You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/search/search-get-started-portal-import-vectors.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -61,7 +61,7 @@ If you're starting with the free service, you're limited to three indexes, three
61
61
62
62
We recommend role assignments for search service connections to other resources.
63
63
64
-
1. On Azure AI Search, [enable role-based access](search-security-rbac.md#enable-role-based-access-for-data-plane-operations).
64
+
1. On Azure AI Search, [enable role-based access](search-security-enable-roles.md).
65
65
66
66
1. Configure your search service to [use a system or user-assigned managed identity](search-howto-managed-identities-data-sources.md#create-a-system-managed-identity).
Copy file name to clipboardExpand all lines: articles/search/search-how-to-index-onelake-files.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -42,7 +42,7 @@ This article uses the REST APIs to illustrate each step.
42
42
+[Use data pipelines](/fabric/data-engineering/tutorial-lakehouse-data-ingestion) from [Microsoft Fabric](https://fabric.microsoft.com/)
43
43
+[Add shortcuts](/fabric/onelake/create-onelake-shortcut) from external data sources like [Amazon S3](/fabric/onelake/create-s3-shortcut) or [Google Cloud Storage](/fabric/onelake/create-gcs-shortcut).
44
44
45
-
+ A search service configured for either a [system managed identity](search-howto-managed-identities-data-sources.md#create-a-system-managed-identity) or [user-assigned assigned managed identity](search-howto-managed-identities-data-sources.md#create-a-user-assigned-managed-identity-preview).
45
+
+ A search service configured for either a [system managed identity](search-howto-managed-identities-data-sources.md#create-a-system-managed-identity) or [user-assigned assigned managed identity](search-howto-managed-identities-data-sources.md#create-a-user-assigned-managed-identity).
46
46
47
47
+ A Contributor role assignment in the Microsoft Fabric workspace where the lakehouse is located. Steps are outlined in the [Grant permissions](#assign-service-permissions) section of this article.
Copy file name to clipboardExpand all lines: articles/search/search-howto-aad.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -64,7 +64,7 @@ All calls to the Management REST API are authenticated through Microsoft Entra I
64
64
GET https://management.azure.com/subscriptions/{{subscriptionId}}/providers/Microsoft.Search/searchServices?api-version=2023-11-01
65
65
```
66
66
67
-
1. Use PATCH to update service configuration. The following modifications enable both keys and role-based access. If you want a roles-only configuration, see [Disable API keys](search-security-rbac.md#disable-api-key-authentication).
67
+
1. Use PATCH to update service configuration. The following modifications enable both keys and role-based access. If you want a roles-only configuration, see [Disable API keys](search-security-enable-roles.md#disable-api-key-authentication).
68
68
69
69
Under "properties", set ["authOptions"](/rest/api/searchmanagement/services/create-or-update#dataplaneauthoptions) to "aadOrApiKey". The "disableLocalAuth" property must be false to set "authOptions".
Copy file name to clipboardExpand all lines: articles/search/search-howto-managed-identities-storage.md
+48-72Lines changed: 48 additions & 72 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,141 +8,117 @@ manager: nitinme
8
8
9
9
ms.service: cognitive-search
10
10
ms.topic: how-to
11
-
ms.date: 02/22/2024
11
+
ms.date: 06/03/2024
12
12
ms.custom:
13
13
- subject-rbac-steps
14
14
- ignite-2023
15
15
---
16
16
17
-
# Set up an indexer connection to Azure Storage using a managed identity
17
+
# Connect to Azure Storage using a managed identity (Azure AI Search)
18
18
19
-
This article explains how to set up an indexer connection to an Azure Storage account using a managed identity instead of providing credentials in the connection string.
19
+
This article explains how to configure a search service connection to an Azure Storage account using a managed identity instead of providing credentials in the connection string.
20
20
21
-
You can use a system-assigned managed identity or a user-assigned managed identity (preview). Managed identities are Microsoft Entra logins and require Azure role assignments to access data in Azure Storage.
21
+
You can use a system-assigned managed identity or a user-assigned managed identity. Managed identities are Microsoft Entra logins and require role assignments for access to Azure Storage.
22
+
23
+
## Prerequisites
24
+
25
+
+ Azure AI Search, Basic tier or higher, with a [managed identity](search-howto-managed-identities-data-sources.md).
22
26
23
27
> [!NOTE]
24
28
> If storage is network-protected and in the same region as your search service, you must use a system-assigned managed identity and either one of the following network options: [connect as a trusted service](search-indexer-howto-access-trusted-service-exception.md), or [connect using the resource instance rule](../storage/common/storage-network-security.md#grant-access-from-azure-resource-instances).
25
29
26
-
## Prerequisites
27
-
28
-
*[Create a managed identity](search-howto-managed-identities-data-sources.md) for your search service.
30
+
## Create a role assignment in Azure Storage
29
31
30
-
*[Assign a role](search-howto-managed-identities-data-sources.md#assign-a-role) in Azure Storage:
32
+
1. Sign in to Azure portal and find your storage account.
33
+
1. Select **Access control (IAM)**.
34
+
1. Select **Add** and then select **Role assignment**.
35
+
1. From the list of job function roles, select the roles needed for your search service:
31
36
32
-
* Choose **Storage Blob Data Reader** for data read access in Blob Storage and ADLS Gen2.
37
+
| Task | Role assignment |
38
+
|------|-----------------|
39
+
| Blob indexing using an indexer | Add **Storage Blob Data Reader**|
40
+
| ADLS Gen2 indexing using an indexer | Add **Storage Blob Data Reader**|
41
+
| Table indexing using an indexer | Add **Reader and Data Access**|
42
+
| File indexing using an indexer | Add **Reader and Data Access**|
43
+
| Write to a knowledge store | Add **Storage Blob DataContributor** for object and file projections, and **Reader and Data Access** for table projections. |
44
+
| Write to an enrichment cache | Add **Storage Blob Data Contributor**|
45
+
| Save debug session state | Add **Storage Blob Data Contributor**|
33
46
34
-
* Choose **Reader and Data** for data read access in Table Storage and File Storage.
47
+
1. Select **Next**.
48
+
1. Select **Managed identity** and then select **Members**.
49
+
1. Filter by system-assigned managed identities or user-assigned managed identities. If you don't have a managed identity, see [Configure search to use a managed identity](search-howto-managed-identities-data-sources.md). If you already set one up but it's not available, give it a few minutes.
50
+
1. Select the identity and save the role assignment.
35
51
36
-
* You should be familiar with [indexer concepts](search-indexer-overview.md) and [configuration](search-howto-indexing-azure-blob-storage.md).
52
+
## Specify a managed identity in a connection string
37
53
38
-
> [!TIP]
39
-
> For a code example in C#, see [Index Data Lake Gen2 using Microsoft Entra ID](https://github.com/Azure-Samples/azure-search-dotnet-utilities/blob/main/data-lake-gen2-acl-indexing/README.md) on GitHub.
54
+
Once you have a role assignment, you can set up a connection to Azure Storage that operates under that role.
40
55
41
-
## Create the data source
56
+
Indexers use a data source object for connections to an external data source. This section explains how to specify a system-assigned managed identity or a user-assigned managed identity on a data source connection string. You can find more [connection string examples](search-howto-managed-identities-data-sources.md#connection-string-examples) in the managed identity article.
42
57
43
-
Create the data source and provide either a system-assigned managed identity or a user-assigned managed identity (preview).
58
+
> [!TIP]
59
+
> You can create a data source connection to Azure Storage in the Azure portal, specifying either a system or user-assigned managed identity, and then view the JSON definition to see how the connection string is formulated.
44
60
45
61
### System-assigned managed identity
46
62
47
-
The [REST API](/rest/api/searchservice/create-data-source), Azure portal, and the [.NET SDK](/dotnet/api/azure.search.documents.indexes.models.searchindexerdatasourceconnection) support using a system-assigned managed identity.
63
+
You must have a [system-assigned managed identity already configured](search-howto-managed-identities-data-sources.md), and it must have a role-assignment on Azure Storage.
48
64
49
-
When you're connecting with a system-assigned managed identity, the only change to the data source definition is the format of the "credentials" property. Provide a ResourceId that has no account key or password. The ResourceId must include the subscription ID of the storage account, the resource group of the storage account, and the storage account name.
65
+
For connections made using a system-assigned managed identity, the only change to the [data source definition](/rest/api/searchservice/create-data-source) is the format of the `credentials` property.
50
66
51
-
Here's an example of how to create a data source to index data from a storage account using the [Create Data Source](/rest/api/searchservice/create-data-source) REST API and a managed identity connection string. The managed identity connection string format is the same for the REST API, .NET SDK, and the Azure portal.
67
+
Provide a `ResourceId` that has no account key or password. The `ResourceId` must include the subscription ID of the storage account, the resource group of the storage account, and the storage account name.
52
68
53
69
```http
54
70
POST https://[service name].search.windows.net/datasources?api-version=2023-11-01
55
-
Content-Type: application/json
56
-
api-key: [admin key]
57
71
58
72
{
59
73
"name" : "blob-datasource",
60
74
"type" : "azureblob",
61
75
"credentials" : {
62
-
"connectionString" : "ResourceId=/subscriptions/[subscription ID]/resourceGroups/[resource group name]/providers/Microsoft.Storage/storageAccounts/[storage account name]/;"
The 2021-04-30-preview REST API supports connections based on a user-assigned managed identity. When you're connecting with a user-assigned managed identity, there are two changes to the data source definition:
86
+
You must have a [user-assigned managed identity already configured](search-howto-managed-identities-data-sources.md) and associated with your search service, and the identity must have a role-assignment on Azure Storage.
73
87
74
-
* First, the format of the "credentials" property is a ResourceId that has no account key or password. The ResourceId must include the subscription ID of the storage account, the resource group of the storage account, and the storage account name. This format is the same format as the system-assigned managed identity.
88
+
Connections made through user-assigned managed identities use the same credentials as a system-assigned managed identity, plus an extra identity property that contains the collection of user-assigned managed identities. Only one user-assigned managed identity should be provided when creating the data source. Set `userAssignedIdentity` to the user-assigned managed identity..
75
89
76
-
* Second, add an "identity" property that contains the collection of user-assigned managed identities. Only one user-assigned managed identity should be provided when creating the data source. Set it to type "userAssignedIdentities".
90
+
Provide a `ResourceId` that has no account key or password. The `ResourceId` must include the subscription ID of the storage account, the resource group of the storage account, and the storage account name.
77
91
78
-
Here's an example of how to create an indexer data source object using the [preview Create or Update Data Source](/rest/api/searchservice/preview-api/create-or-update-data-source) REST API:
92
+
Provide an `identity`using the syntax shown in the following example.
79
93
80
94
```http
81
-
POST https://[service name].search.windows.net/datasources?api-version=2021-04-30-preview
82
-
Content-Type: application/json
83
-
api-key: [admin key]
95
+
POST https://[service name].search.windows.net/datasources?api-version=2023-11-01
84
96
85
97
{
86
98
"name" : "blob-datasource",
87
99
"type" : "azureblob",
88
100
"credentials" : {
89
-
"connectionString" : "ResourceId=/subscriptions/[subscription ID]/resourceGroups/[resource group name]/providers/Microsoft.Storage/storageAccounts/[storage account name]/;"
An indexer connects a data source with a target search index, and provides a schedule to automate the data refresh. Once the index and data source have been created, you're ready to create and run the indexer. If the indexer is successful, the connection syntax and role assignments are valid.
124
-
125
-
Here's a [Create Indexer](/rest/api/searchservice/create-indexer) REST API call with a blob indexer definition. The indexer runs when you submit the request.
126
-
127
-
```http
128
-
POST https://[service name].search.windows.net/indexers?api-version=2023-11-01
129
-
Content-Type: application/json
130
-
api-key: [admin key]
131
-
132
-
{
133
-
"name" : "blob-indexer",
134
-
"dataSourceName" : "blob-datasource",
135
-
"targetIndexName" : "my-target-index"
136
-
}
137
-
```
113
+
Connection information and permissions on the remote service are validated at run time during indexer execution. If the indexer is successful, the connection syntax and role assignments are valid. For more information, see [Run or reset indexers, skills, or documents](search-howto-run-reset-indexers.md).
138
114
139
115
## Accessing network secured data in storage accounts
140
116
141
117
Azure storage accounts can be further secured using firewalls and virtual networks. If you want to index content from a storage account that is secured using a firewall or virtual network, see [Make indexer connections to Azure Storage as a trusted service](search-indexer-howto-access-trusted-service-exception.md).
*[C# Example: Index Data Lake Gen2 using Microsoft Entra ID (GitHub)](https://github.com/Azure-Samples/azure-search-dotnet-utilities/blob/main/data-lake-gen2-acl-indexing/README.md)
+[C# Example: Index Data Lake Gen2 using Microsoft Entra ID (GitHub)](https://github.com/Azure-Samples/azure-search-dotnet-utilities/blob/main/data-lake-gen2-acl-indexing/README.md)
Copy file name to clipboardExpand all lines: articles/search/search-manage-rest.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -184,7 +184,7 @@ In this step, configure your search service to recognize an **authorization** he
184
184
185
185
To use role-based access control for data plane operations, set `authOptions` to `aadOrApiKey` and then send the request.
186
186
187
-
To use role-based access control exclusively, [turn off API key authentication](search-security-rbac.md#disable-api-key-authentication) by following up with a second request, this time setting `disableLocalAuth` to true.
187
+
To use role-based access control exclusively, [turn off API key authentication](search-security-enable-roles.md#disable-api-key-authentication) by following up with a second request, this time setting `disableLocalAuth` to true.
0 commit comments