@@ -5,7 +5,7 @@ ms.service: azure-ai-search
 ms.custom:
   - ignite-2023
 ms.topic: include
-ms.date: 10/07/2024
+ms.date: 11/01/2024
 ---
 
 Build a Java console application using the [Azure.Search.Documents](/java/api/overview/azure/search) library to create, load, and query a search index. 
@@ -65,12 +65,12 @@ Use the following tools to create this quickstart.
         <dependency>
           <groupId>com.azure</groupId>
           <artifactId>azure-search-documents</artifactId>
-          <version>11.5.2</version>
+          <version>11.7.3</version>
         </dependency>
         <dependency>
           <groupId>com.azure</groupId>
           <artifactId>azure-core</artifactId>
-          <version>1.34.0</version>
+          <version>1.53.0</version>
         </dependency>
         <dependency>
           <groupId>junit</groupId>

@@ -1,11 +1,10 @@
 ---
 title: Use keyless connections with Azure AI Search
-description: Use keyless connections with an Azure Identity library for authentication and authorization with Azure AI Search.
+description: Use keyless connections with an Azure Identity library for Microsoft Entra ID authentication and authorization with Azure AI Search.
 ms.topic: how-to
-ms.date: 06/05/2024
+ms.date: 10/30/2024
 author: HeidiSteen
 ms.author: heidist
-ms.reviewer: scaddie
 ms.custom: devx-track-dotnet, devx-track-extended-java, devx-track-js, devx-track-python, Keyless-dotnet, Keyless-java, Keyless-js, Keyless-python, build-2024-intelligent-apps
 #customer intent: As a developer, I want to use keyless connections so that I don't leak secrets.
 ---
@@ -34,7 +33,7 @@ Before continuing with this article, you need an Azure AI Search resource to wor
 
 ### Install Azure Identity client library
 
-Before working locally without keyless, update your AI Search enabled code with the Azure Identity client library.
+To use a keyless approach, update your AI Search enabled code with the Azure Identity client library.
 
 #### [.NET](#tab/csharp)
 
@@ -211,22 +210,21 @@ search_index_client = SearchIndexClient(
 
 ---
 
-
 ## Local development
 
-Local development without keyless includes these steps:
+Local development using roles includes these steps:
 
-- Assign your personal identity with RBAC roles on the specific resource.
-- Use a tool to authenticate with Azure.
+- Assign your personal identity to RBAC roles on the specific resource.
+- Use a tool like the Azure CLI or Azure PowerShell to authenticate with Azure.
 - Establish environment variables for your resource.
 
 ### Roles for local development
 
-As a local developer, your Azure identity needs full control of your service. This control is provided with RBAC roles. To manage your resource during development, these are the suggested roles:
+As a local developer, your Azure identity needs full control over data plane operations. These are the suggested roles:
 
-- Search Service Contributor
-- Search Index Data Contributor
-- Search Index Data Reader
+- Search Service Contributor, create and manage objects
+- Search Index Data Contributor, load an index
+- Search Index Data Reader, query an index
 
 Find your personal identity with one of the following tools. Use that identity as the `<identity-id>` value.
 
@@ -253,7 +251,7 @@ Find your personal identity with one of the following tools. Use that identity a
         --assignee "<identity-id>" \
         --scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>"
     ```
-    
+
 #### [Azure PowerShell](#tab/azure-powershell)
 
 1. Sign in with PowerShell.
@@ -277,13 +275,12 @@ Find your personal identity with one of the following tools. Use that identity a
 #### [Azure portal](#tab/portal)
 
 1. Use the steps found here: [find the user object ID](/partner-center/find-ids-and-domain-names#find-the-user-object-id) in the Azure portal.
-    
-2. Use the steps found at [open the Add role assignment page](search-security-rbac.md) in the Azure portal.
-    
+
+1. Use the steps found at [open the Add role assignment page](search-security-rbac.md) in the Azure portal.
+
 ---
-    
-Where applicable, replace `<identity-id>`, `<subscription-id>`, and `<resource-group-name>` with your actual values. 
 
+Where applicable, replace `<identity-id>`, `<subscription-id>`, and `<resource-group-name>` with your actual values. 
 
 ### Authentication for local development
 

@@ -212,8 +212,8 @@ This section uses Visual Studio Code and Python to call the chat completion APIs
    ! pip install azure-search-documents==11.6.0b5 --quiet
    ! pip install azure-identity==1.16.1 --quiet
    ! pip install openai --quiet
-   ! pip intall aiohttp --quiet
-   ! pip intall ipykernel --quiet
+   ! pip install aiohttp --quiet
+   ! pip install ipykernel --quiet
    ```
 
 1. Set the following variables, substituting placeholders with the endpoints you collected in the previous step. 

@@ -14,7 +14,7 @@ ms.custom:
   - devx-track-python
   - ignite-2023
 ms.topic: quickstart
-ms.date: 10/07/2024
+ms.date: 11/01/2024
 ---
 
 # Quickstart: Full text search using the Azure SDKs

@@ -94,7 +94,7 @@ You can create an Azure AI Search resource in any of the following Azure public
 | Australia Southeast​​​ |  | ✅ |  | |
 | East Asia​ | ✅ | ✅ | ✅ |  |
 | Southeast Asia​ ​ ​ | ✅ | ✅ | ✅ |  |
-| Central India | ✅ | ✅ | ✅ | S2, S3, S3HD, L1, L2 |
+| Central India | ✅ | ✅ | ✅ |  |
 | Jio India West​ ​ | ✅ | ✅ |  |
 | South India <sup>1</sup> |  | | ✅ |
 | Japan East  | ✅ | ✅ | ✅ |

@@ -10,7 +10,7 @@ ms.service: azure-ai-search
 ms.custom:
   - ignite-2023
 ms.topic: how-to
-ms.date: 06/28/2024
+ms.date: 10/30/2024
 ---
 
 # Connect to Azure AI Search using keys
@@ -245,7 +245,7 @@ It's not possible to use [customer-managed key encryption](search-security-manag
 
 + Always check code, samples, and training material before publishing to make sure you didn't leave valid API keys behind.
 
-+ For production workloads, switch to [Microsoft Entra ID and role-based access](search-security-rbac.md). Or, if you want to continue using API keys, be sure to always monitor [who has access to your API keys](#secure-api-keys) and [regenerate API keys](#regenerate-admin-keys) on a regular cadence.
++ For production workloads, switch to [Microsoft Entra ID and role-based access](keyless-connections.md). Or, if you want to continue using API keys, be sure to always monitor [who has access to your API keys](#secure-api-keys) and [regenerate API keys](#regenerate-admin-keys) on a regular cadence.
 
 ## See also
 

@@ -8,20 +8,18 @@ author: HeidiSteen
 ms.author: heidist
 ms.service: azure-ai-search
 ms.topic: how-to
-ms.date: 06/18/2024
+ms.date: 10/30/2024
 
 ---
 
 # Enable or disable role-based access control in Azure AI Search
 
-Before you can assign roles for authorized access to Azure AI Search, enable role-based access control on your search service.
+Azure AI Search uses [key-based authentication](search-security-api-keys.md) by default, but it fully supports Microsoft Entra ID authentication and authorization for all control plane and data plane operations through Azure role-based access control (RBAC).
 
-Role-based access for data plane operations is optional, but recommended as the more secure option. The alternative is [key-based authentication](search-security-api-keys.md), which is the default. 
-
-Roles for service administration (control plane) are built in and can't be enabled or disabled. 
+Before you can assign roles for authorized data plane access to Azure AI Search, you must enable role-based access control on your search service. Roles for service administration (control plane) are built in and can't be enabled or disabled. 
 
 > [!NOTE]
-> *Data plane* refers to operations against the search service endpoint, such as indexing or queries, or any other operation specified in the [Search REST API](/rest/api/searchservice/) or equivalent Azure SDK client libraries.
+> *Data plane* refers to operations against the search service endpoint, such as indexing or queries, or any other operation specified in the [Search Service REST APIs](/rest/api/searchservice/) or equivalent Azure SDK client libraries. *Control plane* refers to Azure resource management, such as creating or configuring a search service.
 
 ## Prerequisites
 
@@ -223,13 +221,11 @@ To re-enable key authentication, set "disableLocalAuth" to false. The search ser
 
 ---
 
-## Limitations
-
-+ Role-based access control can increase the latency of some requests. Each unique combination of service resource (index, indexer, etc.) and service principal triggers an authorization check. These authorization checks can add up to 200 milliseconds of latency per request. 
+## Effects of role-based access control
 
-+ In rare cases where requests originate from a high number of different service principals, all targeting different service resources (indexes, indexers, etc.), it's possible for the authorization checks to result in throttling. Throttling would only happen if hundreds of unique combinations of search service resource and service principal were used within a second.
++ Role-based access control can increase the latency of some requests. Each unique combination of service resource (index, indexer, skillsets and so forth) and service principal triggers an authorization check. These authorization checks can add up to 200 milliseconds of latency per request. 
 
----
++ In rare cases where requests originate from a high number of different service principals, all targeting different service resources (indexes, indexers, and so forth), it's possible for the authorization checks to result in throttling. Throttling would only happen if hundreds of unique combinations of search service resource and service principal were used within a second.
 
 ## Next steps
 

@@ -10,7 +10,7 @@ ms.service: azure-ai-search
 ms.custom:
   - ignite-2023
 ms.topic: conceptual
-ms.date: 02/16/2024
+ms.date: 10/30/2024
 ---
 
 # Find encrypted objects and information

@@ -8,19 +8,20 @@ author: HeidiSteen
 ms.author: heidist
 ms.service: azure-ai-search
 ms.topic: how-to
-ms.date: 06/03/2024
+ms.date: 10/30/2024
 ms.custom: subject-rbac-steps, devx-track-azurepowershell
 ---
 
 # Connect to Azure AI Search using roles
 
-Azure provides a global authentication and [role-based authorization system](/azure/role-based-access-control/role-assignments-portal) for all services running on the platform. In Azure AI Search, you can assign Azure roles for:
+Azure provides a global authentication and [role-based access control](/azure/role-based-access-control/role-assignments-portal) through Microsoft Entra ID for all services running on the platform. In this article, learn which roles provide access to search content and administration on Azure AI Search.
 
-> [!div class="checklist"]
-> + [Service administration](#assign-roles-for-service-administration)
-> + [Development or write-access to a search service](#assign-roles-for-development)
-> + [Read-only access for queries](#assign-roles-for-read-only-queries)
-> + [Scoped access to a single index](#grant-access-to-a-single-index)
+In Azure AI Search, you can assign Azure roles for:
+
++ [Service administration](#assign-roles-for-service-administration)
++ [Development or write-access to a search service](#assign-roles-for-development)
++ [Read-only access for queries](#assign-roles-for-read-only-queries)
++ [Scoped access to a single index](#grant-access-to-a-single-index)
 
 Per-user access over search results (sometimes referred to as *row-level security* or *document-level security*) isn't supported through role assignments. As a workaround, [create security filters](search-security-trimming-for-azure-search.md) that trim results by user identity, removing documents for which the requestor shouldn't have access. See this [Enterprise chat sample using RAG](/azure/developer/python/get-started-app-chat-template) for a demonstration.
 
@@ -32,11 +33,35 @@ Role-based access is optional, but recommended. The alternative is [key-based au
 
 + A search service in any region, on any tier, [enabled for role-based access](search-security-enable-roles.md).
 
-+ Owner, User Access Administrator, or a custom role with [Microsoft.Authorization/roleAssignments/write](/azure/templates/microsoft.authorization/roleassignments) permissions.
++ Owner, User Access Administrator, Role-based Access Control Administrator, or a custom role with [Microsoft.Authorization/roleAssignments/write](/azure/templates/microsoft.authorization/roleassignments) permissions.
+
+## How to assign roles in the portal
+
+The following steps work for all role assignments.
+
+1. Sign in to the [Azure portal](https://portal.azure.com).
+
+1. Navigate to your search service.
+
+1. [Enable role-based access](search-security-enable-roles.md).
+
+1. Select **Access Control (IAM)** in the left navigation pane.
+
+1. Select **+ Add** > **Add role assignment** to start the **Add role assignment** wizard.
 
-<a name = "built-in-roles-used-in-search"></a>
+   :::image type="content" source="media/search-security-rbac/portal-access-control.png" alt-text="Screenshot of the access control page in the Azure portal.":::
 
-## Built-in roles used in Azure AI Search
+1. Select a role. You can assign multiple security principals, whether users or managed identities to a role in one pass through the wizard, but you have to repeat these steps for each role you define.
+
+1. On the **Members** tab, select the Microsoft Entra user or group identity. If you're setting up permissions for another Azure service, select a system or user-managed identity.
+
+1. On the **Review + assign** tab, select **Review + assign** to assign the role.
+
+## Built-in roles used in search
+
+*Data plane* refers to operations against the search service endpoint, such as indexing or queries, or any other operation specified in the [Search Service REST APIs](/rest/api/searchservice/) or equivalent Azure SDK client libraries. 
+
+*Control plane* refers to Azure resource management, such as creating or configuring a search service.
 
 The following roles are built in. If these roles are insufficient, [create a custom role](#create-a-custom-role). 
 
@@ -54,18 +79,47 @@ Combine these roles to get sufficient permissions for your use case.
 > [!NOTE]
 > If you disable Azure role-based access, built-in roles for the control plane (Owner, Contributor, Reader) continue to be available. Disabling role-based access removes just the data-related permissions associated with those roles. If data plane roles are disabled, Search Service Contributor is equivalent to control-plane Contributor.
 
+## Summary
+
+| Permissions | Search Index Data Reader | Search Index Data Contributor | Search Service Contributor | Owner/Contributor | Reader |
+|-------------|--------------------------|-------------------------------|----------------------------|-------------------|--------|
+|View the resource in Azure portal |❌|❌|✅|✅|✅|
+|View resource properties/metrics/endpoint |❌|❌|✅|✅|✅|
+|List all objects on the resource |❌|❌|✅|✅|✅|
+|Access quotas and service statistics |❌|❌|✅|✅|❌|
+|Read/query an index |✅|❌|❌|❌|❌|
+|Upload data for indexing |❌|✅|❌|❌|❌|
+|Create or edit indexes/aliases |❌|❌|✅|✅|❌|
+|Create, edit and run indexers/data sources/skillsets |❌|❌|✅|✅|❌|
+|Create or edit synonym maps |❌|❌|✅|✅|❌|
+|Create or edit debug sessions |❌|❌|✅|✅|❌|
+|Create or manage deployments |❌|❌|✅|✅|❌|
+|Create or configure Azure AI Search resources |❌|❌|✅|✅|❌|
+|View/Copy/Regenerate keys under Keys |❌|❌|✅|✅|❌|
+|View roles/policies/definitions |❌|❌|✅|✅|❌|
+|Set authentication options |❌|❌|✅|✅|❌|
+|Configure private connections |❌|❌|✅|✅|❌|
+|Configure network security |❌|❌|✅|✅|❌|
+
+Owners and Contributors grant the same permissions, except that only Owners can assign roles.
+
+Owners and Contributors can create, read, update, and delete objects in the Azure portal *if API keys are enabled*. The portal uses keys on internal calls to data plane APIs. In you subsequently configure Azure AI Search to use "roles only", then Owner and Contributor won't be able to manage objects in the portal using just those role assignments. The solution is to assign more roles, such as Search Index Data Reader, Search Index Data Contributor, and Search Service Contributor.
+
 ## Assign roles
 
 In this section, assign roles for:
 
-+ [Service administration](#assign-roles-for-service-administration)
++ Service administration
++ Development or write-access to a search service
++ Read-only access for queries
+
+<!-- + [Service administration](#assign-roles-for-service-administration)
 
     | Role | ID|
     | --- | --- |
     |`Owner`|8e3af657-a8ff-443c-a75c-2fe8c4bcb635|
     |`Contributor`|b24988ac-6180-42a0-ab88-20f7382dd24c|
     |`Reader`|acdd72a7-3385-48ef-bd42-f606fba81ae7|
-    
 
 + [Development or write-access to a search service](#assign-roles-for-development)
 
@@ -79,33 +133,28 @@ In this section, assign roles for:
 
     | Role | ID|
     | --- | --- |
-    | `Search Index Data Reader` [with PowerShell](search-security-rbac.md?tabs=roles-portal-admin%2Croles-portal%2Croles-portal-query%2Ctest-portal%2Ccustom-role-portal#grant-access-to-a-single-index)|1407120a-92aa-4202-b7e9-c0e197c71c8f|
+    | `Search Index Data Reader` [with PowerShell](search-security-rbac.md?tabs=roles-portal-admin%2Croles-portal%2Croles-portal-query%2Ctest-portal%2Ccustom-role-portal#grant-access-to-a-single-index)|1407120a-92aa-4202-b7e9-c0e197c71c8f| -->
 
 ### Assign roles for service administration
 
-As a service administrator, you can create and configure a search service, and perform all control plane operations described in the [Management REST API](/rest/api/searchmanagement/) or equivalent client libraries. Depending on the role, you can also perform most data plane [Search REST API](/rest/api/searchservice/) tasks.
+As a service administrator, you can create and configure a search service, and perform all control plane operations described in the [Management REST API](/rest/api/searchmanagement/) or equivalent client libraries. If you're an Owner or Contributor, you can also perform most data plane [Search REST API](/rest/api/searchservice/) tasks in the Azure portal.
 
+| Role | ID|
+| --- | --- |
+|[`Owner`](/azure/role-based-access-control/built-in-roles#owner) |8e3af657-a8ff-443c-a75c-2fe8c4bcb635|
+|[`Contributor`](/azure/role-based-access-control/built-in-roles#contributor)|b24988ac-6180-42a0-ab88-20f7382dd24c|
+|[`Reader`](/azure/role-based-access-control/built-in-roles#reader)|acdd72a7-3385-48ef-bd42-f606fba81ae7|
 
 #### [**Azure portal**](#tab/roles-portal-admin)
 
 1. Sign in to the [Azure portal](https://portal.azure.com).
 
-1. Navigate to your search service.
-
-1. Select **Access Control (IAM)** in the left navigation pane.
-
-1. Select **+ Add** > **Add role assignment**.
-
-1. Select an applicable role:
+1. Assign these roles:
 
    + Owner (full access to all data plane and control plane operations, except for query permissions)
    + Contributor (same as Owner, except for permissions to assign roles)
    + Reader (acceptable for monitoring and viewing metrics)
 
-1. On the **Members** tab, select the Microsoft Entra user or group identity.
-
-1. On the **Review + assign** tab, select **Review + assign** to assign the role.
-
 #### [**PowerShell**](#tab/roles-powershell-admin)
 
 When you [use PowerShell to assign roles](/azure/role-based-access-control/role-assignments-powershell), call [New-AzRoleAssignment](/powershell/module/az.resources/new-azroleassignment), providing the Azure user or group name, and the scope of the assignment.
@@ -124,6 +173,12 @@ New-AzRoleAssignment -SignInName <email> `
 
 Role assignments are global across the search service. To [scope permissions to a single index](#rbac-single-index), use PowerShell or the Azure CLI to create a custom role.
 
+| Task | Role | ID|
+| --- | --- | --- |
+| CRUD operations | [`Search Service Contributor`](/azure/role-based-access-control/built-in-roles#search-service-contributor)|7ca78c08-252a-4471-8644-bb5ff32d4ba0|
+| Load documents, run indexing jobs | [`Search Index Data Contributor`](/azure/role-based-access-control/built-in-roles#search-index-data-contributor)|8ebe5a00-799e-43f5-93ac-243d3dce84a7|
+| Query an index | [`Search Index Data Reader`](/azure/role-based-access-control/built-in-roles#search-index-data-reader)|1407120a-92aa-4202-b7e9-c0e197c71c8f|
+
 Another combination of roles that provides full access is Contributor or Owner, plus Search Index Data Reader.
 
 > [!IMPORTANT]
@@ -133,28 +188,12 @@ Another combination of roles that provides full access is Contributor or Owner,
 
 1. Sign in to the [Azure portal](https://portal.azure.com).
 
-1. Navigate to your search service.
-
-1. Select **Access Control (IAM)** in the left navigation pane.
-
-1. Select **+ Add** > **Add role assignment**.
-
-   ![Access control (IAM) page with Add role assignment menu open.](~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png)
-
-1. Select a role:
+1. Assign these roles:
 
    + Search Service Contributor (create-read-update-delete operations on indexes, indexers, skillsets, and other top-level objects)
    + Search Index Data Contributor (load documents and run indexing jobs)
    + Search Index Data Reader (query an index)
 
-   Another combination of roles that provides full access is Contributor or Owner, plus Search Index Data Reader.
-
-1. On the **Members** tab, select the Microsoft Entra user or group identity.
-
-1. On the **Review + assign** tab, select **Review + assign** to assign the role.
-
-1. Repeat for the other roles. Most developers need all three.
-
 #### [**PowerShell**](#tab/roles-powershell)
 
 When you [use PowerShell to assign roles](/azure/role-based-access-control/role-assignments-powershell), call [New-AzRoleAssignment](/powershell/module/az.resources/new-azroleassignment), providing the Azure user or group name, and the scope of the assignment.
@@ -179,7 +218,11 @@ New-AzRoleAssignment -SignInName <email> `
 
 ### Assign roles for read-only queries
 
-Use the Search Index Data Reader role for apps and processes that only need read-access to an index. 
+Use the Search Index Data Reader role for apps and processes that only need read-access to an index.
+
+| Role | ID|
+| --- | --- |
+| [`Search Index Data Reader`](/azure/role-based-access-control/built-in-roles#search-index-data-reader) [with PowerShell](search-security-rbac.md#grant-access-to-a-single-index)|1407120a-92aa-4202-b7e9-c0e197c71c8f|
 
 This is a very specific role. It grants [GET or POST access](/rest/api/searchservice/documents) to the *documents collection of a search index* for search, autocomplete, and suggestions. It doesn't support GET or LIST operations on an index or other top-level objects, or GET service statistics.
 
@@ -189,17 +232,7 @@ This section provides basic steps for setting up the role assignment and is here
 
 1. Sign in to the [Azure portal](https://portal.azure.com).
 
-1. Navigate to your search service.
-
-1. Select **Access Control (IAM)** in the left navigation pane.
-
-1. Select **+ Add** > **Add role assignment**.
-
-1. Select the **Search Index Data Reader** role.
-
-1. On the **Members** tab, select the Microsoft Entra user or group identity. If you're setting up permissions for another service, you might be using a system or user-managed identity. Choose that option if the role assignment is for a service identity.
-
-1. On the **Review + assign** tab, select **Review + assign** to assign the role.
+1. Assign the **Search Index Data Reader** role.
 
 #### [**PowerShell**](#tab/roles-powershell-query)
 

@@ -59,7 +59,6 @@ Currently, several regions are at capacity for specific tiers and can't be used
 
 | Region | Disabled tier (SKU) due to over-capacity | Suggested alternative |
 |--------|------------------------------------------|-----------------------|
-| Central India | S2, S3, S3HD, L1, L2| South India |
 | East US 2| Basic, S1| Central US |
 | South Central US | All tiers | Central US |
 | US Gov Virginia | All tiers | US Gov Arizona |

@@ -155,7 +155,7 @@ If the synonym map exists on the search service, it's used on the next query, wi
 Use the [Create or Update Index (REST API)](/rest/api/searchservice/indexes/create-or-update) to modify a field definition.
 
 ```http
-POST /indexes?api-version=2024-07-01
+PUT /indexes?api-version=2024-07-01
 {
     "name":"hotels-sample-index",
     "fields":[