, and the [.NET SDK](/dotnet/api/azure.search.documents.indexes.models.searchindexerdatasourceconnection) support system-assigned managed identity.
96
95
97
-
When you're connecting with a system-assigned managed identity, the only change to the data source definition is the format of the "credentials" property. You'll provide an Initial Catalog or Database name and a `ResourceId` that has no account key or password. The `ResourceId` must include the subscription ID of SQL Managed Instance, the resource group of SQL Managed instance, and the name of the SQL database.
96
+
When you're connecting with a system-assigned managed identity, the only change to the data source definition is the format of the "credentials" property. You provide an Initial Catalog or Database name and a `ResourceId` that has no account key or password. The `ResourceId` must include the subscription ID of SQL Managed Instance, the resource group of SQL Managed instance, and the name of the SQL database.
98
97
99
98
Here's an example of how to create a data source to index data from a storage account using the [Create Data Source](/rest/api/searchservice/data-sources/create) REST API and a managed identity connection string. The managed identity connection string format is the same for the REST API, .NET SDK, and the Azure portal.
100
99
@@ -115,11 +114,11 @@ api-key: [admin key]
115
114
}
116
115
```
117
116
118
-
## 4 - Create the index
117
+
## Create the index
119
118
120
119
The index specifies the fields in a document, attributes, and other constructs that shape the search experience.
121
120
122
-
Here's a [Create Index](/rest/api/searchservice/indexes/create) REST API call with a searchable `booktitle` field:
121
+
Here's a [Create Index](/rest/api/searchservice/indexes/create) REST API call with a searchable `booktitle` field:
123
122
124
123
```http
125
124
POST https://[service name].search.windows.net/indexes?api-version=2024-07-01
@@ -135,9 +134,9 @@ api-key: [admin key]
135
134
}
136
135
```
137
136
138
-
## 5 - Create the indexer
137
+
## Create the indexer
139
138
140
-
An indexer connects a data source with a target search index, and provides a schedule to automate the data refresh. Once the index and data source have been created, you're ready to create the indexer.
139
+
An indexer connects a data source with a target search index, and provides a schedule to automate the data refresh. Once the index and data source are created, you're ready to create the indexer.
141
140
142
141
Here's a [Create Indexer](/rest/api/searchservice/indexers/create) REST API call with an Azure SQL indexer definition. The indexer runs when you submit the request.
143
142
@@ -155,7 +154,7 @@ api-key: [admin key]
155
154
156
155
## Troubleshooting
157
156
158
-
If you get an error when the indexer tries to connect to the data source that says that the client is not allowed to access the server, take a look at [common indexer errors](./search-indexer-troubleshooting.md).
157
+
If you get an error when the indexer tries to connect to the data source that says that the client isn't allowed to access the server, see the [common indexer errors](./search-indexer-troubleshooting.md).
159
158
160
159
You can also rule out any firewall issues by trying the connection with and without restrictions in place.
0 commit comments