Skip to content

Skip role assignments for free Azure Search SKU (#2848) #2886

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pamelafox merged 6 commits into from
Jan 9, 2026
Merged

Skip role assignments for free Azure Search SKU (#2848) #2886

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d7dcdd4
Fix: skip role assignments when principalId is empty to avoid Invalid…
nb-a153 Dec 31, 2025
d4503fb
Add checks to each role in main.bicep that is assigned to searchServi…
nb-a153 Jan 7, 2026
d27bd24
Add checks to each role in main.bicep that is assigned to searchServi…
nb-a153 Jan 7, 2026
7403e7b
Add limitations in docs
nb-a153 Jan 7, 2026
5757f0a
Revert unneeded change to role.bicep
pamelafox Jan 9, 2026
1235ff0
Merge branch 'main' into fix/skip-role-assignments-free-search
pamelafox Jan 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/deploy_lowcost.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ However, if your goal is to minimize costs while prototyping your application, f
reuse your [existing search service](../README.md#existing-azure-ai-search-resource).
2. The free tier does not support semantic ranker, so the app UI will no longer display
the option to use the semantic ranker. Note that will generally result in [decreased search relevance](https://techcommunity.microsoft.com/blog/azure-ai-services-blog/azure-ai-search-outperforming-vector-search-with-hybrid-retrieval-and-ranking-ca/3929167).
3. The free tier does not support managed identities. As a result, cloud ingestion and multimodal/vector features that require role assignments to the search service principal will have those role assignments skipped during provisioning. If you need those permissions, use a non-free tier (for example, `Basic`/`B1` or `Standard`).

1. Use the free tier of Azure Document Intelligence (used in analyzing files):

Expand Down
8 changes: 4 additions & 4 deletions infra/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1154,7 +1154,7 @@ module openAiRoleBackend 'core/security/role.bicep' = if (isAzureOpenAiHost && d
}
}

module openAiRoleSearchService 'core/security/role.bicep' = if (isAzureOpenAiHost && deployAzureOpenAi) {
module openAiRoleSearchService 'core/security/role.bicep' = if (isAzureOpenAiHost && deployAzureOpenAi && searchServiceSkuName != 'free') {
scope: openAiResourceGroup
name: 'openai-role-searchservice'
params: {
Expand All @@ -1164,7 +1164,7 @@ module openAiRoleSearchService 'core/security/role.bicep' = if (isAzureOpenAiHos
}
}

module visionRoleSearchService 'core/security/role.bicep' = if (useMultimodal) {
module visionRoleSearchService 'core/security/role.bicep' = if (useMultimodal && searchServiceSkuName != 'free') {
scope: visionResourceGroup
name: 'vision-role-searchservice'
params: {
Expand Down Expand Up @@ -1199,7 +1199,7 @@ module storageOwnerRoleBackend 'core/security/role.bicep' = if (useUserUpload) {
}

// Search service needs blob read access for both integrated vectorization and cloud ingestion indexer data source
module storageRoleSearchService 'core/security/role.bicep' = if (useIntegratedVectorization || useCloudIngestion) {
module storageRoleSearchService 'core/security/role.bicep' = if ((useIntegratedVectorization || useCloudIngestion) && searchServiceSkuName != 'free') {
scope: storageResourceGroup
name: 'storage-role-searchservice'
params: {
Expand All @@ -1209,7 +1209,7 @@ module storageRoleSearchService 'core/security/role.bicep' = if (useIntegratedVe
}
}

module storageRoleContributorSearchService 'core/security/role.bicep' = if (useIntegratedVectorization && useMultimodal) {
module storageRoleContributorSearchService 'core/security/role.bicep' = if ((useIntegratedVectorization && useMultimodal) && searchServiceSkuName != 'free') {
scope: storageResourceGroup
name: 'storage-role-contributor-searchservice'
params: {
Expand Down
Loading