revisions

Author: HeidiSteen

articles/search/search-howto-managed-identities-data-sources.md

@@ -189,7 +189,7 @@ The following steps are for Azure Storage. If your resource is Azure Cosmos DB o
 
 1. Select **Add role assignment**.
 
-1. On the **Role** page, select the roles needed for your search service. Recall that roles are cumulative. Choose only what you need, but you can select all of them for full access to integrated features:
+1. On the **Role** page, select the roles needed for your search service. Recall that roles are cumulative. You should choose only what you need, but you can select all of them for full access to integrated features:
 
    | Role | Usage |
    |------|-------|

articles/search/search-indexer-howto-access-trusted-service-exception.md

@@ -15,17 +15,16 @@ ms.date: 12/08/2022
 
 In Azure Cognitive Search, indexers that access Azure blobs can use the [trusted service exception](../storage/common/storage-network-security.md#exceptions) to securely access data. This mechanism offers customers who are unable to grant [indexer access using IP firewall rules](search-indexer-howto-access-ip-restricted.md) a simple, secure, and free alternative for accessing data in storage accounts.
 
-## Prerequisites
-
-+ A search service with a [**system-assigned managed identity**](search-howto-managed-identities-data-sources.md). 
+> [!NOTE]
+> If Azure Storage is behind a firewall and in the same region as Azure Cognitive Search, you won't be able to create an inbound rule that admits requests from your search service. The solution for this scenario is for search to connect as a trusted service, as described in this article.
 
-+ A storage account with the **Allow trusted Microsoft services to access this storage account** network option.
+## Prerequisites
 
-+ Content in Azure Blob Storage or Azure Data Lake Storage Gen2 (ADLS Gen2) that you want to index or enrich.
++ A search service with a system-assigned managed identity ([see below](#check-service-identity)).
 
-+ An Azure role assignment in Azure Storage that grants permissions to the search service system-assigned managed identity. A system managed identity is an Azure AD login. The assignment needs **Storage Blob Data Reader** at a minimum.
++ A storage account with the **Allow trusted Microsoft services to access this storage account** network option ([see below](#check-network-settings)).
 
-  The role assignment also needs **Storage Blob Data Contributor** if write access is required. Features that require write access include [enrichment caching](cognitive-search-incremental-indexing-conceptual.md), [debug sessions](cognitive-search-debug-session.md), and [knowledge store](knowledge-store-concept-intro.md).
++ An Azure role assignment in Azure Storage that grants permissions to the search service system-assigned managed identity ([see below](#check-permissions)).
 
 > [!NOTE]
 > In Cognitive Search, a trusted service connection is limited to blobs and ADLS Gen2 on Azure Storage. It's unsupported for indexer connections to Azure Table Storage and Azure File Storage.
@@ -36,11 +35,11 @@ In Azure Cognitive Search, indexers that access Azure blobs can use the [trusted
 
 1. [Sign in to Azure portal](https://portal.azure.com) and [find your search service](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Storage%2storageAccounts/).
 
-1. On the **Identity** page, make sure that a system assigned identity is enabled. Remember that user-assigned managed identities, currently in preview, won't work for a trusted service connection.
+1. On the **Identity** page, make sure that a [system assigned identity is enabled](search-howto-managed-identities-data-sources.md). Remember that user-assigned managed identities, currently in preview, won't work for a trusted service connection.
 
    :::image type="content" source="media/search-managed-identities/system-assigned-identity-object-id.png" alt-text="Screenshot of a system identity object identifier." border="true":::
 
-## Check network settings and permissions
+## Check network settings
 
 1. [Sign in to Azure portal](https://portal.azure.com) and [find your storage account](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Storage%2storageAccounts/).
 
@@ -56,8 +55,16 @@ In Azure Cognitive Search, indexers that access Azure blobs can use the [trusted
 
    This option will only permit the specific search service instance with appropriate role-based access to the storage account (strong authentication) to access data in the storage account, even if it's secured by IP firewall rules.
 
+## Check permissions
+
+A system managed identity is an Azure AD login. The assignment needs **Storage Blob Data Reader** at a minimum.
+
 1. In the left navigation pane under **Access Control**, view all role assignments and make sure that **Storage Blob Data Reader** is assigned to the search service system identity.
 
+1. Add **Storage Blob Data Contributor** if write access is required.
+
+   Features that require write access include [enrichment caching](cognitive-search-incremental-indexing-conceptual.md), [debug sessions](cognitive-search-debug-session.md), and [knowledge store](knowledge-store-concept-intro.md).
+
 ## Set up and test the connection
 
 The easiest way to test the connection is by running the Import data wizard.