@@ -370,7 +370,6 @@
             "redirect_url": "/azure/search/search-what-is-data-import",
             "redirect_document_id": true
         },
-
         {
             "source_path_from_root": "/articles/search/search-get-started-management-api.md",
             "redirect_url": "/rest/api/searchmanagement/",
@@ -427,24 +426,24 @@
             "redirect_document_id": false
         },
         {
-            "source_path_from_root": "/articles/search/tutorial-multimodal-indexing-with-embedding-and-doc-extraction.md",
-            "redirect_url": "/azure/search/tutorial-document-extraction-multimodal-embeddings",
-            "redirect_document_id": true
+            "source_path_from_root": "/articles/search/tutorial-document-extraction-multimodal-embeddings.md",
+            "redirect_url": "/azure/search/tutorial-multimodal",
+            "redirect_document_id": false
         },
         {
-            "source_path_from_root": "/articles/search/tutorial-multimodal-indexing-with-image-verbalization-and-doc-extraction.md",
-            "redirect_url": "/azure/search/tutorial-document-extraction-image-verbalization",
-            "redirect_document_id": true
+            "source_path_from_root": "/articles/search/tutorial-document-extraction-image-verbalization.md",
+            "redirect_url": "/azure/search/tutorial-multimodal",
+            "redirect_document_id": false
         },
         {
-            "source_path_from_root": "/articles/search/tutorial-multimodal-index-embeddings-skill.md",
-            "redirect_url": "/azure/search/tutorial-document-layout-multimodal-embeddings",
-            "redirect_document_id": true
+            "source_path_from_root": "/articles/search/tutorial-document-layout-multimodal-embeddings.md",
+            "redirect_url": "/azure/search/tutorial-multimodal",
+            "redirect_document_id": false
         },
         {
-            "source_path_from_root": "/articles/search/tutorial-multimodal-index-image-verbalization-skill.md",
-            "redirect_url": "/azure/search/tutorial-document-layout-image-verbalization",
-            "redirect_document_id": true
+            "source_path_from_root": "/articles/search/tutorial-document-layout-image-verbalization.md",
+            "redirect_url": "/azure/search/tutorial-multimodal",
+            "redirect_document_id": false
         },
         {
             "source_path_from_root": "/articles/search/search-get-started-rest.md",
@@ -650,6 +649,11 @@
             "source_path_from_root": "/articles/search/keyless-connections.md",
             "redirect_url": "/azure/search/search-security-rbac-client-code",
             "redirect_document_id": true
+        },
+        {
+            "source_path_from_root": "/articles/search/search-security-overview.md",
+            "redirect_url": "/azure/search/search-security-built-in",
+            "redirect_document_id": true
         }
     ]
   }
\ No newline at end of file

@@ -273,7 +273,7 @@ Billing goes into effect when API calls to a Foundry resource exceed 20 API call
 
 Keyless and key-based connections are used for billing, but not for connections related to enrichment operations.
 
-For key-based connections, a search service [connects over the internal network](search-security-overview.md#internal-traffic) to a Foundry resource located in the [same physical region](search-region-support.md). Most regions that offer Azure AI Search also offer other Azure services. If you attempt AI enrichment in a region that doesn't have both services, you see this message: "Provided key isn't a valid CognitiveServices type key for the region of your search service."
+For key-based connections, a search service [connects over the internal network](search-security-built-in.md#internal-traffic-protection) to a Foundry resource located in the [same physical region](search-region-support.md). Most regions that offer Azure AI Search also offer other Azure services. If you attempt AI enrichment in a region that doesn't have both services, you see this message: "Provided key isn't a valid CognitiveServices type key for the region of your search service."
 
 For keyless connections, a search service authenticates using its identity and role assignment and targets a Foundry resource. The resource is specified as a fully qualified URI, and the URI includes a unique subdomain.
 

@@ -32,10 +32,7 @@ The Azure Content Understanding skill is bound to a [billable Microsoft Foundry
 Azure AI resource skills, such as the [Document Layout skill](/azure/search/cognitive-search-skill-document-intelligence-layout), the Azure Content Understanding skill doesn't provide 20 free documents per indexer per day. Execution of this skill is charged at the [Azure Content Understanding price](https://azure.microsoft.com/pricing/details/content-understanding/).
 
 > [!TIP]
-> You can use the Azure Content Understanding skill in a skillset that also performs image verbalization and chunk vectorization. In the following tutorials, replace the Document Layout skill with the Azure Content Understanding skill.
->
-> + [Tutorial: Verbalize images from a structured document layout](tutorial-document-layout-image-verbalization.md)
-> + [Tutorial: Vectorize from a structured document layout](tutorial-document-layout-multimodal-embeddings.md)
+> You can use the Azure Content Understanding skill in a skillset that also performs image verbalization and chunk vectorization. In the [multimodal tutorial](tutorial-multimodal.md), replace the Document Layout skill with the Azure Content Understanding skill.
 
 ## Limitations
 

@@ -16,11 +16,7 @@ ms.update-cycle: 365-days
 
 The **Document Extraction** skill extracts content from a file in the [enrichment pipeline](cognitive-search-concept-intro.md). By default, content extraction or retrieval is built into the enrichment pipeline. However, by using the Document Extraction skill, you can control how parameters are set, and how extracted content is named in the enrichment tree.
 
-For [vector](vector-search-overview.md) and [multimodal search](multimodal-search-overview.md), Document Extraction combined with the [Text Split skill](cognitive-search-skill-textsplit.md) is more affordable than other [data chunking approaches](vector-search-how-to-chunk-documents.md). The following tutorials demonstrate skill usage for different scenarios:
-
-+ [Tutorial: Vectorize images and text](tutorial-document-extraction-multimodal-embeddings.md)
-
-+ [Tutorial: Verbalize images using generative AI](tutorial-document-extraction-image-verbalization.md)
+For [vector](vector-search-overview.md) and [multimodal search](multimodal-search-overview.md), Document Extraction combined with the [Text Split skill](cognitive-search-skill-textsplit.md) is more affordable than other [data chunking approaches](vector-search-how-to-chunk-documents.md). The [Multimodal tutorial](tutorial-multimodal.md) demonstrates this scenario.
 
 > [!NOTE]
 > This skill isn't bound to Foundry Tools and has no Foundry Tools key requirement.

@@ -22,10 +22,7 @@ For transactions that exceed 20 documents per indexer per day, this skill requir
 This article is the reference documentation for the Document Layout skill. For usage information, see [How to chunk and vectorize by document layout](search-how-to-semantic-chunking.md).
 
 > [!TIP]
-> It's common to use this skill on content that has structure and images, such as PDFs. The following tutorials demonstrate image verbalization with two different data chunking techniques:
->
-> - [Tutorial: Verbalize images from a structured document layout](tutorial-document-layout-image-verbalization.md)
-> - [Tutorial: Vectorize from a structured document layout](tutorial-document-layout-multimodal-embeddings.md)
+> It's common to use this skill on content that has structure and images, such as PDFs. The [Multimodal tutorial](tutorial-multimodal.md) demonstrates image verbalization with two different data chunking strategies.
 
 ## Limitations
 

@@ -27,10 +27,7 @@ Here are some examples of how the GenAI prompt skill can help you create content
 The GenAI Prompt skill is available in the [latest preview REST API](/rest/api/searchservice/skillsets/create?view=rest-searchservice-2025-11-01-preview&preserve-view=true). This skill supports text, image, and multimodal content, such as images with visuals and text extracted from PDF files.
 
 > [!TIP]
-> It's common to use this skill combined with a data chunking skill. The following tutorials demonstrate image verbalization with two different data chunking techniques:
->
-> - [Tutorial: Verbalize images using generative AI](tutorial-document-extraction-image-verbalization.md)
-> - [Tutorial: Verbalize images from a structured document layout](tutorial-document-layout-image-verbalization.md)
+> It's common to use this skill combined with a data chunking skill. The [Multimodal tutorial](tutorial-multimodal.md) demonstrates image verbalization with two different data chunking strategies.
 >
 
 ## Supported models

@@ -6,7 +6,7 @@ author: HeidiSteen
 ms.author: heidist
 ms.service: azure-ai-search
 ms.topic: how-to
-ms.date: 08/27/2025
+ms.date: 02/24/2026
 ms.update-cycle: 180-days
 ms.custom:
   - ignite-2023
@@ -18,9 +18,12 @@ ms.custom:
 > [!IMPORTANT] 
 > This feature is in public preview under [supplemental terms of use](https://azure.microsoft.com/support/legal/preview-supplemental-terms/). [Preview REST APIs](/rest/api/searchservice/index-preview) support this feature.
 
-This article explains how to add caching to an enrichment pipeline so that you can modify downstream enrichment steps without having to rebuild in full every time. By default, a skillset is stateless, and changing any part of its composition requires a full rerun of the indexer. With an *enrichment cache*, the indexer can determine which parts of the document tree must be refreshed based on changes detected in the skillset or indexer definitions. Existing processed output is preserved and reused wherever possible. 
+This article explains how to add caching to a skillset pipeline so that you can modify downstream enrichment steps without a full rebuild every time. By default, a skillset is stateless, and changing any part of its composition requires a full rerun of the indexer. With an *enrichment cache*, the indexer determines which parts of the document tree must be refreshed based on skillset or indexer definition changes. Existing processed output is preserved and reused where possible.
 
-Cached content is placed in Azure Storage using account information that you provide. The container, named `ms-az-search-indexercache-<alpha-numerc-string>`, is created when you run the indexer. It should be considered an internal component managed by your search service and must not be modified.
+Cached content is placed in Azure Storage using a connection string that you provide. These objects are created when you run the indexer. It should be considered an internal component managed by your search service and must not be modified.
+
++ A container named `ms-az-search-indexercache-<alpha-numeric-string>`
++ Tables named `MsAzSearchIndexerCacheIndex<alpha-numeric-string>`
 
 ## Prerequisites
 
@@ -37,146 +40,94 @@ You should be familiar with setting up indexers and skillsets. Start with [index
 
 ## Permissions
 
-Azure AI Search needs write-access to Azure Storage. If you're using a managed identity for your search service, make sure it's assigned to the **Storage Blob Data Contributor** and **Storage Table Data Contributor** roles. For more information, see [Connect to Azure Storage using a managed identity (Azure AI Search)](search-howto-managed-identities-storage.md).
+An Azure AI Search identity needs write-access to Azure Storage:
 
-## Enable on new indexers
++ **Storage Blob Data Contributor**
++ **Storage Table Data Contributor**
 
-You can use the Azure portal, preview APIs, or preview Azure SDK packages to enable an enrichment cache on an indexer.
+The connection string syntax determines whether a system-assigned or user-assigned identity is used. For more information, see [Connect to Azure Storage using a managed identity](search-howto-managed-identities-storage.md).
 
-### [**Azure portal**](#tab/portal)
+## Set the cache property
 
-1. On the left, select **Indexers**, and then select **Add indexer**.
-1. Provide an indexer name and an existing index, data source, and skillset.
-1. Enable incremental caching and set the Azure Storage account.
+Use this procedure for both new and existing indexers.
 
-   :::image type="content" source="media/search-incremental-index/portal-option.png" alt-text="Screenshot of the Azure portal option for enrichment cache.":::
-
-### [**REST**](#tab/rest)
+In the indexer definition, set `cache` with:
 
-On new indexers, add the `cache` property in the indexer definition payload when calling Create or Update Indexer.
-
-We recommend the latest preview REST API for [Create or Update Indexer](/rest/api/searchservice/indexers/create-or-update?view=rest-searchservice-2025-11-01-preview&preserve-view=true).
-
-```https
-POST https://[service name].search.windows.net/indexers?api-version=2025-11-01-preview
-    {
-        "name": "<YOUR-INDEXER-NAME>",
-        "targetIndexName": "<YOUR-INDEX-NAME>",
-        "dataSourceName": "<YOUR-DATASOURCE-NAME>",
-        "skillsetName": "<YOUR-SKILLSET-NAME>",
-        `cache` : {
-            "storageConnectionString" : "<YOUR-STORAGE-ACCOUNT-CONNECTION-STRING>",
-            "enableReprocessing": true
-        },
-    "fieldMappings" : [],
-    "outputFieldMappings": [],
-    "parameters": []
-    }
-```
-
----
++ (Required) `storageConnectionString` set to an Azure Storage connection string.
++ (Optional) `enableReprocessing` (`true` by default). Set it to `false` to suspend incremental enrichment temporarily, and switch it back to `true` later.
 
-## Enable on existing indexers
-
-For existing indexers that already have a skillset, use the following steps to add caching. As a one-time operation, reset and rerun the indexer in full to load the cache.
-
-### Step 1: Get the indexer definition
-
-Start with a valid, work indexer that has these components: data source, skillset, index. Using an API client, send a [GET Indexer](/rest/api/searchservice/indexers/get?view=rest-searchservice-2025-11-01-preview&preserve-view=true) request to retrieve the indexer. When you use the preview API version to the GET the indexer, a `cache` property set to null is added to the definition automatically.
-
-```http
-GET https://[YOUR-SEARCH-SERVICE].search.windows.net/indexers/[YOUR-INDEXER-NAME]?api-version=2025-11-01-preview
-    Content-Type: application/json
-    api-key: [YOUR-ADMIN-KEY]
-```
-
-### Step 2: Set the cache property
+### [**Azure portal**](#tab/portal)
 
-In the index definition, modify `cache` to include the following required and optional properties:
+1. On the left, select **Indexers**.
+1. Select **Add indexer** to create a new indexer, or open an existing one in JSON edit mode.
+1. Enable incremental enrichment, set the enrichment cache storage account, and save the indexer.
 
-+ (Required) `storageConnectionString` must be set to an Azure Storage connection string.
-+ (Optional) `enableReprocessing` boolean property (`true` by default), indicates that incremental enrichment is enabled. Set to `false` if you want to suspend incremental processing while other resource-intensive operations, such as indexing new documents, are underway and then switch back to `true` later.
+   :::image type="content" source="media/search-incremental-index/portal-option.png" alt-text="Screenshot of the Azure portal option for enrichment cache.":::
 
-```http
-POST https://[service name].search.windows.net/indexers?api-version=2025-11-01-preview
-    {
-        "name": "<YOUR-INDEXER-NAME>",
-        "targetIndexName": "<YOUR-INDEX-NAME>",
-        "dataSourceName": "<YOUR-DATASOURCE-NAME>",
-        "skillsetName": "<YOUR-SKILLSET-NAME>",
-        `cache` : {
-            "storageConnectionString" : "<YOUR-STORAGE-ACCOUNT-CONNECTION-STRING>",
-            "enableReprocessing": true
-        },
-        "fieldMappings" : [],
-        "outputFieldMappings": [],
-        "parameters": []
-    }
-```
+1. Reset the indexer if it already exists.
 
-### Step 3: Reset the indexer
+1. Run the indexer. This one-time full rebuild seeds the cache. After it's loaded, incremental reuse applies on subsequent runs.
 
-[Reset Indexer](/rest/api/searchservice/indexers/reset) is required when setting up incremental enrichment for existing indexers to ensure all documents are in a consistent state. You can use the Azure portal or an API client for this task.
+### [**REST**](#tab/rest)
 
-```https
-POST https://[YOUR-SEARCH-SERVICE].search.windows.net/indexers/[YOUR-INDEXER-NAME]/reset?api-version=2025-11-01-preview
-    Content-Type: application/json
-    api-key: [YOUR-ADMIN-KEY]
-```
+We recommend that you do a [GET Indexer](/rest/api/searchservice/indexers/get?view=rest-searchservice-2025-11-01-preview&preserve-view=true) if you're editing an existing indexer.
+
+1. Use the latest preview API for [Create or Update Indexer](/rest/api/searchservice/indexers/create-or-update?view=rest-searchservice-2025-11-01-preview&preserve-view=true).
+
+    ```http
+    PUT https://[YOUR-SEARCH-SERVICE].search.windows.net/indexers/[YOUR-INDEXER-NAME]?api-version=2025-11-01-preview
+        Content-Type: application/json
+        api-key: [YOUR-ADMIN-KEY]
+        {
+            "name": "<YOUR-INDEXER-NAME>",
+            "targetIndexName": "<YOUR-INDEX-NAME>",
+            "dataSourceName": "<YOUR-DATASOURCE-NAME>",
+            "skillsetName": "<YOUR-SKILLSET-NAME>",
+            "cache": {
+                "storageConnectionString": "<YOUR-STORAGE-ACCOUNT-CONNECTION-STRING>",
+                "enableReprocessing": true
+            },
+            "fieldMappings": [],
+            "outputFieldMappings": [],
+            "parameters": []
+        }
+    ```
 
-### Step 4: Save the indexer
+1. [Reset the indexer](/rest/api/searchservice/indexers/reset) if it already exists.
 
-[Update Indexer](/rest/api/searchservice/indexers/create-or-update?view=rest-searchservice-2025-11-01-preview&preserve-view=true) with a PUT request, where the body of the request includes `cache`.
+1. [Run the indexer](/rest/api/searchservice/indexers/run). This one-time full rebuild seeds the cache. After it's loaded, incremental reuse applies on subsequent runs.
 
-```http
-PUT https://[YOUR-SEARCH-SERVICE].search.windows.net/indexers/[YOUR-INDEXER-NAME]?api-version=2025-11-01-preview
-    Content-Type: application/json
-    api-key: [YOUR-ADMIN-KEY]
-    {
-        "name" : "<YOUR-INDEXER-NAME>",
-        ...
-        `cache`: {
-            "storageConnectionString": "<YOUR-STORAGE-ACCOUNT-CONNECTION-STRING>",
-            "enableReprocessing": true
-        }
-    }
-```
+    ```http
+    POST https://[YOUR-SEARCH-SERVICE].search.windows.net/indexers/[YOUR-INDEXER-NAME]/run?api-version=2025-11-01-preview
+        Content-Type: application/json
+        api-key: [YOUR-ADMIN-KEY]
+    ```
 
 If you now issue another GET request on the indexer, the response from the service includes an `ID` property in the cache object. The string is appended to the name of the container containing all the cached results and intermediate state of each document processed by this indexer. The ID is used to uniquely name the cache in Blob storage.
 
 ```http
-    `cache`: {
+    "cache": {
         "ID": "<ALPHA-NUMERIC STRING>",
         "enableReprocessing": true,
         "storageConnectionString": "DefaultEndpointsProtocol=https;AccountName=<YOUR-STORAGE-ACCOUNT>;AccountKey=<YOUR-STORAGE-KEY>;EndpointSuffix=core.windows.net"
     }
 ```
 
-### Step 5: Run the indexer
-
-To run indexer, you can use the Azure portal or the API. In the Azure portal, from the indexers list, select the indexer and select **Run**. One advantage to using the Azure portal is that you can monitor indexer status, note the duration of the job, and how many documents are processed. Portal pages are refreshed every few minutes.
-
-Alternatively, you can use REST to [run the indexer](/rest/api/searchservice/indexers/run):
+## Check for cached output
 
-```http
-POST https://[YOUR-SEARCH-SERVICE].search.windows.net/indexers/[YOUR-INDEXER-NAME]/run?api-version=2025-11-01-preview
-Content-Type: application/json
-api-key: [YOUR-ADMIN-KEY]
-```
+1. Sign in to the Azure portal and find your Azure Storage account.
 
-> [!NOTE]
-> A reset and rerun of the indexer results in a full rebuild so that content can be cached. All cognitive enrichments will be rerun on all documents. Reusing enriched content from the cache begins after the cache is loaded.
->
+1. Use Storage Browser to review containers and tables.
 
-## Check for cached output
+   + The container name is  `ms-az-search-indexercache-<some-alphanumeric-string>`.
 
-Find the cache in Azure Storage, under Blob container. The container name is  `ms-az-search-indexercache-<some-alphanumeric-string>`.
+   + Table names are `MsAzSearchIndexerCacheIndex<alpha-numeric-string>`
 
 A cache is created and used by an indexer. Its content isn't human readable.
 
-To verify whether the cache is operational, modify a skillset and run the indexer, then compare before-and-after metrics for execution time and document counts. 
+To verify whether the cache is operational, modify a skillset and run the indexer, then compare before-and-after metrics for execution time and document count.
 
-Skillsets that include image analysis and Optical Character Recognition (OCR) of scanned documents make good test cases. If you modify a downstream text skill or any skill that isn't image-related, the indexer can retrieve all of the previously processed image and OCR content from cache, updating and processing only the text-related changes indicated by your edits.  You can expect to see fewer documents in the indexer execution document count, shorter execution times, and fewer charges on your bill. 
+Skillsets that include image analysis and Optical Character Recognition (OCR) of scanned documents make good test cases. If you modify a downstream text skill or any skill that isn't image-related, the indexer can retrieve previously processed image and OCR content from cache, and process only text-related changes from your edits. You can expect fewer documents in indexer execution counts, shorter execution times, and lower costs.
 
 The [file set](https://github.com/Azure-Samples/azure-search-sample-data/tree/main/ai-enrichment-mixed-media) used in [cog-search-demo tutorials](tutorial-skillset.md) is a useful test case because it contains 14 files of various formats JPG, PNG, HTML, DOCX, PPTX, and other types. Change `en` to `es` or another language in the text translation skill for proof-of-concept testing of incremental enrichment.
 

@@ -6,7 +6,7 @@ author: HeidiSteen
 ms.author: heidist
 ms.service: azure-ai-search
 ms.topic: how-to
-ms.date: 08/27/2025
+ms.date: 02/24/2026
 ms.update-cycle: 180-days
 ms.custom:
   - ignite-2023
@@ -20,7 +20,7 @@ ms.custom:
 
 An *enrichment cache* is an optional feature that stores reusable enriched content created during [skillset execution](cognitive-search-working-with-skillsets.md) so that only new and changed skills and documents incur standard processing charges during future indexer and skillset processing. 
 
-The cache contains the output from [document cracking](search-indexer-overview.md#document-cracking), plus the outputs of each skill for every document. Although caching is billable (it uses Azure Storage), the overall cost of enrichment is reduced because the costs of storage are less than image extraction and AI processing.
+The enrichment cache is created in Azure Storage. The cache contains the output from [document cracking](search-indexer-overview.md#document-cracking), plus the outputs of each skill for every document. Although caching is billable (it uses Azure Storage), the overall cost of enrichment is reduced because the costs of storage are less than image extraction and AI processing.
 
 If you have configured an enrichment cache, this article explains how to manage skill and data source updates so that you get maximum utility from cached enrichments.
 
@@ -37,14 +37,12 @@ If you have configured an enrichment cache, this article explains how to manage
 
 ## Cache configuration
 
-Physically, the cache is stored in a blob container or table in your Azure Storage account, one per indexer. Each indexer is assigned a unique and immutable cache identifier that corresponds to the container it's using.
+Physically, the cache is stored in a blob container and tables in your Azure Storage account, one per indexer. Each indexer is assigned a unique and immutable cache identifier that corresponds to the container it's using.
 
-The cache is created when you specify the "cache" property and run the indexer. Only enriched content can be cached. If your indexer doesn't have an attached skillset, then caching doesn't apply. 
+The cache is created when you specify the `cache` property and run the indexer. Only enriched content can be cached. If your indexer doesn't have an attached skillset, then caching doesn't apply. 
 
 The following example illustrates an indexer with caching enabled. See [Configure enrichment caching](enrichment-cache-how-to-configure.md) for full instructions. 
 
-To set the cache property, use latest preview REST API for [Create or Update Indexer](/rest/api/searchservice/indexers/create-or-update?view=rest-searchservice-2025-11-01-preview&preserve-view=true) or a preview Azure SDK package that provides the feature. You can also enable enrichment caching in the Import data wizard in the Azure portal.
-
 ```json
 POST https://[YOUR-SEARCH-SERVICE-NAME].search.windows.net/indexers?api-version=2025-11-01-preview
     {
@@ -66,7 +64,7 @@ POST https://[YOUR-SEARCH-SERVICE-NAME].search.windows.net/indexers?api-version=
 
 The lifecycle of the cache is managed by the indexer. If an indexer is deleted, its cache is also deleted. If the `cache` property on the indexer is set to null or the connection string is changed, the existing cache is deleted on the next indexer run. 
 
-While incremental enrichment is designed to detect and respond to changes with no intervention on your part, there are parameters you can use to invoke specific behaviors:
+While incremental enrichment is designed to detect and respond to changes with no intervention on your part, you can set parameters to invoke specific behaviors:
 
 + [Prioritize new documents](#Prioritize-new-documents)
 + [Bypass skillset checks](#Bypass-skillset-checks)
@@ -77,9 +75,9 @@ While incremental enrichment is designed to detect and respond to changes with n
 
 ### Prioritize new documents
 
-The cache property includes an `enableReprocessing` parameter. It's used to control processing over incoming documents already represented in the cache. When true (default), documents already in the cache are reprocessed when you rerun the indexer, assuming your skill update affects that doc. 
+The `cache` property includes an `enableReprocessing` parameter that controls whether cached content is reprocessed. When true (default), cached documents are reprocessed when you rerun the indexer if a skill update affects them.
 
-When false, existing documents aren't reprocessed, effectively prioritizing new, incoming content over existing content. You should only set enableReprocessing to false on a temporary basis. Having enableReprocessing set to true most of the time ensures that all documents, both new and existing, are valid per the current skillset definition.
+When false, existing documents aren't reprocessed, effectively prioritizing new content. Set `enableReprocessing` to false only temporarily. Keeping it true most of the time ensures that both new and existing documents remain valid for the current skillset definition.
 
 <a name="Bypass-skillset-checks"></a>
 

@@ -0,0 +1,27 @@
+---
+title: Include File
+description: Include file for Azure AI Search authentication to Microsoft Foundry.
+author: haileytap 
+ms.author: haileytapia 
+ms.service: azure-ai-search
+ms.topic: include
+ms.date: 02/11/2026
+# Use this file to describe authentication for Foundry-integrated scenarios.
+---
+
+Azure AI Search connects to Microsoft Foundry models for certain skills, vectorizers, and agentic retrieval workloads. You can configure this connection to use Microsoft Entra ID authentication and role-based access.
+
+To configure the recommended role-based access:
+
+1. [Create a managed identity](../search-security-enable-roles.md) for your search service.
+
+1. [Assign the following roles](/azure/ai-foundry/concepts/rbac-foundry) in your Azure OpenAI resource or Microsoft Foundry resource.
+
+    | Target Endpoint | Required Role | Scope |
+    |-|-|-|
+    | GPT-4/5 & text-embedding-3 | Cognitive Services OpenAI User | Azure OpenAI Resource |
+    | Azure AI Vision multimodal 4.0 | Cognitive Services User | Azure AI Multi-service Resource |
+    | Content Understanding  | Cognitive Services User | Microsoft Foundry Resource |
+    | Foundry Model Orchestration | Azure AI User | Foundry Project |
+
+1. Choose **Managed identity** and then assign your [search service managed identity](search-how-to-managed-identities.md).

@@ -118,8 +118,5 @@ To help you get started with multimodal search in Azure AI Search, here's a coll
 | Content | Description |
 |--|--|
 | [Quickstart: Multimodal search in the Azure portal](search-get-started-portal-image-search.md) | Create and test a multimodal index in the Azure portal using the wizard and Search Explorer. |
-| [Tutorial: Verbalize images using generative AI](tutorial-document-extraction-image-verbalization.md) | Extract text and images, verbalize diagrams, and embed the resulting descriptions and text into a searchable index. |
-| [Tutorial: Vectorize images and text](tutorial-document-extraction-multimodal-embeddings.md) | Use a vision-text model to embed both text and images directly, enabling visual-similarity search over scanned PDFs. |
-| [Tutorial: Verbalize images from a structured document layout](tutorial-document-layout-image-verbalization.md) | Apply layout-aware chunking and diagram verbalization, capture location metadata, and store cropped images for precise citations and page highlights. |
-| [Tutorial: Vectorize from a structured document layout](tutorial-document-layout-multimodal-embeddings.md) | Combine layout-aware chunking with unified embeddings for hybrid semantic and keyword search that returns exact hit locations. |
+| [Multimodal tutorial](tutorial-multimodal.md) | Extract text and images, chunk data, and vectorize the chunks for similarity search and other retrieval patterns. |
 | [Sample app: Multimodal RAG GitHub repository](https://aka.ms/azs-multimodal-sample-app-repo) | An end-to-end, code-ready RAG application with multimodal capabilities that surfaces both text snippets and image annotations. Ideal for jump-starting enterprise copilots. |

@@ -134,7 +134,7 @@ The following sections explain how each approach solves specific RAG challenges.
 + Filter-based security at query time for other data sources
 + Network isolation via private endpoints
 
-[Learn more about security](search-security-overview.md).
+[Learn more about security](search-security-built-in.md).
 
 <!-- OLD INTRO
 Retrieval-augmented Generation (RAG) is a design pattern in AI that augments the capabilities of a pretrained large language model (LLM) by adding newer, specialized, or proprietary content to help answer questions. To get that content, you typically need an information retrieval component. Azure AI Search is an information retrieval solution that's designed to solve the challenges of RAG implementations.

@@ -41,7 +41,7 @@ Some properties are fixed for the lifetime of the search service. Before you cre
 | [Name](#name-your-service) | Becomes part of the URL endpoint. The name must be unique and follow naming rules. |
 | [Region](search-region-support.md) | Determines data residency and availability of certain features. For example, semantic ranker and Azure AI integration have region requirements. Choose a region that supports the features you need. |
 | [Tier](search-sku-tier.md) | Determines infrastructure, service limits, and billing. Some features aren't available on lower or specialized tiers. After you create your service, you can [switch between Basic and Standard (S1, S2, and S3) tiers](search-capacity-planning.md#change-your-pricing-tier). |
-| [Compute type](search-security-overview.md#data-in-use) | Determines virtualization and security model. You can choose between standard VMs (recommended) and confidential VMs, which are intended for select workloads requiring data-in-use privacy and isolation. |
+| [Compute type](search-security-best-practices.md#optional-enable-confidential-computing) | Determines virtualization and security model. You can choose between standard VMs (recommended) and confidential VMs, which are intended for select workloads requiring data-in-use privacy and isolation. |
 ## Subscribe to Azure
 
 Azure AI Search requires a free or Standard Azure subscription.
@@ -149,7 +149,7 @@ The compute type determines the virtualization and security model used to deploy
 
 + **Confidential** (10% surcharge) uses [Azure confidential computing](/azure/confidential-computing/use-cases-scenarios) to isolate processing in a hardware-based trusted execution environment, protecting unencrypted data in use from unauthorized access. Recommended only if you have advanced privacy, compliance, or regulatory requirements.
 
-Confidential computing has limited regional availability, disables or restricts certain features, and increases the cost of running your search service. For a detailed comparison of both compute types, see [Data in use](search-security-overview.md#data-in-use).
+Confidential computing has limited regional availability, disables or restricts certain features, and increases the cost of running your search service. For a detailed comparison of both compute types, see [(Optional) Enable confidential computing](search-security-best-practices.md#optional-enable-confidential-computing).
 
 ## Create your service
 

@@ -195,7 +195,7 @@ sections:
       - question: |
           Does Azure AI Search send customer data to other services for processing?
         answer: |
-          Yes. Skills and vectorizers make [outbound calls from Azure AI Search](search-security-overview.md) to other Azure resources or external models that you specify for embedding or chat. Calls to those APIs typically contain raw content to be processed or queries that are vectorized by an embedding model. For Azure-to-Azure connections, the service sends requests over the internal network. If you add a custom skill or vectorizer, the indexer sends content to the URI provided in the custom skill over the public network unless you configure a [shared private link](search-indexer-howto-access-private.md).
+          Yes. Skills and vectorizers make [outbound calls from Azure AI Search](search-security-best-practices.md#configure-outbound-connections) to other Azure resources or external models that you specify for embedding or chat. Calls to those APIs typically contain raw content to be processed or queries that are vectorized by an embedding model. For Azure-to-Azure connections, the service sends requests over the internal network. If you add a custom skill or vectorizer, the indexer sends content to the URI provided in the custom skill over the public network unless you configure a [shared private link](search-indexer-howto-access-private.md).
 
       - question: |
           Does Azure AI Search process customer data in other regions?

@@ -83,7 +83,7 @@ The following table summarizes features by category. There's feature parity in a
 | Category                             | Features |
 |-------------------|----------|
 | Network security | [**IP rules for inbound firewall support**](service-configure-firewall.md) allows you to set up IP ranges over which the search service accepts requests. </br></br>[**Create a private endpoint**](service-create-private-endpoint.md) using Azure Private Link to force all requests through a virtual network. </br></br>[**Network security perimeter**](search-security-network-security-perimeter.md) support allows you to join Azure AI Search to a network security perimeter that includes other Azure resources so that you can manage network access holistically. |
-| Data encryption | [**Microsoft-managed encryption-at-rest**](search-security-overview.md#encryption) is built into the internal storage layer and is irrevocable. </br></br>[**Customer-managed encryption keys (CMK)**](search-security-manage-encryption-keys.md) that you create and manage in Azure Key Vault can be used for supplemental encryption of indexes and synonym maps. For services created after August 1 2020, CMK encryption extends to data on temporary disks, for full double encryption of indexed content.|
+| Data encryption | [**Microsoft-managed encryption-at-rest**](search-security-built-in.md#data-encryption) is built into the internal storage layer and is irrevocable. </br></br>[**Customer-managed encryption keys (CMK)**](search-security-manage-encryption-keys.md) that you create and manage in Azure Key Vault can be used for supplemental encryption of indexes and synonym maps. For services created after August 1 2020, CMK encryption extends to data on temporary disks, for full double encryption of indexed content.|
 | Inbound access | [**Role-based access control**](search-security-rbac.md) assigns roles to users and groups in Microsoft Entra ID for controlled access to search content and operations. You can also use [**key-based authentication**](search-security-api-keys.md) if you don't want to use role assignments. </br></br>[**Document-level access control (preview)**](search-document-level-access-overview.md) filters out search results that a user isn't authorized to see. For several data sources, if the data source provides an access control model, you can configure an index to inherit the user permission metadata. |
 | Outbound security (indexers) | [**Data connections through private endpoints**](search-indexer-howto-access-private.md) allows an indexer to connect to Azure resources that are protected through Azure Private Link. </br></br>[**Data connections through managed identities**](search-how-to-managed-identities.md) authenticates connections to Azure resources using a Microsoft Entra security principal, which eliminates storage and passing of hardcoded API keys.</br></br>[**Data access using a trusted identity**](search-how-to-managed-identities.md) means that connection strings to external data sources can omit user names and passwords. When an indexer connects to the data source, the resource allows the connection if the search service was previously registered as a trusted service (applies to Azure Storage only). |
 

@@ -22,7 +22,7 @@ In this quickstart, you use an Azure Resource Manager (ARM) template to deploy a
 
 [!INCLUDE [About Azure Resource Manager](~/reusable-content/ce-skilling/azure/includes/resource-manager-quickstart-introduction.md)]
 
-Only those properties included in the template are used in the deployment. If more customization is required, such as [setting up network security](search-security-overview.md#network-security), you can update the service as a post-deployment task. To customize an existing service with the fewest steps, use [Azure CLI](search-manage-azure-cli.md) or [Azure PowerShell](search-manage-powershell.md). If you're evaluating preview features, use the [Management REST API](search-manage-rest.md).
+Only those properties included in the template are used in the deployment. If more customization is required, such as [setting up network security](search-security-best-practices.md#configure-network-security), you can update the service as a post-deployment task. To customize an existing service with the fewest steps, use [Azure CLI](search-manage-azure-cli.md) or [Azure PowerShell](search-manage-powershell.md). If you're evaluating preview features, use the [Management REST API](search-manage-rest.md).
 
 Assuming your environment meets the prerequisites and you're familiar with using ARM templates, select the **Deploy to Azure** button. The template will open in the Azure portal.
 

@@ -21,7 +21,7 @@ In this quickstart, you use a Bicep file to deploy an Azure AI Search service in
 
 [!INCLUDE [About Bicep](~/reusable-content/ce-skilling/azure/includes/resource-manager-quickstart-bicep-introduction.md)]
 
-Only those properties included in the template are used in the deployment. If more customization is required, such as [setting up network security](search-security-overview.md#network-security), you can update the service as a post-deployment task. To customize an existing service with the fewest steps, use [Azure CLI](search-manage-azure-cli.md) or [Azure PowerShell](search-manage-powershell.md). If you're evaluating preview features, use the [Management REST API](search-manage-rest.md).
+Only those properties included in the template are used in the deployment. If more customization is required, such as [setting up network security](search-security-best-practices.md#configure-network-security), you can update the service as a post-deployment task. To customize an existing service with the fewest steps, use [Azure CLI](search-manage-azure-cli.md) or [Azure PowerShell](search-manage-powershell.md). If you're evaluating preview features, use the [Management REST API](search-manage-rest.md).
 
 > [!TIP]
 > For an alternative Bicep template that deploys Azure AI Search with a pre-configured indexer to Cosmos DB for NoSQL, see [Bicep deployment of Azure AI Search](https://github.com/Azure-Samples/azure-search-deployment-template). There's no bicep template support for Azure AI Search data plane operations like creating an index, but you can add a module that calls REST APIs. The sample includes a module that creates an index, data source connector, and an indexer that refreshes from Cosmos DB at 5-minute intervals.

@@ -473,9 +473,4 @@ To query your multimodal index:
 
 ## Next steps
 
-This quickstart introduced you to the **Import data (new)** wizard, which creates all of the necessary objects for multimodal search. To explore each step in detail, see the following tutorials:
-
-+ [Tutorial: Verbalize images using generative AI](tutorial-document-extraction-image-verbalization.md)
-+ [Tutorial: Verbalize images from a structured document layout](tutorial-document-layout-image-verbalization.md)
-+ [Tutorial: Vectorize images and text](tutorial-document-extraction-multimodal-embeddings.md)
-+ [Tutorial: Vectorize from a structured document layout](tutorial-document-layout-multimodal-embeddings.md)
+This quickstart introduced you to the **Import data (new)** wizard, which creates all of the necessary objects for multimodal search. To explore each step in detail, see the [Multimodal tutorial](tutorial-multimodal.md).

@@ -228,7 +228,7 @@ There are several ways to run an indexer:
 
 Scheduled execution is usually implemented when you have a need for incremental indexing so that you can pick up the latest changes. As such, scheduling has a dependency on change detection.
 
-Indexers are one of the few subsystems that make overt outbound calls to other Azure resources. In terms of Azure roles, indexers don't have separate identities; a connection from the search engine to another Azure resource is made using the [system or user-assigned managed identity](search-how-to-managed-identities.md) of a search service. If the indexer connects to an Azure resource on a virtual network, you should create a [shared private link](search-indexer-howto-access-private.md) for that connection. For more information about secure connections, see [Security in Azure AI Search](search-security-overview.md).
+Indexers are one of the few subsystems that make overt outbound calls to other Azure resources. In terms of Azure roles, indexers don't have separate identities; a connection from the search engine to another Azure resource is made using the [system or user-assigned managed identity](search-how-to-managed-identities.md) of a search service. If the indexer connects to an Azure resource on a virtual network, you should create a [shared private link](search-indexer-howto-access-private.md) for that connection. For more information, see [Secure access to external data](search-security-best-practices.md#secure-access-to-external-data).
 
 ## Check results
 

@@ -417,7 +417,7 @@ If your Azure resource is behind a firewall, make sure there's an inbound rule t
 
 ## See also
 
-+ [Security overview](search-security-overview.md)
++ [Data, privacy, and built-in protections](search-security-built-in.md)
 + [AI enrichment overview](cognitive-search-concept-intro.md)
 + [Indexers overview](search-indexer-overview.md)
 + [Authenticate with Microsoft Entra ID](/azure/architecture/framework/security/design-identity-authentication)

@@ -429,4 +429,4 @@ The following table lists common issues when updating or rebuilding indexes and
 + [Azure Cosmos DB for NoSQL indexer](search-how-to-index-cosmosdb-sql.md)
 + [Azure blob indexer](search-how-to-index-azure-blob-storage.md)
 + [Azure tables indexer](search-how-to-index-azure-tables.md)
-+ [Security in Azure AI Search](search-security-overview.md)
++ [Data, privacy, and built-in protections](search-security-built-in.md)

@@ -4,7 +4,7 @@ titleSuffix: Azure AI Search
 description: Learn how to configure Azure AI Search indexers to ingest Microsoft Purview sensitivity labels from supported data sources for document-level security enforcement.  
 ms.service: azure-ai-search  
 ms.topic: how-to  
-ms.date: 01/28/2026  
+ms.date: 02/26/2026  
 author: gmndrg  
 ms.author: gimondra  
 ---
@@ -53,11 +53,9 @@ These updates are detected if they occurred since the last indexer run.
 
 ## Limitations
 
-+ There's a known issue with document deletion and sensitivity labels. When sensitivity labels are enabled for an index, the indexer fails to enumerate the index’s documents. As a result, soft delete operations don't run because the indexer can't list the documents that need to be removed. This applies to indexers that support soft delete, including Azure Blob, ADLS Gen2, OneLake, SharePoint.
 + Initial release supports REST API version 2025-11-01-preview and associated beta SDK only. There's no portal experience for configuration or management.  
 + [Autocomplete](/rest/api/searchservice/documents/autocomplete-post) and [Suggest](/rest/api/searchservice/documents/suggest-post) APIs are disabled for Purview-enabled indexes, as they can't yet enforce label-based access control.  
 + Guest accounts and cross-tenant queries aren't supported.
-+ In the initial release, sensitivity label-enabled indexes don't support unlabeled documents and don't return them in query results. This capability will be documented when available.
 + The following indexer features don't support documents with sensitivity labels. If you use any of these features in a skillset or indexer, they don't process those documents.
 
     - Custom Web API skill

@@ -309,7 +309,7 @@ az search private-endpoint-connection delete \
 
 ## Create a service with confidential computing
 
-[Confidential computing](search-security-overview.md#data-in-use) is an optional compute type for data-in-use protection. When configured, your search service is deployed on confidential VMs (DCasv5 or DCesv5) instead of standard VMs. This compute type also incurs a 10% surcharge for billable tiers. For more information, see the [pricing page](https://azure.microsoft.com/pricing/details/search/).
+[Confidential computing](search-security-best-practices.md#optional-enable-confidential-computing) is an optional compute type for data-in-use protection. When configured, your search service is deployed on confidential VMs (DCasv5 or DCesv5) instead of standard VMs. This compute type also incurs a 10% surcharge for billable tiers. For more information, see the [pricing page](https://azure.microsoft.com/pricing/details/search/).
 
 For daily usage, confidential computing isn't necessary. We only recommend this compute type for stringent regulatory, compliance, or security requirements. For more information, see [Confidential computing use cases](/azure/confidential-computing/use-cases-scenarios).
 

@@ -246,7 +246,7 @@ PATCH https://management.azure.com/subscriptions/{{subscription-id}}/resourcegro
 
 ## Configure confidential computing
 
-[Confidential computing](search-security-overview.md#data-in-use) is an optional compute type for data-in-use protection. When configured, your search service is deployed on confidential VMs (DCasv5 or DCesv5) instead of standard VMs. This compute type also incurs a 10% surcharge for billable tiers. For more information, see the [pricing page](https://azure.microsoft.com/pricing/details/search/).
+[Confidential computing](search-security-best-practices.md#optional-enable-confidential-computing) is an optional compute type for data-in-use protection. When configured, your search service is deployed on confidential VMs (DCasv5 or DCesv5) instead of standard VMs. This compute type also incurs a 10% surcharge for billable tiers. For more information, see the [pricing page](https://azure.microsoft.com/pricing/details/search/).
 
 For daily usage, confidential computing isn't necessary. We only recommend this compute type for stringent regulatory, compliance, or security requirements. For more information, see [Confidential computing use cases](/azure/confidential-computing/use-cases-scenarios).
 

@@ -70,7 +70,7 @@ By default, a search service accepts authenticated and authorized requests over
 + [Configure firewall rules](service-configure-firewall.md) to restrict network access by IP address.
 + [Configure a private endpoint](service-create-private-endpoint.md) to only allow traffic from Azure virtual networks. Note that when you turn off the public endpoint, the import wizards won't run.
 
-To learn about inbound and outbound calls in Azure AI Search, see [Security in Azure AI Search](search-security-overview.md).
+To learn about inbound and outbound calls in Azure AI Search, see [Understand network traffic patterns](search-security-best-practices.md#understand-network-traffic-patterns).
 
 ## Check capacity and understand billing
 
@@ -86,7 +86,7 @@ To learn about other features that affect billing, see [How you're charged for A
 
 Internally, Microsoft collects telemetry data about your service and the platform. To learn more about data retention, see [Retention of metrics](/azure/azure-monitor/essentials/data-platform-metrics#retention-of-metrics).
 
-To learn more about data location and privacy, see [Data residency](search-security-overview.md#data-residency).
+To learn more about data location and privacy, see [Data residency](search-security-built-in.md#data-residency).
 
 ## Enable semantic ranker
 

@@ -12,7 +12,7 @@ ms.date: 05/29/2025
 ms.update-cycle: 365-days
 ---
 
-# Visualize Azure AI Search Logs and Metrics with Power BI
+# Visualize Azure AI Search logs and metrics with Power BI
 
 Azure AI Search can send operation logs and service metrics to an Azure Storage account, which can then be visualized in Power BI. This article explains the steps and how to use a Power BI template app to visualize the data. The template covers information about queries, indexing, operations, and service metrics.
 

@@ -26,7 +26,7 @@ When you create an Azure AI Search service, your region selection might depend o
 | [AI enrichment](cognitive-search-concept-intro.md) | Refers to [built-in skills](cognitive-search-predefined-skills.md) that make internal calls to Foundry Tools for enrichment and transformation during indexing. Integration requires that Azure AI Search coexists with a [Microsoft Foundry resource](/azure/ai-services/multi-service-resource) in the same physical region. You can bypass region requirements by using [identity-based connections](cognitive-search-attach-cognitive-services.md#bill-through-a-keyless-connection), currently in public preview. | Regional support is noted in this article. |
 | [Availability zones](/azure/reliability/reliability-ai-search#availability-zone-support) | Divides a region's data centers into distinct physical location groups, providing high availability within the same geo. | Regional support is noted in this article. |
 | [Agentic retrieval](agentic-retrieval-overview.md) | Uses the agentic retrieval engine designed for conversational search. | Regional support is noted in this article. |
-| [Confidential computing](search-security-overview.md#data-in-use) | Deploys your search service on confidential VMs to process data in a hardware-based trusted execution environment.<p>Confidential computing disables or restricts certain features, including agentic retrieval, semantic ranker, query rewrite, and skillset execution. | Regional support is noted in this article. |
+| [Confidential computing](search-security-best-practices.md#optional-enable-confidential-computing) | Deploys your search service on confidential VMs to process data in a hardware-based trusted execution environment.<p>Confidential computing disables or restricts certain features, including agentic retrieval, semantic ranker, query rewrite, and skillset execution. | Regional support is noted in this article. |
 | [Semantic ranker](semantic-search-overview.md) | Takes a dependency on Microsoft-hosted models in specific regions. | Regional support is noted in this article. |
 | [Query rewrite](semantic-how-to-query-rewrite.md) | Takes a dependency on Microsoft-hosted models in specific regions. | Regional support is noted in this article. |
 | [Extra capacity](search-limits-quotas-capacity.md#service-limits) | Higher-capacity partitions became available in select regions starting in April 2024, with a second wave following in May 2024. Currently, there are just a few regions that *don't* offer higher-capacity partitions.<p>If you have an older search service in a supported region, check if you can [upgrade your service](search-how-to-upgrade.md). Otherwise, create a new search service to benefit from more capacity at the same billing rate. | Regional support is noted in the footnotes of this article. |

@@ -358,6 +358,6 @@ It's not possible to use [customer-managed key encryption](search-security-manag
 
 ## Related content
 
-+ [Security in Azure AI Search](search-security-overview.md)
++ [Data, privacy, and built-in protections in Azure AI Search](search-security-built-in.md)
 + [Azure role-based access control in Azure AI Search](search-security-rbac.md)
 + [Manage using PowerShell](search-manage-powershell.md)

@@ -0,0 +1,296 @@
+---
+title: Best Practices for Security
+titleSuffix: Azure AI Search
+description: Learn how to configure security features in Azure AI Search to protect endpoints, content, and operations. This article provides best practices for network security, authentication, and data protection.
+manager: nitinme
+author: haileytap
+ms.author: haileytapia
+ms.service: azure-ai-search
+ms.update-cycle: 180-days
+ms.topic: how-to
+ms.date: 02/24/2026
+ai-usage: ai-assisted
+---
+
+# Secure an Azure AI Search service
+
+This article provides security best practices to help protect your Azure AI Search service. You're responsible for implementing these customer-configurable security controls. For information about Microsoft's built-in protections, such as network architecture, encryption, and compliance certifications, see [Data, privacy, and built-in protections in Azure AI Search](search-security-built-in.md).
+
+As a solutions architect, you should configure security controls across three domains:
+
+- **Network security**: Control inbound and outbound traffic to your search service.
+- **Authentication and authorization**: Define how, who, and what can access your search service and data.
+- **Data protection**: Implement encryption, access controls, and monitoring.
+
+## Understand network traffic patterns
+
+Before you configure network security, understand the three network traffic patterns in Azure AI Search:
+
++ **Inbound traffic**: Requests from clients to your search service, such as queries, indexing, and management operations. This traffic is configurable by customers.
+
++ **Outbound traffic**: Requests from your search service to external resources, such as indexers that connect to data sources, vectorizers, and custom skills. This traffic is configurable by customers.
+
++ **Internal traffic**: Service-to-service calls over the Microsoft backbone network. This traffic is managed by Microsoft and isn't configurable by customers. For more information, see [Internal traffic protection](search-security-built-in.md#internal-traffic-protection).
+
+## Configure network security
+
+Use one of the following approaches to restrict inbound access to your search service. These approaches are listed from least secure to most secure:
+
++ [Create IP firewall rules](#create-ip-firewall-rules)
++ [Create a private endpoint](#create-a-private-endpoint)
++ [Join a network security perimeter](#join-a-network-security-perimeter)
+
+### Create IP firewall rules
+
+Create inbound firewall rules to admit requests only from specific IP addresses or address ranges. All client connections must be made through an allowed IP address. Otherwise, the connection is denied.
+
+:::image type="content" source="media/search-security-overview/inbound-firewall-ip-restrictions.png" alt-text="Sample architecture diagram for IP restricted access.":::
+
+**When to use**: Basic protection scenarios where you need to restrict access to known IP addresses.
+
+**How to get started**: See [Configure network access and firewall rules for Azure AI Search](service-configure-firewall.md).
+
+### Create a private endpoint
+
+Create a private endpoint for Azure AI Search to allow clients on a virtual network to securely access data in a search index over a Private Link. The private endpoint uses an IP address from your virtual network address space.
+
+Network traffic between the client and the search service traverses over the virtual network and a private link on the Microsoft backbone network, eliminating exposure from the public internet.
+
+:::image type="content" source="media/search-security-overview/inbound-private-link-azure-cog-search.png" alt-text="Sample architecture diagram for private endpoint access.":::
+
+**When to use**: High-security scenarios requiring complete network isolation from the public internet.
+
+**How to get started**: See [Create a private endpoint for Azure AI Search](service-create-private-endpoint.md).
+
+### Join a network security perimeter
+
+Create a network security perimeter around your platform-as-a-service (PaaS) resources deployed outside of a virtual network to establish a logical network boundary. This establishes a perimeter that controls public network access through explicit access rules.
+
+Inbound client connections and service-to-service connections occur within the boundary, simplifying defenses against unauthorized access. In Azure AI Search, it's common for solutions to use multiple Azure resources.
+
+**When to use**: Solutions using multiple Azure PaaS resources that need coordinated network boundary protection.
+
+**How to get started**:
+
++ Start by joining Azure AI Search to a network security perimeter. See [Add a search service to a network security perimeter](search-security-network-security-perimeter.md).
+
++ Add related services, such as [Azure OpenAI](/azure/ai-foundry/openai/how-to/network-security-perimeter), [Azure Storage](/azure/storage/common/storage-network-security-perimeter), and [Azure Monitor](/azure/azure-monitor/fundamentals/network-security-perimeter), to the same perimeter.
+
+## Configure authentication and authorization
+
+Azure AI Search supports two authentication approaches. You can use one approach and disable the other, or you can use both with appropriate controls.
+
+### (Recommended) Enable role-based access control
+
+Use Microsoft Entra authentication to establish the *caller*, rather than the *request*, as the authenticated identity. Azure role assignments determine authorization, providing centralized identity management, conditional access policies, and comprehensive audit trails.
+
+The workflow for role-based access control is:
+
+1. **Enable role-based access control**: Configure your search service to accept Microsoft Entra ID authentication instead of (or in addition to) API keys. See [Enable or disable role-based access control in Azure AI Search](search-security-enable-roles.md).
+
+1. **Assign roles to users and groups**: Grant least-privilege access using built-in roles (Search Service Contributor, Search Index Data Contributor, and Search Index Data Reader) to control who can manage and query indexes. See [Connect to Azure AI Search using roles](search-security-rbac.md).
+
+1. **Connect your application using identities**: Authenticate without API keys by using `DefaultAzureCredential`, which supports managed identities, developer credentials, and other token-based flows. See [Connect your app to Azure AI Search using identities](search-security-rbac-client-code.md).
+
+### Configure API key authentication
+
+With key-based authentication, each request must include an admin or query API key to prove it originates from a trusted source. This approach is suitable for development environments, backward compatibility with existing applications, or scenarios where Microsoft Entra ID isn't available.
+
+The workflow for key-based authentication is:
+
+1. **Provide an API key in each request**: Admin keys grant full access to all operations. Query keys grant read-only access to the documents collection of an index. See [Connect to Azure AI Search using keys](search-security-api-keys.md).
+
+1. **Rotate admin keys on a schedule**: Reduce the risk of key compromise by regularly regenerating admin keys. Search services support two admin keys for zero-downtime rotation. See [Regenerate admin keys](search-security-api-keys.md#regenerate-admin-keys).
+
+### Authorize control plane operations
+
+Control plane operations (service creation, configuration, and deletion) are authorized through Azure Resource Manager role-based access control, the same model used across all Azure services. API keys don't apply to control plane operations. Three built-in Azure roles govern access:
+
+| Role | Permissions |
+| ---- | ----------- |
+| Owner | Full control, including access management. |
+| Contributor | Full control except for access management. |
+| Reader | View-only access. |
+
+The workflow for authorizing control plane operations is:
+
+1. **Assign administrative roles**: Use built-in Azure roles (Owner, Contributor, and Reader) to grant least-privilege access and control who can create, configure, or delete search services. See [Assign roles for service administration](search-security-rbac.md#assign-roles-for-service-administration).
+
+1. **Apply resource locks**: Prevent accidental deletion of production search services by applying `CanNotDelete` or `ReadOnly` locks. See [Lock your Azure resources to protect your infrastructure](/azure/azure-resource-manager/management/lock-resources).
+
+### Authorize data plane operations
+
+Data plane operations target content hosted on a search service, such as index creation, document loading, and queries. Authorization is available through role-based access control, API keys, or both. For configuration steps, see the previous sections on [role-based access control](#recommended-enable-role-based-access-control) and [API key authentication](#configure-api-key-authentication).
+
+### Grant access to individual indexes
+
+Restrict user access to individual indexes by creating custom role definitions. This approach is essential for multi-tenant scenarios where each tenant's data must be isolated at the index level. See [Grant access to a single index](search-security-rbac.md#grant-access-to-a-single-index).
+
+For solutions requiring security boundaries at the index level, see [Design patterns for multitenant SaaS applications and Azure AI Search](search-modeling-multitenant-saas-applications.md).
+
+> [!NOTE]
+> API keys provide service-level access only. Anyone with an [admin key](search-security-api-keys.md) can read, modify, or delete any index in the search service. For index-level isolation, use role-based access control or implement isolation in your application's middle tier.
+
+## Configure outbound connections
+
+Outbound requests originate from a search service to other applications, typically made by indexers, custom skills, and vectorizers. Configure these connections to use secure authentication and network access.
+
+### (Recommended) Use a managed identity
+
+Create a managed identity for your search service to authenticate to other Azure resources without storing credentials in your code. A managed identity eliminates the need to store and rotate connection strings with credentials.
+
+The workflow for using a managed identity is:
+
+1. **Configure a managed identity for the search service**: Choose between a system-assigned or user-assigned managed identity. See [Configure a search service to connect using a managed identity](search-how-to-managed-identities.md).
+
+1. **Connect to external resources using the managed identity**: Supported connections include [Azure Storage](search-howto-managed-identities-storage.md), [Azure Cosmos DB](search-howto-managed-identities-cosmos-db.md), [Azure SQL Database](search-howto-managed-identities-sql.md), [SQL Managed Instance](search-how-to-index-sql-managed-instance-with-managed-identity.md), and [Azure Functions](search-howto-managed-identities-azure-functions.md).
+
+### Secure access to external data
+
+Configure secure connections based on how external resources are protected:
+
++ **Create firewall exceptions for the search service**: Allow indexer traffic through data source firewalls by adding the search service's outbound IP addresses to allowlists. See [Configure IP firewall rules to allow indexer connections from Azure AI Search](search-indexer-howto-access-ip-restricted.md).
+
++ **Create shared private links**: Connect indexers to data sources protected by Azure Private Link without exposing traffic to the public internet. See [Make outbound connections through a shared private link](search-indexer-howto-access-private.md).
+
++ **Use trusted service exception for same-region storage**: Enable indexer access to secured Azure Storage accounts in the same region without firewall configuration. See [Make indexer connections to Azure Storage as a trusted service](search-indexer-howto-access-trusted-service-exception.md).
+
++ **Configure resource instance rules**: Grant specific search services access to Azure Storage accounts protected by network rules. See [Grant access from Azure resource instances](/azure/storage/common/storage-network-security?tabs=azure-portal#grant-access-from-azure-resource-instances).
+
++ **Connect to SQL Managed Instance private endpoints**: Access SQL Managed Instance databases through private endpoints while maintaining network isolation. See [Create a shared private link for a SQL managed instance from Azure AI Search](search-indexer-how-to-access-private-sql.md).
+
+> [!TIP]
+> If Azure Storage and Azure AI Search are in the same region, network traffic is automatically routed through a private IP address over the Microsoft backbone network, eliminating the need for firewall configuration. For more information, see [Same-region Azure Storage and Azure AI Search](search-security-built-in.md#same-region-azure-storage-and-azure-ai-search).
+
+### Secure connections for external AI processing
+
+Outbound requests for AI enrichment and vectorization require special consideration:
+
+| Operation | Configuration |
+| --------- | ------------- |
+| Indexers connecting to data sources | [Secure access to external data](search-indexer-securing-resources.md). |
+| Custom skills calling external code | Secure connections to [Azure Functions, web apps, or other hosts](cognitive-search-custom-skill-interface.md#set-the-endpoint-and-time-out-interval). |
+| Vectorization during indexing | Connect to [Azure OpenAI](vector-search-integrated-vectorization.md#secure-connections-to-vectorizers-and-models) or custom embedding models. |
+| Azure Key Vault | Connect to Azure Key Vault for [customer-managed encryption keys](search-security-manage-encryption-keys.md). |
+
+For basic retrieval-augmented generation (RAG) patterns where your client application calls a chat completion model, the connection uses the client or user identity, not the search service identity. For agentic retrieval using knowledge bases, the outbound request is made by the search service managed identity.
+
+## Implement document-level access control
+
+User permissions at the document level, also known as *row-level security*, control which documents users can access through query execution.
+
+### Configure document-level security
+
+Configure fine-grained permissions at the document level, from data ingestion through query execution. This capability is essential for building secure AI agentic systems grounding data, RAG applications, and enterprise search solutions that require authorization checks at the document level. For more information, see [Document-level access control](search-document-level-access-overview.md).
+
+### Use sensitivity labels (preview)
+
+Configure an indexer to automatically detect Microsoft Purview sensitivity labels during indexing and apply label-based access controls when queries are executed. For more information, see [Sensitivity labels](search-indexer-sensitivity-labels.md).
+
+## Configure data encryption
+
+Azure AI Search encrypts all data automatically using Microsoft-managed keys. For information about built-in encryption, see [Data encryption](search-security-built-in.md#data-encryption).
+
+For enhanced data protection, you can implement the following encryption controls.
+
+### (Optional) Add customer-managed key encryption
+
+Add an extra encryption layer for indexes and synonym maps by managing your own encryption keys
+in Azure Key Vault. Customer-managed keys (CMK) are for organizations with compliance requirements mandating
+customer control over encryption keys or key revocation capabilities. See [Configure customer-managed keys for data encryption in Azure AI Search](search-security-manage-encryption-keys.md).
+
+You can also configure the following options:
+
++ **Configure cross-tenant CMK**: Support multi-tenant scenarios where keys are stored in a different Microsoft Entra tenant than the search service. See [Configure customer-managed keys across different tenants](search-security-managed-encryption-cross-tenant.md).
+
++ **Find encrypted objects**: Identify which indexes and synonym maps use CMK encryption. See [Find encrypted objects and information](search-security-get-encryption-keys.md).
+
+> [!IMPORTANT]
+> + CMK encryption increases index size and can degrade query performance by 30-60%. Only enable for indexes that require it.
+> + CMK on temporary disks requires services created after May 13, 2021. Earlier services support CMK on data disks only.
+
+### Index encrypted blob content
+
+Configure an indexer to process content from Azure Blob Storage that's encrypted at rest, which is separate
+from CMK encryption of the search index. See [Tutorial: Index and enrich encrypted blobs](search-how-to-index-azure-blob-encrypted.md).
+
+### (Optional) Enable confidential computing
+
+[Confidential computing](/azure/confidential-computing/overview) protects data in use from unauthorized access, including from Microsoft, through hardware attestation and encryption. This compute type is only configurable during service creation. See [Choose a compute type](search-create-service-portal.md#choose-a-compute-type).
+
+We only recommend confidential computing for organizations whose compliance or regulatory requirements necessitate data-in-use protection. For daily usage, the default compute type suffices.
+
+| Compute type | Description | Limitations | Cost | Availability |
+| ------------ | ----------- | ----------- | ---- | ------------ |
+| Default | Standard VMs with built-in encryption for data at rest and in transit. No hardware-based isolation for data in use. | No limitations. | No change to the base cost of free or billable tiers. | Available in all regions. |
+| Confidential | Confidential VMs (DCasv5 or DCesv5) in hardware-based trusted execution environment. Isolates computations and memory from the host operating system and other VMs. | Disables or restricts [agentic retrieval](agentic-retrieval-overview.md), [semantic ranker](semantic-search-overview.md), [query rewrite](semantic-how-to-query-rewrite.md), [skillset execution](cognitive-search-concept-intro.md), and indexers that run in the [multitenant environment](search-howto-run-reset-indexers.md#indexer-execution-environment) <sup>1</sup>. | Adds 10% surcharge to the base cost of billable tiers. For more information, see the [pricing page](https://azure.microsoft.com/pricing/details/search/). | Available in some regions. For more information, see the [list of supported regions](search-region-support.md). |
+
+<sup>1</sup> When you enable this compute type, indexers can only run in the private execution environment, meaning they run from the search clusters hosted on confidential computing.
+
+## Enable monitoring and logging
+
+Track operations, detect anomalies, and support security audits by enabling logging and monitoring for your search service. For information about what Azure AI Search logs by default, see [Data logging](search-security-built-in.md#data-logging).
+
++ **Enable diagnostic logging**: Capture operations for security audits and anomaly detection by sending logs to Azure Monitor, Event Hubs, or Azure Storage. See [Configure diagnostic logging for Azure AI Search](search-monitor-enable-logging.md).
+
++ **Monitor queries**: Track search query activity, latency, and throttling to detect unusual patterns. See [Monitor query requests in Azure AI Search](search-monitor-queries.md).
+
++ **Monitor indexer operations**: Track indexing activity, errors, and data refresh operations. See [Monitor indexer status and results in Azure AI Search](search-monitor-indexers.md).
+
++ **Configure alerts for anomalous activity**: Create alert rules for query volume spikes, failed authentication attempts, and unusual access patterns. See [Create or edit a metric alert rule](/azure/azure-monitor/alerts/alerts-create-new-alert-rule).
+
++ **Visualize logs using Power BI**: Build dashboards to analyze search service activity and identify security trends. See [Visualize Azure AI Search logs and metrics with Power BI](search-monitor-logs-powerbi.md).
+
+## Maintain compliance
+
+For information about Azure AI Search compliance certifications and the shared responsibility model, see [Compliance and certifications](search-security-built-in.md#compliance-and-certifications).
+
+### Use Azure Policy
+
++ **Review built-in policy definitions**: Use Azure Policy to audit and enforce security configurations such as diagnostic logging and private endpoint usage. See [Azure Policy Regulatory Compliance controls for Azure AI Search](security-controls-policy.md).
+
++ **Assign the resource logging policy**: Automatically identify search services missing diagnostic logging and remediate the configuration. See [Azure Policy overview](/azure/governance/policy/overview).
+
++ **Create custom policies**: Define organization-specific security requirements and enforce them across all search services. See [Tutorial: Create a custom policy definition](/azure/governance/policy/tutorials/create-custom-policy-definition).
+
+### Apply resource tags
+
+Apply resource tags to categorize search services by environment, data sensitivity, cost center, or compliance requirements for improved governance. See [Use tags to organize your Azure resources and management hierarchy](/azure/azure-resource-manager/management/tag-resources).
+
+## Security checklist
+
+Use this checklist to ensure you've configured appropriate security controls:
+
+**Network security**:
+
+- [ ] Configured IP firewall rules, private endpoint, or network security perimeter
+- [ ] Restricted inbound access to known clients or networks
+- [ ] Configured secure outbound connections using managed identities
+
+**Authentication and authorization**:
+
+- [ ] Enabled role-based access control
+- [ ] Assigned appropriate roles to users and applications
+- [ ] Implemented admin key rotation schedule (if using keys)
+- [ ] Configured index-level permissions (if required)
+
+**Data protection**:
+
+- [ ] Configured document-level access control (if required)
+- [ ] Configured sensitivity labels (if applicable)
+- [ ] Implemented CMK encryption (if required)
+- [ ] Evaluated confidential computing requirements (if applicable)
+
+**Monitoring and compliance**:
+
+- [ ] Enabled diagnostic logging
+- [ ] Set up monitoring and alerts to identify anomalous activity
+- [ ] Applied resource tags for governance
+- [ ] Assigned Azure Policy for resource logging
+- [ ] Reviewed compliance certifications against requirements
+
+## Related content
+
++ [Data, privacy, and built-in protections in Azure AI Search](search-security-built-in.md)
++ [Azure security fundamentals](/azure/security/fundamentals/)
++ [Shared responsibility in the cloud](/azure/security/fundamentals/shared-responsibility)

@@ -0,0 +1,160 @@
+---
+title: Data, Privacy, and Built-in Protections
+titleSuffix: Azure AI Search
+description: Learn about Microsoft-managed security, data residency, encryption, and compliance features built into Azure AI Search.
+manager: nitinme
+author: haileytap
+ms.author: haileytapia
+ms.service: azure-ai-search
+ms.update-cycle: 180-days
+ms.topic: conceptual
+ms.date: 02/24/2026
+ai-usage: ai-assisted
+---
+
+# Data, privacy, and built-in protections in Azure AI Search
+
+Azure AI Search includes security protections that Microsoft manages automatically, requiring no action from customers. Understanding what Microsoft handles helps you focus your security efforts on the controls and configurations for which you're responsible. 
+
+This article covers Microsoft's built-in protections, including network architecture, encryption (in transit, in use, and at rest), data residency, privacy guarantees, and compliance certifications. For security best practices that you should configure, see [Secure an Azure AI Search service](search-security-best-practices.md).
+
+## What Microsoft manages automatically
+
+Azure AI Search provides comprehensive built-in security protections across network, data, and service operations. These features are active by default and don't require configuration:
+
++ **Transport Layer Security (TLS)**: All connections use TLS 1.2 or 1.3 for encryption in transit.
+
++ **Service-managed encryption**: Data is encrypted at rest using 256-bit Advanced Encryption Standard (AES) encryption.
+
++ **Internal network security**: Service-to-service calls occur over the secure Microsoft backbone network.
+
++ **Compliance certifications**: Azure AI Search maintains certifications for global, regional, and industry-specific standards.
+
++ **Operational security**: Microsoft manages infrastructure security, patching, and service updates.
+
+## Network security architecture
+
+Azure AI Search uses Microsoft's secure network infrastructure to protect traffic to, from, and within your search servic
+
+### Internal traffic protection
+
+Microsoft secures and manages internal requests. You can't configure or control these connections. Internal traffic is isolated from public networks and protected by Microsoft's security infrastructure.
+
+Internal traffic includes:
+
++ **Service-to-service authentication and authorization**: Calls through Microsoft Entra ID, resource logging sent to Azure Monitor, and [private endpoint connections](service-create-private-endpoint.md) that use Azure Private Link.
+
++ **Built-in skills processing**: Same-region requests directed to an internally hosted Microsoft Foundry resource used exclusively for [built-in skills processing](cognitive-search-predefined-skills.md) by Azure AI Search.
+
++ **Semantic ranking**: Requests made to the models that support [semantic ranking](semantic-search-overview.md#availability-and-pricing).
+
+### Transport Layer Security (TLS)
+
+Azure AI Search enforces TLS 1.2 or 1.3 for all connections. TLS 1.3 is the default for newer systems. Earlier TLS versions (1.0 and 1.1) aren't supported.
+
+All endpoints require HTTPS on port 443. Client systems must support TLS 1.2 or later. For implementation guidance, see:
+
++ [Encryption of data in transit](/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit)
++ [TLS best practices](/dotnet/framework/network-programming/tls)
++ [TLS support in .NET Framework](/dotnet/framework/network-programming/tls#tls-support-in-net-framework)
+
+### Same-region Azure Storage and Azure AI Search
+
+If Azure Storage and Azure AI Search are in the same region, network traffic is routed through a private IP address and occurs over the Microsoft backbone network. Because private IP addresses are used, you can't configure IP firewalls or a private endpoint for network security on the storage account for these connections.
+
+This same-region optimization ensures high performance and low latency while maintaining security through network isolation. The traffic never leaves the Microsoft network infrastructure.
+
+## Data encryption
+
+Azure AI Search automatically encrypts all customer data at multiple layers.
+
+### Data in transit
+
+All data transmitted to and from Azure AI Search is encrypted using TLS 1.2 or later. This data includes:
+
++ Client application requests to the search service endpoint
++ Responses from the search service to client applications
++ API requests for index management, query operations, and indexing
+
+Data in transit is protected end-to-end between your client and the search service. For internal service-to-service communication, encryption occurs over the Microsoft backbone network.
+
+### Data in use
+
+By default, Azure AI Search deploys your search service on standard Azure infrastructure. This infrastructure encrypts data at rest and in transit, but it doesn't protect data while it's being actively processed in memory.
+
+For scenarios requiring hardware-based protection of data in use, Azure AI Search offers confidential computing. This compute type has limited regional availability, disables or restricts certain features, and increases the cost of running your search service. For more information, see [(Optional) Enable confidential computing](search-security-best-practices.md#optional-enable-confidential-computing).
+
+### Data at rest
+
+Azure AI Search automatically encrypts all data at rest using 256-bit [AES encryption](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) with Microsoft-managed keys. This applies to indexes, synonym maps, and object definitions (indexers, data sources, and skillsets) on both data disks and temporary disks. For more information, see [Azure encryption at rest](/azure/security/fundamentals/encryption-atrest).
+
+Service-managed encryption:
+
++ Is built-in and automatic (no configuration required)
++ Is available on all pricing tiers in all regions
++ Uses FIPS 140-2 compliant encryption
+
+You can configure customer-managed keys (CMK) to manage your own encryption keys. CMK adds a second encryption layer on top of service-managed encryption. For more information, see [(Optional) Add customer-managed key encryption](search-security-best-practices.md#optional-add-customer-managed-key-encryption).
+
+## Data residency
+
+When you create a search service, you select a region within an [Azure geography](https://azure.microsoft.com/explore/global-infrastructure/geographies/). Azure AI Search stores and processes your data within that geography, but Microsoft might replicate data to other regions within the same geography for high availability. The exception is Brazil South, where data stays within the region.
+
+Data stays in your geography unless you configure features that write to Azure Storage (enrichment cache, debug sessions, knowledge stores) in a different region.
+
+Object names (indexes, fields, indexers) might also be processed outside your selected region. These names appear in telemetry logs that Microsoft uses for service support. Avoid placing sensitive data in object names.
+
+For more information, see:
+
++ [Data residency in Azure](https://azure.microsoft.com/explore/global-infrastructure/data-residency/)
++ [Products available by region](https://azure.microsoft.com/explore/global-infrastructure/products-by-region/)
+
+## Privacy and data handling
+
+Microsoft is committed to protecting your data and respecting your privacy when you use Azure AI Search.
+
+### No customer data used for model training
+
+Microsoft doesn't use customer data from Azure AI Search to train or improve any models, including built-in skills, semantic ranking, or other AI features. Your documents, queries, and other data are used solely to deliver and operate the configured search service.
+
+### Data logging
+
+Azure AI Search doesn't log user identities, so you can't refer to logs for information about a specific user. However, the service does log create, read, update, and delete (CRUD) operations, which you might be able to correlate with other logs to determine who performed specific actions.
+
+Resource logs capture:
+
++ Administrative operations (service creation, configuration changes)
++ Query operations (with query text but no user identity)
++ Indexing operations (document additions, updates, deletions)
+
+Resource logs don't capture:
+
++ Individual user identities
++ Personal information about users
++ Document contents in detail (only metadata about documents being indexed)
+
+For information about setting up logs, see [Monitor Azure AI Search](monitor-azure-cognitive-search.md) and [Monitor query requests](search-monitor-queries.md).
+
+## Compliance and certifications
+
+Azure AI Search undergoes regular third-party audits and maintains certifications against global, regional, government, and industry-specific standards, including [ISO 27001](/azure/compliance/offerings/offering-iso-27001), [ISO 27018](/azure/compliance/offerings/offering-iso-27018), [ISO 27701](/azure/compliance/offerings/offering-iso-27701), [SOC 2](/azure/compliance/offerings/offering-soc-2), [FedRAMP](/azure/compliance/offerings/offering-fedramp), [HIPAA](/azure/compliance/offerings/offering-hipaa-us), and [GDPR](/compliance/regulatory/gdpr).
+
+For complete certification lists, audit reports, and compliance documentation, see:
+
++ [Azure compliance offerings](/azure/compliance/offerings/)
++ [Microsoft Azure Compliance Offerings white paper](https://servicetrust.microsoft.com/DocumentPage/7adf2d9e-d7b5-4e71-bad8-713e6a183cf3/)
++ [Microsoft Trust Center](https://www.microsoft.com/trust-center/compliance/compliance-overview)
+
+### Shared responsibility model
+
+Azure AI Search operates under the [shared responsibility model](/azure/security/fundamentals/shared-responsibility). Microsoft secures the infrastructure and built-in platform features described in this article. You're responsible for configuring security controls for your specific deployment.
+
++ **Microsoft manages** physical security, network infrastructure, platform security, default encryption (in transit, in use, and at rest), compliance certifications, and infrastructure updates.
+
++ **You configure** network access controls, authentication and authorization, outbound connections, document-level permissions, monitoring and alerting, and optional CMK and confidential computing.
+
+## Related content
+
++ [Secure an Azure AI Search service](search-security-best-practices.md)
++ [Azure security fundamentals](/azure/security/fundamentals/)
++ [Shared responsibility in the cloud](/azure/security/fundamentals/shared-responsibility)

@@ -26,7 +26,7 @@ You can store keys using either:
 + Azure Key Vault Managed HSM (Hardware Security Module). An Azure Key Vault Managed HSM is an FIPS 140-2 Level 3 validated HSM. HSM support is new in Azure AI Search. To migrate from Azure Key Vault to HSM, [rotate your keys](#rotate-or-update-encryption-keys) and choose Managed HSM for storage.
 
 > [!IMPORTANT]
-> + CMK provides encryption for data at rest. If you need to protect data in use, consider using [confidential computing](search-security-overview.md#data-in-use).
+> + CMK provides encryption for data at rest. If you need to protect data in use, consider using [confidential computing](search-security-best-practices.md#optional-enable-confidential-computing).
 >
 > + CMK encryption is irreversible. You can rotate keys and change CMK configuration, but index encryption lasts for the lifetime of the index. Post-CMK encryption, an index is only accessible if the search service has access to the key. If you revoke access to the key by deleting or changing role assignment, the index is unusable and the service can't be scaled until the index is deleted or access to the key is restored. If you delete or rotate keys, the most recent key is cached for up to 60 minutes.
 

@@ -1,321 +0,0 @@
----
-title: Secure your Azure AI Search deployment
-titleSuffix: Azure AI Search
-description: Learn about the security features in Azure AI Search to protect endpoints, content, and operations.
-manager: nitinme
-author: HeidiSteen
-ms.author: heidist
-ms.service: azure-ai-search
-ms.update-cycle: 180-days
-ms.custom:
-  - ignite-2023
-  - horz-security
-ms.topic: concept-article
-ms.date: 09/25/2025
----
-
-# Security in Azure AI Search
-
-Azure AI Search provides comprehensive security controls across network access, data access, and data protection to meet enterprise requirements. As a solution architect, you should understand three key security domains:
-
-+ **Network traffic patterns and network security**: Inbound, outbound, and internal traffic.
-+ **Access control mechanisms**: API keys or Microsoft Entra ID with roles.
-+ **Data residency and protection**: Encryption in transit, in use with optional confidential computing, and at rest with optional double encryption.
-
-A search service supports multiple network security topologies, from IP firewall restrictions for basic protection to private endpoints for complete network isolation. Optionally, use a network security perimeter to create a logical boundary around your Azure PaaS resources. For enterprise scenarios requiring granular permissions, you can implement document-level access controls. All security features integrate with Azure's compliance framework and support common enterprise patterns like multitenancy and cross-service authentication using managed identities.
-
-This article details the implementation options for each security layer to help you design appropriate security architectures for development and production environments.
-
-## Network traffic patterns
-
-An Azure AI Search service can be hosted in the Azure public cloud, an Azure private cloud, or a sovereign cloud (such as Azure Government). By default, for all cloud hosts, the search service is typically accessed by client applications over public network connections. While that pattern is predominant, it's not the only traffic pattern that you need to care about. Understanding all points of entry as well as outbound traffic is necessary background for securing your development and production environments.
-
-Azure AI Search has three basic network traffic patterns:
-
-+ Inbound requests made by a user or client to the search service (the predominant pattern)
-+ Outbound requests issued by the search service to other services on Azure and elsewhere
-+ Internal service-to-service requests over the secure Microsoft backbone network
-
-### Inbound traffic
-
-Inbound requests that target a search service endpoint include:
-
-+ Create, read, update, or delete indexes and other objects on the search service
-+ Load an index with search documents
-+ Query an index
-+ Run indexer or skillset jobs
-
-The [REST APIs](/rest/api/searchservice/) describe the full range of inbound requests that are handled by a search service.
-
-At a minimum, all inbound requests must be authenticated using either of these options:
-
-+ Key-based authentication (default). Inbound requests provide a valid API key.
-+ Role-based access control. Authorization is through Microsoft Entra identities and role assignments on your search service.
-
-Additionally, you can add [network security features](#service-access-and-authentication) to further restrict access to the endpoint. You can create either inbound rules in an IP firewall, or create private endpoints that fully shield your search service from the public internet. 
-
-### Outbound traffic
-
-Outbound requests can be secured and managed by you. Outbound requests originate from a search service to other applications. These requests are typically made by indexers for text-based and multimodal indexing, custom skills-based AI enrichment, and vectorizations at query time. Outbound requests include both read and write operations.
-
-The following list is a full enumeration of the outbound requests for which you can configure secure connections. A search service makes requests on its own behalf, and on the behalf of an indexer or custom skill.
-
-| Operation | Scenario |
-| ----------| -------- |
-| Indexers | Connect to external data sources to retrieve data (read access). For more information, see [Indexer access to content protected by Azure network security](search-indexer-securing-resources.md). |
-| Indexers | Connect to Azure Storage for write operations to  [knowledge stores](knowledge-store-concept-intro.md), [cached enrichments](enrichment-cache-how-to-configure.md), [debug sessions](cognitive-search-debug-session.md). |
-| Custom skills | Connect to Azure functions, Azure web apps, or other apps running external code that's hosted off-service. The request for external processing is sent during skillset execution. |
-| Indexers and [integrated vectorization](vector-search-integrated-vectorization.md) | Connect to Azure OpenAI and a deployed embedding model, or it goes through a custom skill to connect to an embedding model that you provide. The search service sends text to embedding models for vectorization during indexing. |
-| Vectorizers | Connect to Azure OpenAI or other embedding models at query time to [convert user text strings to vectors](vector-search-how-to-configure-vectorizer.md) for vector search. |
-| Knowledge bases | Connect to chat completion models for [agentic retrieval](agentic-retrieval-overview.md) query planning, and also for formulating answers grounded in search results. <p>If you're implementing a [basic RAG pattern](retrieval-augmented-generation-overview.md), your query logic calls an external chat completion model for formulating an answer grounded in search results. For this pattern, the connection to the model uses the identity of your client or user. The search service identity isn't used for the connection. In contrast, if you use [knowledge bases](agentic-retrieval-how-to-create-knowledge-base.md) in a RAG retrieval pattern, the outbound request is made by the search service managed identity. |
-| Search service | Connect to Azure Key Vault for [customer-managed encryption keys](search-security-manage-encryption-keys.md) used to encrypt and decrypt sensitive data. |
-
-Outbound connections can generally be made using a resource's full access connection string that includes a key or a database login, or [a managed identity](search-how-to-managed-identities.md) if you're using Microsoft Entra ID and role-based access.
-
-To reach Azure resources behind a firewall, [create inbound rules on other Azure resources that admit search service requests](search-indexer-howto-access-ip-restricted.md). 
-
-To reach Azure resources protected by Azure Private Link, [create a shared private link](search-indexer-howto-access-private.md) that an indexer uses to make its connection.
-
-#### Exception for same-region search and storage services
-
-If Azure Storage and Azure AI Search are in the same region, network traffic is routed through a private IP address and occurs over the Microsoft backbone network. Because private IP addresses are used, you can't configure IP firewalls or a private endpoint for network security. 
-
-Configure same-region connections using either of the following approaches:
-
-+ [Trusted service exception](search-indexer-howto-access-trusted-service-exception.md)
-+ [Resource instance rules](/azure/storage/common/storage-network-security?tabs=azure-portal#grant-access-from-azure-resource-instances)
-
-### Internal traffic
-
-Internal requests are secured and managed by Microsoft. You can't configure or control these connections. If you're locking down network access, no action on your part is required because internal traffic isn't customer-configurable.
-
-Internal traffic consists of:
-
-+ Service-to-service calls for tasks like authentication and authorization through Microsoft Entra ID, resource logging sent to Azure Monitor, and [private endpoint connections](service-create-private-endpoint.md) that utilize Azure Private Link.
-+ Requests for [built-in skills processing](cognitive-search-predefined-skills.md), with same-region requests directed to an internally hosted Microsoft Foundry resource used exclusively for built-in skills processing by Azure AI Search.
-+ Requests made to the various models that support [semantic ranking](semantic-search-overview.md#availability-and-pricing).
-
-<a name="service-access-and-authentication"></a>
-
-## Network security
-
-[Network security](/azure/security/fundamentals/network-overview) protects resources from unauthorized access or attack by applying controls to network traffic. Azure AI Search supports networking features that can be your frontline of defense against unauthorized access.
-
-### Inbound connection through IP firewalls
-
-A search service is provisioned with a public endpoint that allows access using a public IP address. To restrict which traffic comes through the public endpoint, create an inbound firewall rule that admits requests from a specific IP address or a range of IP addresses. All client connections must be made through an allowed IP address, or the connection is denied.
-
-:::image type="content" source="media/search-security-overview/inbound-firewall-ip-restrictions.png" alt-text="sample architecture diagram for ip restricted access":::
-
-You can use the Azure portal to [configure firewall access](service-configure-firewall.md).
-
-Alternatively, you can use the management REST APIs. Starting with API version 2020-03-13, with the [IpRule](/rest/api/searchmanagement/services/create-or-update#iprule) parameter, you can restrict access to your service by identifying IP addresses, individually or in a range, that you want to grant access to your search service.
-
-### Inbound connection to a private endpoint (network isolation, no Internet traffic)
-
-For more stringent security, you can establish a [private endpoint](/azure/private-link/private-endpoint-overview) for Azure AI Search allows a client on a [virtual network](/azure/virtual-network/virtual-networks-overview) to securely access data in a search index over a [Private Link](/azure/private-link/private-link-overview).
-
-The private endpoint uses an IP address from the virtual network address space for connections to your search service. Network traffic between the client and the search service traverses over the virtual network and a private link on the Microsoft backbone network, eliminating exposure from the public internet. A virtual network allows for secure communication among resources, with your on-premises network as well as the Internet.
-
-:::image type="content" source="media/search-security-overview/inbound-private-link-azure-cog-search.png" alt-text="sample architecture diagram for private endpoint access":::
-
-While this solution is the most secure, using more services is an added cost so be sure you have a clear understanding of the benefits before diving in. For more information about costs, see the [pricing page](https://azure.microsoft.com/pricing/details/private-link/). For more information about how these components work together, [watch this video](/Shows/AI-Show/Azure-Cognitive-Search-Whats-new-in-security). Coverage of the private endpoint option starts at 5:48 into the video. For instructions on how to set up the endpoint, see [Create a Private Endpoint for Azure AI Search](service-create-private-endpoint.md).
-
-### Network security perimeter
-
-A network security perimeter is a logical network boundary around your platform-as-a-service (PaaS) resources that are deployed outside of a virtual network. It establishes a perimeter for controlling public network access to resources like Azure AI Search, Azure Storage, and Azure OpenAI. You can grant exceptions through explicit access rules for inbound and outbound traffic. This approach helps prevent data exfiltration while maintaining necessary connectivity for your applications.
-
-Inbound client connections and service-to-service connections occur within the boundary, which simplifies and strengthens your defenses against unauthorized access. It's common in Azure AI Search solutions to use multiple Azure resources. The following resources can all be joined to an [existing network security perimeter](/azure/private-link/create-network-security-perimeter-portal):
-
-+ [Azure AI Search](search-security-network-security-perimeter.md)
-+ [Azure OpenAI](/azure/ai-foundry/openai/how-to/network-security-perimeter)
-+ [Azure Storage](/azure/storage/common/storage-network-security-perimeter)
-+ [Azure Monitor](/azure/azure-monitor/fundamentals/network-security-perimeter)
-
-For a complete list of eligible services, see [Onboarded private link resources](/azure/private-link/network-security-perimeter-concepts#onboarded-private-link-resources).
-
-## Authentication
-
-Once a request is admitted to the search service, it must still undergo authentication and authorization that determines whether the request is permitted. Azure AI Search supports two approaches:
-
-+ [Microsoft Entra authentication](search-security-rbac.md) establishes the caller (and not the request) as the authenticated identity. An Azure role assignment determines authorization. 
-
-+ [Key-based authentication](search-security-api-keys.md) is performed on the request (not the calling app or user) through an API key, where the key is a string composed of randomly generated numbers and letters that prove the request is from a trustworthy source. Keys are required on every request. Submission of a valid key is considered proof the request originates from a trusted entity. 
-
-  Reliance on API key-based authentication means that you should have a plan for regenerating the admin key at regular intervals, per Azure security best practices. There are a maximum of two admin keys per search service. For more information about securing and managing API keys, see [Create and manage api-keys](search-security-api-keys.md).
-
-Key-based authentication is the default for data plane operations (creating and using objects on the search service). You can use both authentication methods, or [disable an approach](search-security-enable-roles.md) that you don't want available on your search service.
-
-## Authorization
-
-Azure AI Search provides authorization models for service management and content management. 
-
-### Privileged access
-
-On a new search service, existing role assignments at the subscription level are inherited by the search service, and only Owners and User Access Administrators can grant access.
-
-Control plane operations (service or resource creation and management) tasks are exclusively authorized through [role assignments](/azure/role-based-access-control/overview), with no ability to use key-based authentication for service administration.
-
-Control plane operations include create, configure, or delete the service, and manage security. As such, Azure role assignments will determine who can perform those tasks, regardless of whether they're using the [portal](search-manage.md), [PowerShell](search-manage-powershell.md), or the [Management REST APIs](/rest/api/searchmanagement).
-
-[Three basic roles](search-security-rbac.md#assign-roles-for-service-administration) (Owner, Contributor, Reader) apply to search service administration. 
-
-> [!NOTE]
-> Using Azure-wide mechanisms, you can lock a subscription or resource to prevent accidental or unauthorized deletion of your search service by users with admin rights. For more information, see [Lock resources to prevent unexpected deletion](/azure/azure-resource-manager/management/lock-resources).
-
-### Authorize access to content
-
-Data plane operations refers to the objects created and used on a search service.
-
-+ For role-based authorization, [use Azure role assignments](search-security-rbac.md) to establish read-write access to operations.
-
-+ For key-based authorization, [an API key](search-security-api-keys.md) and a qualified endpoint determine access. An endpoint might be the service itself, the indexes collection, a specific index, a documents collection, or a specific document. When chained together, the endpoint, the operation (for example, a create request) and the type of key (admin or query) authorize access to content and operations.
-
-### Restricting access to indexes
-
-Using Azure roles, you can [set permissions on individual indexes](search-security-rbac.md#grant-access-to-a-single-index) as long as it's done programmatically.
-
-Using keys, anyone with an [admin key](search-security-api-keys.md) to your service can read, modify, or delete any index in the same service. For protection against accidental or malicious deletion of indexes, your in-house source control for code assets is the solution for reversing an unwanted index deletion or modification. Azure AI Search has failover within the cluster to ensure availability, but it doesn't store or execute your proprietary code used to create or load indexes.
-
-For multitenancy solutions requiring security boundaries at the index level, it's common to handle index isolation in the middle tier in your application code. For more information about the multitenant use case, see [Design patterns for multitenant SaaS applications and Azure AI Search](search-modeling-multitenant-saas-applications.md).
-
-### Restricting access to documents
-
-User permissions at the document level, also known as *row-level security*, is available as a preview feature and depends on the data source. If content originates from [Azure Data Lake Storage (ADLS) Gen2](search-indexer-access-control-lists-and-role-based-access.md) or [Azure blobs](search-blob-indexer-role-based-access.md), user permission metadata that originates in Azure Storage is preserved in indexer-generated indexes and enforced at query time so that only authorized content is included in search results.
-
-For other data sources, you can [push a document payload that includes user or group permission metadata](search-index-access-control-lists-and-rbac-push-api.md), and those permissions are retained in indexed content and also enforced at query time. This capability is also in preview.
-
-If you can't use preview features and you require permissioned access over content in search results, there's a technique for applying filters that include or exclude documents based on user identity. This workaround adds a string field in the data source that represents a group or user identity, which you can make filterable in your index. For more information about this pattern, see [Security trimming based on identity filters](search-security-trimming-for-azure-search.md). For more information about document access, see [Document-level access control](search-document-level-access-overview.md).
-
-## Data residency
-
-When you set up a search service, you choose a region that determines where customer data is stored and processed. Each region exists within a [geography (Geo)](https://azure.microsoft.com/explore/global-infrastructure/geographies/#overview) that often includes multiple regions (for example, Switzerland is a Geo that contains Switzerland North and Switzerland West). Azure AI Search might replicate your data to another region within the same Geo for durability and high availability. The service won't store or process customer data outside of your specified Geo unless you configure a feature that has a dependency on another Azure resource, and that resource is provisioned in a different region.
-
-Currently, the only external resource that a search service writes to is Azure Storage. The storage account is one that you provide, and it could be in any region. A search service writes to Azure Storage if you use any of the following features:
-
-+ [enrichment cache](enrichment-cache-how-to-configure.md)
-+ [debug session](cognitive-search-debug-session.md)
-+ [knowledge store](knowledge-store-concept-intro.md)
-
-For more information about data residency, see [data residency in Azure](https://azure.microsoft.com/explore/global-infrastructure/data-residency/#overview).
-
-### Exceptions to data residency commitments
-
-Object names appear in the telemetry logs used by Microsoft to provide support for the service. Object names are stored and processed outside of your selected region or location. Object names include the names of indexes and index fields, aliases, indexers, data sources, skillsets, synonym maps, resources, containers, and key vault store. Customers shouldn't place any sensitive data in name fields or create applications designed to store sensitive data in these fields. 
-
-Telemetry logs are retained for one and a half years. During that period, Microsoft might access and reference object names under the following conditions:
-
-+ Diagnose an issue, improve a feature, or fix a bug. In this scenario, data access is internal only, with no third-party access.
-
-+ During support, this information might be used to provide quick resolution to issues and escalate product team if needed
-
-<a name="encryption"></a>
-
-## Data protection
-
-At the storage layer, data encryption is built in for all service-managed content saved to disk, including indexes, synonym maps, and the definitions of indexers, data sources, and skillsets. Service-managed encryption applies to both long-term data storage and temporary data storage.
-
-Optionally, you can add customer-managed keys (CMK) for supplemental encryption of indexed content for double encryption of data at rest. For services created after August 1 2020, CMK encryption extends to short-term data on temporary disks.
-
-### Data in transit
-
-For search service connections over the public internet, Azure AI Search listens on HTTPS port 443.
-
-Azure AI Search supports TLS 1.2 and 1.3 for client-to-service channel encryption:
-
-+ TLS 1.3 is the default on newer client operating systems and versions of .NET.
-+ TLS 1.2 is the default on older systems, but you can [explicitly set TLS 1.3 on a client request](/dotnet/framework/network-programming/tls).
-
-Earlier versions of TLS (1.0 or 1.1) aren't supported.
-
-For more information, see [TLS support in .NET Framework](/dotnet/framework/network-programming/tls#tls-support-in-net-framework).
-
-### Data in use
-
-By default, Azure AI Search deploys your search service on standard Azure infrastructure. This infrastructure encrypts data at rest and in transit, but it doesn't protect data while it's being actively processed in memory.
-
-Optionally, you can use the [Azure portal](search-create-service-portal.md#choose-a-compute-type) or [Services - Create or Update (REST API)](/rest/api/searchmanagement/services/create-or-update) to configure confidential computing during service creation. Confidential computing protects data in use from unauthorized access, including from Microsoft, through hardware attestation and encryption. For more information, see [Confidential computing use cases](/azure/confidential-computing/use-cases-scenarios).
-
-The following table compares both compute types.
-
-| Compute type | Description | Limitations | Cost | Availability |
-|--|--|--|--|--|
-| Default | Processes data on standard VMs with built-in encryption for data at rest and in transit. No hardware-based isolation for data in use. | No limitations. | No change to the base cost of free or billable tiers. | Available in all regions. |
-| Confidential | Processes data on confidential VMs (DCasv5 or DCesv5) in a hardware-based trusted execution environment. Isolates computations and memory from the host operating system and other VMs. | Disables or restricts [agentic retrieval](agentic-retrieval-overview.md), [semantic ranker](semantic-search-overview.md), [query rewrite](semantic-how-to-query-rewrite.md), [skillset execution](cognitive-search-concept-intro.md), and indexers that run in the [multitenant environment](search-howto-run-reset-indexers.md#indexer-execution-environment) <sup>1</sup>. | Adds a 10% surcharge to the base cost of billable tiers. For more information, see the [pricing page](https://azure.microsoft.com/pricing/details/search/). | Available in some regions. For more information, see the [list of supported regions](search-region-support.md). |
-
-<sup>1</sup> When you enable this compute type, indexers can only run in the private execution environment, meaning they run from the search clusters hosted on confidential computing.
-
-> [!IMPORTANT]
-> We only recommend confidential computing for organizations whose compliance or regulatory requirements necessitate data-in-use protection. For daily usage, the default compute type suffices.
-
-### Data at rest
-
-For data handled internally by the search service, the following table describes the [data encryption models](/azure/security/fundamentals/encryption-models). Some features, such as knowledge store, incremental enrichment, and indexer-based indexing, read from or write to data structures in other Azure Services. Services that have a dependency on Azure Storage can use the [encryption features](/azure/storage/common/storage-service-encryption) of that technology.
-
-| Model | Keys&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; | Requirements&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; | Restrictions | Applies to |
-|------------------|-------|-------------|--------------|------------|
-| server-side encryption | Microsoft-managed keys | None (built-in) | None, available on all tiers, in all regions, for content created after January 24, 2018. | Content (indexes and synonym maps) and definitions (indexers, data sources, skillsets) on data disks and temporary disks |
-| server-side encryption | customer-managed keys | Azure Key Vault | Available on billable tiers, in specific regions, for content created after August 1, 2020. | Content (indexes and synonym maps) and definitions (indexers, data sources, skillsets) on data disks |
-| server-side full encryption | customer-managed keys | Azure Key Vault | Available on billable tiers, in all regions, on search services after May 13, 2021. | Content (indexes and synonym maps) and definitions (indexers, data sources, skillsets) on data disks and temporary disks |
-
-When you introduce CMK encryption, you're encrypting content twice. For the objects and fields noted in the previous section, content is first encrypted with your CMK, and secondly with the Microsoft-managed key. Content is doubly encrypted on data disks for long-term storage, and on temporary disks used for short-term storage.
-
-#### Service-managed keys
-
-Service-managed encryption is a Microsoft-internal operation that uses 256-bit [AES encryption](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard). It occurs automatically on all indexing, including on incremental updates to indexes that aren't fully encrypted (created before January 2018).
-
-Service-managed encryption applies to all content on long-term and short-term storage.
-
-#### Customer-managed keys (CMK)
-
-Customers use CMK for two reasons: extra protection, and the ability to revoke keys, preventing access to content.
-
-Customer-managed keys require another billable service, Azure Key Vault, which can be in a different region, but under the same Azure tenant, as Azure AI Search. 
-
-CMK support was rolled out in two phases. If you created your search service during the first phase, CMK encryption was restricted to long-term storage and specific regions. Services created in the second phase can use CMK encryption in any region. As part of the second wave rollout, content is CMK-encrypted on both long-term and short-term storage.
-
-+ The first rollout was on August 1, 2020 and included the following five regions. Search services created in the following regions supported CMK for data disks, but not temporary disks:
-
-  + West US 2
-  + East US
-  + South Central US
-  + US Gov Virginia
-  + US Gov Arizona
-
-+ The second rollout on May 13, 2021 added encryption for temporary disks and extended CMK encryption to [all supported regions](search-region-support.md).
-
-  If you're using CMK from a service created during the first rollout and you also want CMK encryption over temporary disks, you need to create a new search service in your region of choice and redeploy your content. To determine your service creation date, see [Check your service creation or upgrade date](search-how-to-upgrade.md#check-your-service-creation-or-upgrade-date).
-
-Enabling CMK encryption will increase index size and degrade query performance. Based on observations to date, you can expect to see an increase of 30-60 percent in query times, although actual performance will vary depending on the index definition and types of queries. Because of the negative performance impact, we recommend that you only enable this feature on indexes that really require it. For more information, see [Configure customer-managed encryption keys in Azure AI Search](search-security-manage-encryption-keys.md).
-
-## Logging and monitoring
-
-Azure AI Search doesn't log user identities so you can't refer to logs for information about a specific user. However, the service does log create-read-update-delete operations, which you might be able to correlate with other logs to understand the agency of specific actions.
-
-Using alerts and the logging infrastructure in Azure, you can pick up on query volume spikes or other actions that deviate from expected workloads. For more information about setting up logs, see [Collect and analyze log data](monitor-azure-cognitive-search.md) and [Monitor query requests](search-monitor-queries.md).
-
-## Compliance and governance
-
-Azure AI Search participates in regular audits, and has been certified against many global, regional, and industry-specific standards for both the public cloud and Azure Government. For the complete list, download the [**Microsoft Azure Compliance Offerings** whitepaper](https://azure.microsoft.com/resources/microsoft-azure-compliance-offerings/) from the official Audit reports page.
-
-We recommend that you regularly review [Azure AI Search compliance certifications and documentation](/azure/compliance/) to ensure alignment with your regulatory requirements. 
-
-### Use Azure Policy
-
-For compliance, you can use [Azure Policy](/azure/governance/policy/overview) to implement the high-security best practices of [Microsoft cloud security benchmark](/security/benchmark/azure/introduction). The Microsoft cloud security benchmark is a collection of security recommendations, codified into security controls that map to key actions you should take to mitigate threats to services and data. There are currently 12 security controls, including [Network Security](/security/benchmark/azure/mcsb-network-security), Logging and Monitoring, and [Data Protection](/security/benchmark/azure/mcsb-data-protection).
-
-Azure Policy is a capability built into Azure that helps you manage compliance for multiple standards, including those of Microsoft cloud security benchmark. For well-known benchmarks, Azure Policy provides built-in definitions that provide both criteria and an actionable response that addresses noncompliance.
-
-For Azure AI Search, there's currently one built-in definition. It's for resource logging. You can assign a policy that identifies search services that are missing resource logging, and then turn it on. For more information, see [Azure Policy Regulatory Compliance controls for Azure AI Search](security-controls-policy.md).
-
-### Use tags
-
-Apply metadata tags to categorize search services based on data sensitivity and compliance requirements. This facilitates proper governance and security controls. For more information, see [Use tags to organize your Azure resources](/azure/azure-resource-manager/management/tag-resources) and [General guidance – Organize Azure resources using tags](/azure/azure-resource-manager/management/tag-resources).
-
-## Related content
-
-+ [Azure security fundamentals](/azure/security/fundamentals/)
-+ [Azure Security](https://azure.microsoft.com/overview/security)
-+ [Microsoft Defender for Cloud](/azure/security-center/)
-
-We also recommend the following [video on security features](/Shows/AI-Show/Azure-Cognitive-Search-Whats-new-in-security). It's several years old and doesn't cover newer features, but it covers these features: CMK, IP firewalls, and private link. If you use those features, you might find this video helpful.

@@ -420,16 +420,10 @@ items:
       items:
       - name: What is multimodal search?
         href: multimodal-search-overview.md
-      - name: Tutorials
-        items:
-        - name: Vectorize images and text
-          href: tutorial-document-extraction-multimodal-embeddings.md
-        - name: Vectorize from a structured document layout
-          href: tutorial-document-layout-multimodal-embeddings.md
-        - name: Verbalize images using generative AI
-          href: tutorial-document-extraction-image-verbalization.md
-        - name: Verbalize images from a structured document layout
-          href: tutorial-document-layout-image-verbalization.md
+      - name: Tutorial (REST)
+        href: tutorial-multimodal.md
+      - name: Multimodal samples (REST)
+        href: https://github.com/Azure-Samples/azure-search-rest-samples/tree/main/multimodal-tutorial
     - name: Other query types
       href: search-query-overview.md
   - name: Relevance and ranking
@@ -512,8 +506,10 @@ items:
 
 - name: Security
   items:
-  - name: Security in Azure AI Search
-    href: search-security-overview.md
+  - name: Built-in security
+    href: search-security-built-in.md
+  - name: Secure a search service
+    href: search-security-best-practices.md
   - name: Network access
     items:
     - name: Configure network access

@@ -1,769 +0,0 @@
----
-title: 'Tutorial: Verbalize images using generative AI'
-titleSuffix: Azure AI Search
-description: Learn how to extract, index, and search multimodal content using the Document Extraction skill for chunking and GenAI Prompt skill for image verbalizations.
-manager: arjagann
-author: mdonovan
-ms.author: mdonovan
-ms.service: azure-ai-search
-ms.update-cycle: 180-days
-ms.custom:
-ms.topic: tutorial
-ms.date: 08/27/2025
-
----
-
-# Tutorial: Verbalize images using generative AI
-
-Azure AI Search can extract and index both text and images from PDF documents stored in Azure Blob Storage. This tutorial shows you how to build a multimodal indexing pipeline that *chunks data  using the built-in Text Split skill* and uses *image verbalization* to describe images. Cropped images are stored in a knowledge store, and visual content is described in natural language and ingested alongside text in a searchable index.
-
-To get image verbalizations, each extracted image is passed to the [GenAI Prompt skill (preview)](cognitive-search-skill-genai-prompt.md) that calls a chat completion model to generate a concise textual description. These descriptions, along with the original document text, are then embedded into vector representations using Azure OpenAI’s text-embedding-3-large model. The result is a single index containing searchable content from both modalities: text and verbalized images.
-
-In this tutorial, you use:
-
-+ A 36-page PDF document that combines rich visual content, such as charts, infographics, and scanned pages, with traditional text.
-
-+ An indexer and skillset to create an indexing pipeline that includes AI enrichment through skills.
-
-+ The [Document Extraction skill](cognitive-search-skill-document-extraction.md) for extracting normalized images and text. The [Text Split skill](cognitive-search-skill-textsplit.md) chunks the data.
-
-+ The [GenAI Prompt skill (preview)](cognitive-search-skill-genai-prompt.md) that calls a chat completion model to create descriptions of visual content.
-
-+ A search index configured to store text and image verbalizations. Some content is vectorized for vector-based similarity search.
-
-This tutorial demonstrates a lower-cost approach for indexing multimodal content using the Document Extraction skill and image captioning. It enables extraction and search over both text and images from documents in Azure Blob Storage. However, it doesn't include locational metadata for text, such as page numbers or bounding regions. For a more comprehensive solution that includes structured text layout and spatial metadata, see [Tutorial: Verbalize images from a structured document layout](tutorial-document-layout-image-verbalization.md).
-
-> [!NOTE]
-> Image extraction by the Document Extraction skill isn't free. Setting `imageAction` to `generateNormalizedImages` in the skillset triggers image extraction, which is an extra charge. For billing information, see [Azure AI Search pricing](https://azure.microsoft.com/pricing/details/search/).
-
-## Prerequisites
-
-+ [Azure AI Search](search-create-service-portal.md). [Configure your search service](search-manage.md) for role-based access control and a managed identity. Your service must be on the Basic tier or higher. This tutorial isn't supported on the Free tier.
-
-+ [Azure Storage](/azure/storage/common/storage-account-create), used for storing sample data and for creating a [knowledge store](knowledge-store-concept-intro.md).
-
-+ [Azure OpenAI](/azure/ai-foundry/openai/how-to/create-resource) with a deployment of
-
-  + A chat completion model hosted in Microsoft Foundry or another source. The model is used to verbalize image content. You provide the URI to the hosted model in the GenAI Prompt skill definition. You can use [any chat completion model](cognitive-search-skill-genai-prompt.md#supported-models).
-
-  + A text embedding model deployed in Foundry. The model is used to vectorize text content pull from source documents and the image descriptions generated by the chat completion model. For integrated vectorization, the embedding model must be located in Foundry, and it must be either text-embedding-ada-002, text-embedding-3-large, or text-embedding-3-small. If you want to use an external embedding model, use a custom skill instead of the Azure OpenAI embedding skill.
-
-+ [Visual Studio Code](https://code.visualstudio.com/download) with a [REST client](https://marketplace.visualstudio.com/items?itemName=humao.rest-client).
-
-## Prepare data
-
-The following instructions apply to Azure Storage which provides the sample data and also hosts the knowledge store. A search service identity needs read access to Azure Storage to retrieve the sample data, and it needs write access to create the knowledge store. The search service creates the container for cropped images during skillset processing, using the name you provide in an environment variable.
-
-1. Download the following sample PDF: [sustainable-ai-pdf](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Accelerating-Sustainability-with-AI-2025.pdf)
-
-1. In Azure Storage, create a new container named **sustainable-ai-pdf**.
-
-1. [Upload the sample data file](/azure/storage/blobs/storage-quickstart-blobs-portal).
-
-1. [Create role assignments and specify a managed identity in a connection string](search-howto-managed-identities-storage.md):
-
-   1. Assign **Storage Blob Data Reader** for data retrieval by the indexer. Assign **Storage Blob Data Contributor** and **Storage Table Data Contributor** to create and load the knowledge store. You can use either a system-assigned managed identity or a user-assigned managed identity for your search service role assignment.
-
-   1. For connections made using a system-assigned managed identity, get a connection string that contains a ResourceId, with no account key or password. The ResourceId must include the subscription ID of the storage account, the resource group of the storage account, and the storage account name. The connection string is similar to the following example:
-
-        ```json
-        "credentials" : { 
-            "connectionString" : "ResourceId=/subscriptions/00000000-0000-0000-0000-00000000/resourceGroups/MY-DEMO-RESOURCE-GROUP/providers/Microsoft.Storage/storageAccounts/MY-DEMO-STORAGE-ACCOUNT/;" 
-        }
-        ```
-
-   1. For connections made using a user-assigned managed identity, get a connection string that contains a ResourceId, with no account key or password. The ResourceId must include the subscription ID of the storage account, the resource group of the storage account, and the storage account name. Provide an identity using the syntax shown in the following example. Set userAssignedIdentity to the user-assigned managed identity. The connection string is similar to the following example:
-
-      ```json
-      "credentials" : { 
-          "connectionString" : "ResourceId=/subscriptions/00000000-0000-0000-0000-00000000/resourceGroups/MY-DEMO-RESOURCE-GROUP/providers/Microsoft.Storage/storageAccounts/MY-DEMO-STORAGE-ACCOUNT/;" 
-      },
-      "identity" : { 
-          "@odata.type": "#Microsoft.Azure.Search.DataUserAssignedIdentity",
-          "userAssignedIdentity" : "/subscriptions/00000000-0000-0000-0000-00000000/resourcegroups/MY-DEMO-RESOURCE-GROUP/providers/Microsoft.ManagedIdentity/userAssignedIdentities/MY-DEMO-USER-MANAGED-IDENTITY" 
-      }
-      ```
-
-## Prepare models
-
-This tutorial assumes you have an existing Azure OpenAI resource through which the skills call the text embedding model and chat completion models. The search service connects to the models during skillset processing and during query execution using its managed identity. This section gives you guidance and links for assigning roles for authorized access.
-
-1. Sign in to the Azure portal (not the Foundry portal) and find the Azure OpenAI resource.
-
-1. Select **Access control (IAM)**.
-
-1. Select **Add** and then **Add role assignment**.
-
-1. Search for **Cognitive Services OpenAI User** and then select it.
-
-1. Choose **Managed identity** and then assign your [search service managed identity](search-how-to-managed-identities.md).
-
-For more information, see [Role-based access control for Azure OpenAI in Foundry Models](/azure/ai-foundry/openai/how-to/role-based-access-control).
-
-## Set up your REST file
-
-For this tutorial, your local REST client connection to Azure AI Search requires an endpoint and an API key. You can get these values from the Azure portal. For alternative connection methods, see [Connect to a search service](search-get-started-rbac.md).
-
-For authenticated connections that occur during indexer and skillset processing, the search service uses the role assignments you previously defined.
-
-1. Start Visual Studio Code and create a new file.
-
-1. Provide values for variables used in the request. For `@storageConnection`, make sure your connection string doesn't have a trailing semicolon or quotation marks. For `@imageProjectionContainer`, provide a container name that's unique in blob storage. Azure AI Search creates this container for you during skills processing.
-
-   ```http
-   @searchUrl = PUT-YOUR-SEARCH-SERVICE-ENDPOINT-HERE
-   @searchApiKey = PUT-YOUR-ADMIN-API-KEY-HERE
-   @storageConnection = PUT-YOUR-STORAGE-CONNECTION-STRING-HERE
-   @openAIResourceUri = PUT-YOUR-OPENAI-URI-HERE
-   @openAIKey = PUT-YOUR-OPENAI-KEY-HERE
-   @chatCompletionResourceUri = PUT-YOUR-CHAT-COMPLETION-URI-HERE
-   @chatCompletionKey = PUT-YOUR-CHAT-COMPLETION-KEY-HERE
-   @imageProjectionContainer=sustainable-ai-pdf-images
-   ```
-
-1. Save the file using a `.rest` or `.http` file extension. For help with the REST client, see [Quickstart: Full-text search using REST](search-get-started-text.md).
-
-To get the Azure AI Search endpoint and API key:
-
-1. Sign in to the [Azure portal](https://portal.azure.com), navigate to the search service **Overview** page, and copy the URL. An example endpoint might look like `https://mydemo.search.windows.net`.
-
-1. Under **Settings** > **Keys**, copy an admin key. Admin keys are used to add, modify, and delete objects. There are two interchangeable admin keys. Copy either one.
-
-   :::image type="content" source="media/search-get-started-rest/get-url-key.png" alt-text="Screenshot of the URL and API keys in the Azure portal.":::
-
-## Create a data source
-
-[Create Data Source (REST)](/rest/api/searchservice/data-sources/create) creates a data source connection that specifies what data to index.
-
-```http
-### Create a data source
-POST {{searchUrl}}/datasources?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-
-  {
-    "name": "doc-extraction-image-verbalization-ds",
-    "description": null,
-    "type": "azureblob",
-    "subtype": null,
-    "credentials":{
-      "connectionString":"{{storageConnection}}"
-    },
-    "container": {
-      "name": "sustainable-ai-pdf",
-      "query": null
-    },
-    "dataChangeDetectionPolicy": null,
-    "dataDeletionDetectionPolicy": null,
-    "encryptionKey": null,
-    "identity": null
-  }
-```
-
-Send the request. The response should look like:
-
-```json
-HTTP/1.1 201 Created
-Transfer-Encoding: chunked
-Content-Type: application/json; odata.metadata=minimal; odata.streaming=true; charset=utf-8
-Location: https://<YOUR-SEARCH-SERVICE-NAME>.search.windows-int.net:443/datasources('doc-extraction-multimodal-embedding-ds')?api-version=2025-11-01-preview -Preview
-Server: Microsoft-IIS/10.0
-Strict-Transport-Security: max-age=2592000, max-age=15724800; includeSubDomains
-Preference-Applied: odata.include-annotations="*"
-OData-Version: 4.0
-request-id: 4eb8bcc3-27b5-44af-834e-295ed078e8ed
-elapsed-time: 346
-Date: Sat, 26 Apr 2025 21:25:24 GMT
-Connection: close
-
-{
-  "name": "doc-extraction-multimodal-embedding-ds",
-  "description": null,
-  "type": "azureblob",
-  "subtype": null,
-  "indexerPermissionOptions": [],
-  "credentials": {
-    "connectionString": null
-  },
-  "container": {
-    "name": "sustainable-ai-pdf",
-    "query": null
-  },
-  "dataChangeDetectionPolicy": null,
-  "dataDeletionDetectionPolicy": null,
-  "encryptionKey": null,
-  "identity": null
-}
-```
-
-## Create an index
-
-[Create Index (REST)](/rest/api/searchservice/indexes/create) creates a search index on your search service. An index specifies all the parameters and their attributes.
-
-For nested JSON, the index fields must be identical to the source fields. Currently, Azure AI Search doesn't support field mappings to nested JSON, so field names and data types must match completely. The following index aligns to the JSON elements in the raw content.
-
-```http
-### Create an index
-POST {{searchUrl}}/indexes?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-
-{
-    "name": "doc-extraction-image-verbalization-index",
-    "fields": [
-        {
-            "name": "content_id",
-            "type": "Edm.String",
-            "retrievable": true,
-            "key": true,
-            "analyzer": "keyword"
-        },
-        {
-            "name": "text_document_id",
-            "type": "Edm.String",
-            "searchable": false,
-            "filterable": true,
-            "retrievable": true,
-            "stored": true,
-            "sortable": false,
-            "facetable": false
-        },          
-        {
-            "name": "document_title",
-            "type": "Edm.String",
-            "searchable": true
-        },
-        {
-            "name": "image_document_id",
-            "type": "Edm.String",
-            "filterable": true,
-            "retrievable": true
-        },
-        {
-            "name": "content_text",
-            "type": "Edm.String",
-            "searchable": true,
-            "retrievable": true
-        },
-        {
-            "name": "content_embedding",
-            "type": "Collection(Edm.Single)",
-            "dimensions": 3072,
-            "searchable": true,
-            "retrievable": true,
-            "vectorSearchProfile": "hnsw"
-        },
-        {
-            "name": "content_path",
-            "type": "Edm.String",
-            "searchable": false,
-            "retrievable": true
-        },
-        {
-            "name": "offset",
-            "type": "Edm.String",
-            "searchable": false,
-            "retrievable": true
-        },
-        {
-            "name": "location_metadata",
-            "type": "Edm.ComplexType",
-            "fields": [
-                {
-                "name": "page_number",
-                "type": "Edm.Int32",
-                "searchable": false,
-                "retrievable": true
-                },
-                {
-                "name": "bounding_polygons",
-                "type": "Edm.String",
-                "searchable": false,
-                "retrievable": true,
-                "filterable": false,
-                "sortable": false,
-                "facetable": false
-                }
-            ]
-        }         
-    ],
-    "vectorSearch": {
-        "profiles": [
-            {
-                "name": "hnsw",
-                "algorithm": "defaulthnsw",
-                "vectorizer": "demo-vectorizer"
-            }
-        ],
-        "algorithms": [
-            {
-                "name": "defaulthnsw",
-                "kind": "hnsw",
-                "hnswParameters": {
-                    "m": 4,
-                    "efConstruction": 400,
-                    "metric": "cosine"
-                }
-            }
-        ],
-        "vectorizers": [
-            {
-              "name": "demo-vectorizer",
-              "kind": "azureOpenAI",    
-              "azureOpenAIParameters": {
-                "resourceUri": "{{openAIResourceUri}}",
-                "deploymentId": "text-embedding-3-large",
-                "searchApiKey": "{{openAIKey}}",
-                "modelName": "text-embedding-3-large"
-              }
-            }
-        ]
-    },
-    "semantic": {
-        "defaultConfiguration": "semanticconfig",
-        "configurations": [
-            {
-                "name": "semanticconfig",
-                "prioritizedFields": {
-                    "titleField": {
-                        "fieldName": "document_title"
-                    },
-                    "prioritizedContentFields": [
-                    ],
-                    "prioritizedKeywordsFields": []
-                }
-            }
-        ]
-    }
-}
-```
-
-Key points:
-
-+ Text and image embeddings are stored in the `content_embedding` field and must be configured with appropriate dimensions (for example, 3072) and a vector search profile.
-
-+ `location_metadata` captures bounding polygon and page number metadata for each normalized image, enabling precise spatial search or UI overlays. `location_metadata` only exists for images in this scenario. If you'd like to capture locational metadata for text as well, consider using [Document Layout skill](cognitive-search-skill-document-intelligence-layout.md). An in-depth tutorial is linked at the bottom of the page.
-
-+ For more information on vector search, see [Vectors in Azure AI Search](vector-search-overview.md).
-
-+ For more information on semantic ranking, see [Semantic ranking in Azure AI Search](semantic-search-overview.md)
-
-## Create a skillset
-
-[Create Skillset (REST)](/rest/api/searchservice/skillsets/create) creates a skillset on your search service. A skillset defines the operations that chunk and embed content prior to indexing. This skillset uses the built-in Document Extraction skill to extract text and images. It uses Text Split skill to chunk large text. It uses Azure OpenAI Embedding skill to vectorize text content.
-
-The skillset also performs actions specific to images. It uses the GenAI Prompt skill to generate image descriptions. It also creates a knowledge store that stores intact images so that you can return them in a query.
-
-```http
-### Create a skillset
-POST {{searchUrl}}/skillsets?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-
-{
-  "name": "doc-extraction-image-verbalization-skillset",
-  "description": "A test skillset",
-  "skills": [
-    {
-      "@odata.type": "#Microsoft.Skills.Util.DocumentExtractionSkill",
-      "name": "document-extraction-skill",
-      "description": "Document extraction skill to extract text and images from documents",
-      "parsingMode": "default",
-      "dataToExtract": "contentAndMetadata",
-      "configuration": {
-          "imageAction": "generateNormalizedImages",
-          "normalizedImageMaxWidth": 2000,
-          "normalizedImageMaxHeight": 2000
-      },
-      "context": "/document",
-      "inputs": [
-        {
-          "name": "file_data",
-          "source": "/document/file_data"
-        }
-      ],
-      "outputs": [
-        {
-          "name": "content",
-          "targetName": "extracted_content"
-        },
-        {
-          "name": "normalized_images",
-          "targetName": "normalized_images"
-        }
-      ]
-    },
-    {
-      "@odata.type": "#Microsoft.Skills.Text.SplitSkill",
-      "name": "split-skill",
-      "description": "Split skill to chunk documents",
-      "context": "/document",
-      "defaultLanguageCode": "en",
-      "textSplitMode": "pages",
-      "maximumPageLength": 2000,
-      "pageOverlapLength": 200,
-      "unit": "characters",
-      "inputs": [
-        {
-          "name": "text",
-          "source": "/document/extracted_content",
-          "inputs": []
-        }
-      ],
-      "outputs": [
-        {
-          "name": "textItems",
-          "targetName": "pages"
-        }
-      ]
-    }, 
-    {
-    "@odata.type": "#Microsoft.Skills.Text.AzureOpenAIEmbeddingSkill",
-    "name": "text-embedding-skill",
-    "description": "Embedding skill for text",
-    "context": "/document/pages/*",
-    "inputs": [
-        {
-        "name": "text",
-        "source": "/document/pages/*"
-        }
-    ],
-    "outputs": [
-        {
-        "name": "embedding",
-        "targetName": "text_vector"
-        }
-    ],
-    "resourceUri": "{{openAIResourceUri}}",
-    "deploymentId": "text-embedding-3-large",
-    "searchApiKey": "{{openAIKey}}",
-    "dimensions": 3072,
-    "modelName": "text-embedding-3-large"
-    },
-    {
-    "@odata.type": "#Microsoft.Skills.Custom.ChatCompletionSkill",
-    "name": "genAI-prompt-skill",
-    "description": "GenAI Prompt skill for image verbalization",
-    "uri": "{{chatCompletionResourceUri}}",
-    "timeout": "PT1M",
-    "searchApiKey": "{{chatCompletionKey}}",
-    "context": "/document/normalized_images/*",
-    "inputs": [
-        {
-        "name": "systemMessage",
-        "source": "='You are tasked with generating concise, accurate descriptions of images, figures, diagrams, or charts in documents. The goal is to capture the key information and meaning conveyed by the image without including extraneous details like style, colors, visual aesthetics, or size.\n\nInstructions:\nContent Focus: Describe the core content and relationships depicted in the image.\n\nFor diagrams, specify the main elements and how they are connected or interact.\nFor charts, highlight key data points, trends, comparisons, or conclusions.\nFor figures or technical illustrations, identify the components and their significance.\nClarity & Precision: Use concise language to ensure clarity and technical accuracy. Avoid subjective or interpretive statements.\n\nAvoid Visual Descriptors: Exclude details about:\n\nColors, shading, and visual styles.\nImage size, layout, or decorative elements.\nFonts, borders, and stylistic embellishments.\nContext: If relevant, relate the image to the broader content of the technical document or the topic it supports.\n\nExample Descriptions:\nDiagram: \"A flowchart showing the four stages of a machine learning pipeline: data collection, preprocessing, model training, and evaluation, with arrows indicating the sequential flow of tasks.\"\n\nChart: \"A bar chart comparing the performance of four algorithms on three datasets, showing that Algorithm A consistently outperforms the others on Dataset 1.\"\n\nFigure: \"A labeled diagram illustrating the components of a transformer model, including the encoder, decoder, self-attention mechanism, and feedforward layers.\"'"
-        },
-        {
-        "name": "userMessage",
-        "source": "='Please describe this image.'"
-        },
-        {
-        "name": "image",
-        "source": "/document/normalized_images/*/data"
-        }
-        ],
-        "outputs": [
-            {
-            "name": "response",
-            "targetName": "verbalizedImage"
-            }
-        ]
-    },    
-    {
-    "@odata.type": "#Microsoft.Skills.Text.AzureOpenAIEmbeddingSkill",
-    "name": "verbalized-image-embedding-skill",
-    "description": "Embedding skill for verbalized images",
-    "context": "/document/normalized_images/*",
-    "inputs": [
-        {
-        "name": "text",
-        "source": "/document/normalized_images/*/verbalizedImage",
-        "inputs": []
-        }
-    ],
-    "outputs": [
-        {
-        "name": "embedding",
-        "targetName": "verbalizedImage_vector"
-        }
-    ],
-    "resourceUri": "{{openAIResourceUri}}",
-    "deploymentId": "text-embedding-3-large",
-    "searchApiKey": "{{openAIKey}}",
-    "dimensions": 3072,
-    "modelName": "text-embedding-3-large"
-    },
-    {
-      "@odata.type": "#Microsoft.Skills.Util.ShaperSkill",
-      "name": "shaper-skill",
-      "description": "Shaper skill to reshape the data to fit the index schema",
-      "context": "/document/normalized_images/*",
-      "inputs": [
-        {
-          "name": "normalized_images",
-          "source": "/document/normalized_images/*",
-          "inputs": []
-        },
-        {
-          "name": "imagePath",
-          "source": "='{{imageProjectionContainer}}/'+$(/document/normalized_images/*/imagePath)",
-          "inputs": []
-        },
-        {
-          "name": "location_metadata",
-          "sourceContext": "/document/normalized_images/*",
-          "inputs": [
-            {
-              "name": "page_number",
-              "source": "/document/normalized_images/*/pageNumber"
-            },
-            {
-              "name": "bounding_polygons",
-              "source": "/document/normalized_images/*/boundingPolygon"
-            }              
-          ]
-        }        
-      ],
-      "outputs": [
-        {
-          "name": "output",
-          "targetName": "new_normalized_images"
-        }
-      ]
-    }      
-  ], 
-   "indexProjections": {
-      "selectors": [
-        {
-          "targetIndexName": "doc-extraction-image-verbalization-index",
-          "parentKeyFieldName": "text_document_id",
-          "sourceContext": "/document/pages/*",
-          "mappings": [    
-            {
-            "name": "content_embedding",
-            "source": "/document/pages/*/text_vector"
-            },                      
-            {
-              "name": "content_text",
-              "source": "/document/pages/*"
-            },             
-            {
-              "name": "document_title",
-              "source": "/document/document_title"
-            }   
-          ]
-        },        
-        {
-          "targetIndexName": "doc-extraction-image-verbalization-index",
-          "parentKeyFieldName": "image_document_id",
-          "sourceContext": "/document/normalized_images/*",
-          "mappings": [    
-            {
-            "name": "content_text",
-            "source": "/document/normalized_images/*/verbalizedImage"
-            },  
-            {
-            "name": "content_embedding",
-            "source": "/document/normalized_images/*/verbalizedImage_vector"
-            },                                           
-            {
-              "name": "content_path",
-              "source": "/document/normalized_images/*/new_normalized_images/imagePath"
-            },                    
-            {
-              "name": "document_title",
-              "source": "/document/document_title"
-            },
-            {
-              "name": "locationMetadata",
-              "source": "/document/normalized_images/*/new_normalized_images/location_metadata"
-            }            
-          ]
-        }
-      ],
-      "parameters": {
-        "projectionMode": "skipIndexingParentDocuments"
-      }
-  },  
-  "knowledgeStore": {
-    "storageConnectionString": "{{storageConnection}}",
-    "identity": null,
-    "projections": [
-      {
-        "files": [
-          {
-            "storageContainer": "{{imageProjectionContainer}}",
-            "source": "/document/normalized_images/*"
-          }
-        ]
-      }
-    ]
-  }
-}
-
-
-```
-
-This skillset extracts text and images, vectorizes both, and shapes the image metadata for projection into the index.
-
-Key points:
-
-+ The `content_text` field is populated in two ways:
-
-  + From document text extracted using the Document Extraction skill and chunked using the Text Split skill
-
-  + From image content using the GenAI Prompt skill, which generates descriptive captions for each normalized image
-  
-+ The `content_embedding` field contains 3072-dimensional embeddings for both page text and verbalized image descriptions. These are generated using the text-embedding-3-large model from Azure OpenAI.
-
-+ `content_path` contains the relative path to the image file within the designated image projection container. This field is generated only for images extracted from PDFs when `imageAction` is set to `generateNormalizedImages`, and can be mapped from the enriched document from the source field `/document/normalized_images/*/imagePath`.
-
-## Create and run an indexer
-
-[Create Indexer](/rest/api/searchservice/indexers/create) creates an indexer on your search service. An indexer connects to the data source, loads data, runs a skillset, and indexes the enriched data.
-
-```http
-### Create and run an indexer
-POST {{searchUrl}}/indexers?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-
-{
-  "dataSourceName": "doc-extraction-image-verbalization-ds",
-  "targetIndexName": "doc-extraction-image-verbalization-index",
-  "skillsetName": "doc-extraction-image-verbalization-skillset",
-  "parameters": {
-    "maxFailedItems": -1,
-    "maxFailedItemsPerBatch": 0,
-    "batchSize": 1,
-    "configuration": {
-      "allowSkillsetToReadFileData": true
-    }
-  },
-  "fieldMappings": [
-    {
-      "sourceFieldName": "metadata_storage_name",
-      "targetFieldName": "document_title"
-    }
-  ],
-  "outputFieldMappings": []
-}
-```
-
-## Run queries
-
-You can start searching as soon as the first document is loaded.
-
-```http
-### Query the index
-POST {{searchUrl}}/indexes/doc-extraction-image-verbalization-index/docs/search?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-  
-  {
-    "search": "*",
-    "count": true
-  }
-```
-
-Send the request. This is an unspecified full-text search query that returns all of the fields marked as retrievable in the index, along with a document count. The response should look like:
-
-```json
-HTTP/1.1 200 OK
-Transfer-Encoding: chunked
-Content-Type: application/json; odata.metadata=minimal; odata.streaming=true; charset=utf-8
-Content-Encoding: gzip
-Vary: Accept-Encoding
-Server: Microsoft-IIS/10.0
-Strict-Transport-Security: max-age=2592000, max-age=15724800; includeSubDomains
-Preference-Applied: odata.include-annotations="*"
-OData-Version: 4.0
-request-id: 712ca003-9493-40f8-a15e-cf719734a805
-elapsed-time: 198
-Date: Wed, 30 Apr 2025 23:20:53 GMT
-Connection: close
-
-{
-  "@odata.count": 100,
-  "@search.nextPageParameters": {
-    "search": "*",
-    "count": true,
-    "skip": 50
-  },
-  "value": [
-  ],
-  "@odata.nextLink": "https://<YOUR-SEARCH-SERVICE-NAME>.search.windows.net/indexes/doc-extraction-image-verbalization-index/docs/search?api-version=2025-11-01-preview "
-}
-```
-
-100 documents are returned in the response.
-
-For filters, you can also use Logical operators (and, or, not) and comparison operators (eq, ne, gt, lt, ge, le). String comparisons are case -sensitive. For more information and examples, see [Examples of simple search queries](search-query-simple-examples.md).
-
-> [!NOTE]
-> The `$filter` parameter only works on fields that were marked filterable during index creation.
-
-Here are some examples of other queries:
-
-```http
-### Query for only images
-POST {{searchUrl}}/indexes/doc-extraction-image-verbalization-index/docs/search?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-  
-  {
-    "search": "*",
-    "count": true,
-    "filter": "image_document_id ne null"
-  }
-```
-
-```http
-### Query for text or images with content related to energy, returning the id, parent document, and text (extracted text for text chunks and verbalized image text for images), and the content path where the image is saved in the knowledge store (only populated for images)
-POST {{searchUrl}}/indexes/doc-extraction-image-verbalization-index/docs/search?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-  
-  {
-    "search": "energy",
-    "count": true,
-    "select": "content_id, document_title, content_text, content_path"
-  }
-```
-
-## Reset and rerun
-
-Indexers can be reset to clear the high-water mark, which allows a full rerun. The following POST requests are for reset, followed by rerun.
-
-```http
-### Reset the indexer
-POST {{searchUrl}}/indexers/doc-extraction-image-verbalization-indexer/reset?api-version=2025-11-01-preview   HTTP/1.1
-  api-key: {{searchApiKey}}
-```
-
-```http
-### Run the indexer
-POST {{searchUrl}}/indexers/doc-extraction-image-verbalization-indexer/run?api-version=2025-11-01-preview   HTTP/1.1
-  api-key: {{searchApiKey}}
-```
-
-```http
-### Check indexer status 
-GET {{searchUrl}}/indexers/doc-extraction-image-verbalization-indexer/status?api-version=2025-11-01-preview   HTTP/1.1
-  api-key: {{searchApiKey}}
-```
-
-## Clean up resources
-
-When you're working in your own subscription, at the end of a project, it's a good idea to remove the resources that you no longer need. Resources left running can cost you money. You can delete resources individually or delete the resource group to delete the entire set of resources.
-
-You can use the Azure portal to delete indexes, indexers, and data sources.
-
-## See also
-
-Now that you're familiar with a sample implementation of a multimodal indexing scenario, check out:
-
-* [GenAI Prompt skill](cognitive-search-skill-genai-prompt.md)
-* [Vectors in Azure AI Search](vector-search-overview.md)
-* [Semantic ranking in Azure AI Search](semantic-search-overview.md)
-* [Tutorial: Verbalize images from a structured document layout](tutorial-document-layout-image-verbalization.md)

@@ -1,720 +0,0 @@
----
-title: 'Tutorial: Vectorize images and text'
-titleSuffix: Azure AI Search
-description: Learn how to extract, index, and search multimodal content using the Document Extraction skill for chunking and Azure Vision for embeddings.
-manager: arjagann
-author: mdonovan
-ms.author: mdonovan
-ms.service: azure-ai-search
-ms.update-cycle: 180-days
-ms.custom:
-ms.topic: tutorial
-ms.date: 09/27/2025
-
----
-
-# Tutorial: Vectorize images and text
-
-Azure AI Search can extract and index both text and images from PDF documents stored in Azure Blob Storage. This tutorial shows you how to build a multimodal indexing pipeline in Azure AI Search that *chunks data using the built-in Text Split skill* and *uses multimodal embeddings* to vectorize text and images from the same document. Cropped images are stored in a knowledge store, and both text and visual content are vectorized and ingested in a searchable index.
-
-In this tutorial, you use:
-
-+ A 36-page PDF document that combines rich visual content, such as charts, infographics, and scanned pages, with traditional text.
-
-+ An indexer and skillset to create an indexing pipeline that includes AI enrichment through skills.
-
-+ The [Document Extraction skill](cognitive-search-skill-document-extraction.md) for extracting normalized images and text. The [Text Split skill](cognitive-search-skill-textsplit.md) chunks the data.
-
-+ The [Azure Vision multimodal embeddings skill](cognitive-search-skill-vision-vectorize.md) to vectorize text and images.
-
-+ A search index configured to store extracted text and image content. Some content is vectorized for vector-based similarity search.
-
-This tutorial demonstrates a lower-cost approach for indexing multimodal content using the Document Extraction skill. It enables extraction and search over both text and images from documents pulled from Azure Blob Storage. However, it doesn't include locational metadata for text, such as page numbers or bounding regions. For a more comprehensive solution that includes structured text layout and spatial metadata, see [Tutorial: Vectorize from a structured document layout](tutorial-document-layout-multimodal-embeddings.md).
-
-> [!NOTE]
-> Image extraction by the Document Extraction skill isn't free. Setting `imageAction` to `generateNormalizedImages` in the skillset triggers image extraction, which is an extra charge. For billing information, see [Azure AI Search pricing](https://azure.microsoft.com/pricing/details/search/).
-
-## Prerequisites
-
-+ [Microsoft Foundry resource](/azure/ai-services/multi-service-resource). This resource provides access to the Azure Vision multimodal embedding model used in this tutorial. You must use a Foundry resource for skillset access to this resource.
-
-+ [Azure AI Search](search-create-service-portal.md). [Configure your search service](search-manage.md) for role-based access control and a managed identity for connections to Azure Storage and Azure Vision. Your service must be on the Basic tier or higher. This tutorial isn't supported on the Free tier.
-
-+ [Azure Storage](/azure/storage/common/storage-account-create), used for storing sample data and for creating a [knowledge store](knowledge-store-concept-intro.md).
-
-+ [Visual Studio Code](https://code.visualstudio.com/download) with a [REST client](https://marketplace.visualstudio.com/items?itemName=humao.rest-client).
-
-## Limitations
-
-+ The [Azure Vision multimodal embeddings skill](cognitive-search-skill-vision-vectorize.md) has limited regional availability. When you create a Foundry resource, choose a region that provides multimodal embeddings. For an updated list of regions that provide multimodal embeddings, see the [Azure Vision documentation](/azure/ai-services/computer-vision/overview-image-analysis#region-availability).
-
-## Prepare data
-
-The following instructions apply to Azure Storage which provides the sample data and also hosts the knowledge store. A search service identity needs read access to Azure Storage to retrieve the sample data, and it needs write access to create the knowledge store. The search service creates the container for cropped images during skillset processing, using the name you provide in an environment variable.
-
-1. Download the following sample PDF: [sustainable-ai-pdf](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Accelerating-Sustainability-with-AI-2025.pdf)
-
-1. In Azure Storage, create a new container named **sustainable-ai-pdf**.
-
-1. [Upload the sample data file](/azure/storage/blobs/storage-quickstart-blobs-portal).
-
-1. [Create role assignments and specify a managed identity in a connection string](search-howto-managed-identities-storage.md):
-
-   1. Assign **Storage Blob Data Reader** for data retrieval by the indexer. Assign **Storage Blob Data Contributor** and **Storage Table Data Contributor** to create and load the knowledge store. You can use either a system-assigned managed identity or a user-assigned managed identity for your search service role assignment.
-
-   1. For connections made using a system-assigned managed identity, get a connection string that contains a ResourceId, with no account key or password. The ResourceId must include the subscription ID of the storage account, the resource group of the storage account, and the storage account name. The connection string is similar to the following example:
-
-        ```json
-        "credentials" : { 
-            "connectionString" : "ResourceId=/subscriptions/00000000-0000-0000-0000-00000000/resourceGroups/MY-DEMO-RESOURCE-GROUP/providers/Microsoft.Storage/storageAccounts/MY-DEMO-STORAGE-ACCOUNT/;" 
-        }
-        ```
-
-   1. For connections made using a user-assigned managed identity, get a connection string that contains a ResourceId, with no account key or password. The ResourceId must include the subscription ID of the storage account, the resource group of the storage account, and the storage account name. Provide an identity using the syntax shown in the following example. Set userAssignedIdentity to the user-assigned managed identity. The connection string is similar to the following example:
-
-      ```json
-      "credentials" : { 
-          "connectionString" : "ResourceId=/subscriptions/00000000-0000-0000-0000-00000000/resourceGroups/MY-DEMO-RESOURCE-GROUP/providers/Microsoft.Storage/storageAccounts/MY-DEMO-STORAGE-ACCOUNT/;" 
-      },
-      "identity" : { 
-          "@odata.type": "#Microsoft.Azure.Search.DataUserAssignedIdentity",
-          "userAssignedIdentity" : "/subscriptions/00000000-0000-0000-0000-00000000/resourcegroups/MY-DEMO-RESOURCE-GROUP/providers/Microsoft.ManagedIdentity/userAssignedIdentities/MY-DEMO-USER-MANAGED-IDENTITY" 
-      }
-      ```
-
-## Prepare models
-
-This tutorial assumes you have an existing Foundry resource through which the skill calls the Azure Vision multimodal 4.0 embedding model. The search service connects to the model during skillset processing using its managed identity. This section gives you guidance and links for assigning roles for authorized access.
-
-1. Sign in to the Azure portal (not the Foundry portal) and find the Foundry resource. Make sure it's in a region that provides the [multimodal 4.0 API](/azure/ai-services/computer-vision/overview-image-analysis#region-availability).
-
-1. Select **Access control (IAM)**.
-
-1. Select **Add** and then **Add role assignment**.
-
-1. Search for **Cognitive Services User** and then select it.
-
-1. Choose **Managed identity** and then assign your [search service managed identity](search-how-to-managed-identities.md).
-
-## Set up your REST file
-
-For this tutorial, your local REST client connection to Azure AI Search requires an endpoint and an API key. You can get these values from the Azure portal. For alternative connection methods, see [Connect to a search service](search-get-started-rbac.md).
-
-For authenticated connections that occur during indexer and skillset processing, the search service uses the role assignments you previously defined.
-
-1. Start Visual Studio Code and create a new file.
-
-1. Provide values for variables used in the request. For `@storageConnection`, make sure your connection string doesn't have a trailing semicolon or quotation marks. For `@imageProjectionContainer`, provide a container name that's unique in blob storage. Azure AI Search creates this container for you during skills processing.
-
-   ```http
-    @searchUrl = PUT-YOUR-SEARCH-SERVICE-ENDPOINT-HERE
-    @searchApiKey = PUT-YOUR-ADMIN-API-KEY-HERE
-    @storageConnection = PUT-YOUR-STORAGE-CONNECTION-STRING-HERE
-    @cognitiveServicesUrl = PUT-YOUR-AZURE-AI-FOUNDRY-ENDPOINT-HERE
-    @modelVersion = 2023-04-15
-    @imageProjectionContainer=sustainable-ai-pdf-images
-   ```
-
-1. Save the file using a `.rest` or `.http` file extension. For help with the REST client, see [Quickstart: Full-text search using REST](search-get-started-text.md).
-
-To get the Azure AI Search endpoint and API key:
-
-1. Sign in to the [Azure portal](https://portal.azure.com), navigate to the search service **Overview** page, and copy the URL. An example endpoint might look like `https://mydemo.search.windows.net`.
-
-1. Under **Settings** > **Keys**, copy an admin key. Admin keys are used to add, modify, and delete objects. There are two interchangeable admin keys. Copy either one.
-
-   :::image type="content" source="media/search-get-started-rest/get-url-key.png" alt-text="Screenshot of the URL and API keys in the Azure portal.":::
-
-## Create a data source
-
-[Create Data Source (REST)](/rest/api/searchservice/data-sources/create) creates a data source connection that specifies what data to index.
-
-```http
-POST {{searchUrl}}/datasources?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-
-{
-   "name":"doc-extraction-multimodal-embedding-ds",
-   "description":null,
-   "type":"azureblob",
-   "subtype":null,
-   "credentials":{
-      "connectionString":"{{storageConnection}}"
-   },
-   "container":{
-      "name":"sustainable-ai-pdf",
-      "query":null
-   },
-   "dataChangeDetectionPolicy":null,
-   "dataDeletionDetectionPolicy":null,
-   "encryptionKey":null,
-   "identity":null
-}
-```
-
-Send the request. The response should look like:
-
-```json
-HTTP/1.1 201 Created
-Transfer-Encoding: chunked
-Content-Type: application/json; odata.metadata=minimal; odata.streaming=true; charset=utf-8
-Location: https://<YOUR-SEARCH-SERVICE-NAME>.search.windows-int.net:443/datasources('doc-extraction-multimodal-embedding-ds')?api-version=2025-11-01-preview -Preview
-Server: Microsoft-IIS/10.0
-Strict-Transport-Security: max-age=2592000, max-age=15724800; includeSubDomains
-Preference-Applied: odata.include-annotations="*"
-OData-Version: 4.0
-request-id: 4eb8bcc3-27b5-44af-834e-295ed078e8ed
-elapsed-time: 346
-Date: Sat, 26 Apr 2025 21:25:24 GMT
-Connection: close
-
-{
-  "name": "doc-extraction-multimodal-embedding-ds",
-  "description": null,
-  "type": "azureblob",
-  "subtype": null,
-  "indexerPermissionOptions": [],
-  "credentials": {
-    "connectionString": null
-  },
-  "container": {
-    "name": "sustainable-ai-pdf",
-    "query": null
-  },
-  "dataChangeDetectionPolicy": null,
-  "dataDeletionDetectionPolicy": null,
-  "encryptionKey": null,
-  "identity": null
-}
-```
-
-## Create an index
-
-[Create Index (REST)](/rest/api/searchservice/indexes/create) creates a search index on your search service. An index specifies all the parameters and their attributes.
-
-For nested JSON, the index fields must be identical to the source fields. Currently, Azure AI Search doesn't support field mappings to nested JSON, so field names and data types must match completely. The following index aligns to the JSON elements in the raw content.
-
-```http
-### Create an index
-POST {{searchUrl}}/indexes?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-
-{
-    "name": "doc-extraction-multimodal-embedding-index",
-    "fields": [
-        {
-            "name": "content_id",
-            "type": "Edm.String",
-            "retrievable": true,
-            "key": true,
-            "analyzer": "keyword"
-        },
-        {
-            "name": "text_document_id",
-            "type": "Edm.String",
-            "searchable": false,
-            "filterable": true,
-            "retrievable": true,
-            "stored": true,
-            "sortable": false,
-            "facetable": false
-        },          
-        {
-            "name": "document_title",
-            "type": "Edm.String",
-            "searchable": true
-        },
-        {
-            "name": "image_document_id",
-            "type": "Edm.String",
-            "filterable": true,
-            "retrievable": true
-        },
-        {
-            "name": "content_text",
-            "type": "Edm.String",
-            "searchable": true,
-            "retrievable": true
-        },
-        {
-            "name": "content_embedding",
-            "type": "Collection(Edm.Single)",
-            "dimensions": 1024,
-            "searchable": true,
-            "retrievable": true,
-            "vectorSearchProfile": "hnsw"
-        },
-        {
-            "name": "content_path",
-            "type": "Edm.String",
-            "searchable": false,
-            "retrievable": true
-        },
-        {
-            "name": "offset",
-            "type": "Edm.String",
-            "searchable": false,
-            "retrievable": true
-        },
-        {
-            "name": "location_metadata",
-            "type": "Edm.ComplexType",
-            "fields": [
-                {
-                "name": "page_number",
-                "type": "Edm.Int32",
-                "searchable": false,
-                "retrievable": true
-                },
-                {
-                "name": "bounding_polygons",
-                "type": "Edm.String",
-                "searchable": false,
-                "retrievable": true,
-                "filterable": false,
-                "sortable": false,
-                "facetable": false
-                }
-            ]
-        }         
-    ],
-    "vectorSearch": {
-        "profiles": [
-            {
-                "name": "hnsw",
-                "algorithm": "defaulthnsw",
-                "vectorizer": "demo-vectorizer"
-            }
-        ],
-        "algorithms": [
-            {
-                "name": "defaulthnsw",
-                "kind": "hnsw",
-                "hnswParameters": {
-                    "m": 4,
-                    "efConstruction": 400,
-                    "metric": "cosine"
-                }
-            }
-        ],
-        "vectorizers": [
-            {
-                "name": "demo-vectorizer",
-                "kind": "aiServicesVision",
-                "aiServicesVisionParameters": {
-                    "resourceUri": "{{cognitiveServicesUrl}}",
-                    "authIdentity": null,
-                    "modelVersion": "{{modelVersion}}"
-                }
-            }
-        ]     
-    },
-    "semantic": {
-        "defaultConfiguration": "semanticconfig",
-        "configurations": [
-            {
-                "name": "semanticconfig",
-                "prioritizedFields": {
-                    "titleField": {
-                        "fieldName": "document_title"
-                    },
-                    "prioritizedContentFields": [
-                    ],
-                    "prioritizedKeywordsFields": []
-                }
-            }
-        ]
-    }
-}
-```
-
-Key points:
-
-+ Text and image embeddings are stored in the `content_embedding` field and must be configured with appropriate dimensions, such as 1024, and a vector search profile.
-
-+ `location_metadata` captures bounding polygon and page number metadata for each normalized image, enabling precise spatial search or UI overlays. `location_metadata` only exists for images in this scenario. If you'd like to capture locational metadata for text as well, consider using [Document Layout skill](cognitive-search-skill-document-intelligence-layout.md). An in-depth tutorial is linked at the bottom of the page.
-
-+ For more information on vector search, see [Vectors in Azure AI Search](vector-search-overview.md).
-
-+ For more information on semantic ranking, see [Semantic ranking in Azure AI Search](semantic-search-overview.md)
-
-## Create a skillset
-
-[Create Skillset (REST)](/rest/api/searchservice/skillsets/create) creates a skillset on your search service. A skillset defines the operations that chunk and embed content prior to indexing. This skillset uses the built-in Document Extraction skill to extract text and images. It uses Text Split skill to chunk large text. It uses Azure Vision multimodal embeddings skill to vectorize image and text content.
-
-```http
-### Create a skillset
-POST {{searchUrl}}/skillsets?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-
-{
-  "name": "doc-extraction-multimodal-embedding-skillset",
-	"description": "A test skillset",
-  "skills": [
-    {
-      "@odata.type": "#Microsoft.Skills.Util.DocumentExtractionSkill",
-      "name": "document-extraction-skill",
-      "description": "Document extraction skill to extract text and images from documents",
-      "parsingMode": "default",
-      "dataToExtract": "contentAndMetadata",
-      "configuration": {
-          "imageAction": "generateNormalizedImages",
-          "normalizedImageMaxWidth": 2000,
-          "normalizedImageMaxHeight": 2000
-      },
-      "context": "/document",
-      "inputs": [
-        {
-          "name": "file_data",
-          "source": "/document/file_data"
-        }
-      ],
-      "outputs": [
-        {
-          "name": "content",
-          "targetName": "extracted_content"
-        },
-        {
-          "name": "normalized_images",
-          "targetName": "normalized_images"
-        }
-      ]
-    },
-    {
-      "@odata.type": "#Microsoft.Skills.Text.SplitSkill",
-      "name": "split-skill",
-      "description": "Split skill to chunk documents",
-      "context": "/document",
-      "defaultLanguageCode": "en",
-      "textSplitMode": "pages",
-      "maximumPageLength": 2000,
-      "pageOverlapLength": 200,
-      "unit": "characters",
-      "inputs": [
-        {
-          "name": "text",
-          "source": "/document/extracted_content",
-          "inputs": []
-        }
-      ],
-      "outputs": [
-        {
-          "name": "textItems",
-          "targetName": "pages"
-        }
-      ]
-    },  
-  { 
-    "@odata.type": "#Microsoft.Skills.Vision.VectorizeSkill", 
-    "name": "text-embedding-skill",
-    "description": "Vision Vectorization skill for text",
-    "context": "/document/pages/*", 
-    "modelVersion": "{{modelVersion}}", 
-    "inputs": [ 
-      { 
-        "name": "text", 
-        "source": "/document/pages/*" 
-      } 
-    ], 
-    "outputs": [ 
-      { 
-        "name": "vector",
-        "targetName": "text_vector"
-      } 
-    ] 
-  },
-  { 
-    "@odata.type": "#Microsoft.Skills.Vision.VectorizeSkill", 
-    "name": "image-embedding-skill",
-    "description": "Vision Vectorization skill for images",
-    "context": "/document/normalized_images/*", 
-    "modelVersion": "{{modelVersion}}", 
-    "inputs": [ 
-      { 
-        "name": "image", 
-        "source": "/document/normalized_images/*" 
-      } 
-    ], 
-    "outputs": [ 
-      { 
-        "name": "vector",
-  "targetName": "image_vector"
-      } 
-    ] 
-  },  
-    {
-      "@odata.type": "#Microsoft.Skills.Util.ShaperSkill",
-      "name": "shaper-skill",
-      "description": "Shaper skill to reshape the data to fit the index schema",
-      "context": "/document/normalized_images/*",
-      "inputs": [
-        {
-          "name": "normalized_images",
-          "source": "/document/normalized_images/*",
-          "inputs": []
-        },
-        {
-          "name": "imagePath",
-          "source": "='{{imageProjectionContainer}}/'+$(/document/normalized_images/*/imagePath)",
-          "inputs": []
-        },
-        {
-          "name": "dataUri",
-          "source": "='data:image/jpeg;base64,'+$(/document/normalized_images/*/data)",
-          "inputs": []
-        },
-        {
-          "name": "location_metadata",
-          "sourceContext": "/document/normalized_images/*",
-          "inputs": [
-            {
-              "name": "page_number",
-              "source": "/document/normalized_images/*/pageNumber"
-            },
-            {
-              "name": "bounding_polygons",
-              "source": "/document/normalized_images/*/boundingPolygon"
-            }              
-          ]
-        }          
-      ],
-      "outputs": [
-        {
-          "name": "output",
-          "targetName": "new_normalized_images"
-        }
-      ]
-    }  
-  ],
-  "cognitiveServices": {
-    "@odata.type": "#Microsoft.Azure.Search.AIServicesByIdentity",
-    "subdomainUrl": "{{cognitiveServicesUrl}}",
-    "identity": null
-  },
-  "indexProjections": {
-      "selectors": [
-        {
-          "targetIndexName": "doc-extraction-multimodal-embedding-index",
-          "parentKeyFieldName": "text_document_id",
-          "sourceContext": "/document/pages/*",
-          "mappings": [              
-            {
-              "name": "content_embedding",
-              "source": "/document/pages/*/text_vector"
-            },
-            {
-              "name": "content_text",
-              "source": "/document/pages/*"
-            },             
-            {
-              "name": "document_title",
-              "source": "/document/document_title"
-            }      
-          ]
-        },
-        {
-          "targetIndexName": "doc-extraction-multimodal-embedding-index",
-          "parentKeyFieldName": "image_document_id",
-          "sourceContext": "/document/normalized_images/*",
-          "mappings": [                                   
-            {
-              "name": "content_embedding",
-              "source": "/document/normalized_images/*/image_vector"
-            },
-            {
-              "name": "content_path",
-              "source": "/document/normalized_images/*/new_normalized_images/imagePath"
-            },
-            {
-              "name": "location_metadata",
-              "source": "/document/normalized_images/*/new_normalized_images/location_metadata"
-            },                      
-            {
-              "name": "document_title",
-              "source": "/document/document_title"
-            }                
-          ]
-        }
-      ],
-      "parameters": {
-        "projectionMode": "skipIndexingParentDocuments"
-      }
-  },
-  "knowledgeStore": {
-    "storageConnectionString": "{{storageConnection}}",
-    "identity": null,
-    "projections": [
-      {
-        "files": [
-          {
-            "storageContainer": "{{imageProjectionContainer}}",
-            "source": "/document/normalized_images/*"
-          }
-        ]
-      }
-    ]
-  }
-}
-```
-
-This skillset extracts text and images, vectorizes both, and shapes the image metadata for projection into the index.
-
-Key points:
-
-+ The `content_text` field is populated with text extracted using the Document Extraction Skill and chunked using the Split Skill
-
-+ `content_path` contains the relative path to the image file within the designated image projection container. This field is generated only for images extracted from PDFs when `imageAction` is set to `generateNormalizedImages`, and can be mapped from the enriched document from the source field `/document/normalized_images/*/imagePath`.
-
-+ The Azure Vision multimodal embeddings skill enables embedding of both textual and visual data using the same skill type, differentiated by input (text vs image). For more information, see [Azure Vision multimodal embeddings skill](cognitive-search-skill-vision-vectorize.md).
-
-## Create and run an indexer
-
-[Create Indexer](/rest/api/searchservice/indexers/create) creates an indexer on your search service. An indexer connects to the data source, loads data, runs a skillset, and indexes the enriched data.
-
-```http
-### Create and run an indexer
-POST {{searchUrl}}/indexers?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-
-{
-  "name": "doc-extraction-multimodal-embedding-indexer",
-  "dataSourceName": "doc-extraction-multimodal-embedding-ds",
-  "targetIndexName": "doc-extraction-multimodal-embedding-index",
-  "skillsetName": "doc-extraction-multimodal-embedding-skillset",
-  "parameters": {
-    "maxFailedItems": -1,
-    "maxFailedItemsPerBatch": 0,
-    "batchSize": 1,
-    "configuration": {
-      "allowSkillsetToReadFileData": true
-    }
-  },
-  "fieldMappings": [
-    {
-      "sourceFieldName": "metadata_storage_name",
-      "targetFieldName": "document_title"
-    }
-  ],
-  "outputFieldMappings": []
-}
-```
-
-## Run queries
-
-You can start searching as soon as the first document is loaded.
-
-```http
-### Query the index
-POST {{searchUrl}}/indexes/doc-extraction-multimodal-embedding-index/docs/search?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-  
-  {
-    "search": "*",
-    "count": true
-  }
-```
-
-Send the request. This is an unspecified full-text search query that returns all of the fields marked as retrievable in the index, along with a document count. The response should look like:
-
-```json
-HTTP/1.1 200 OK
-Transfer-Encoding: chunked
-Content-Type: application/json; odata.metadata=minimal; odata.streaming=true; charset=utf-8
-Content-Encoding: gzip
-Vary: Accept-Encoding
-Server: Microsoft-IIS/10.0
-Strict-Transport-Security: max-age=2592000, max-age=15724800; includeSubDomains
-Preference-Applied: odata.include-annotations="*"
-OData-Version: 4.0
-request-id: 712ca003-9493-40f8-a15e-cf719734a805
-elapsed-time: 198
-Date: Wed, 30 Apr 2025 23:20:53 GMT
-Connection: close
-
-{
-  "@odata.count": 100,
-  "@search.nextPageParameters": {
-    "search": "*",
-    "count": true,
-    "skip": 50
-  },
-  "value": [
-  ],
-  "@odata.nextLink": "https://<YOUR-SEARCH-SERVICE-NAME>.search.windows.net/indexes/doc-extraction-multimodal-embedding-index/docs/search?api-version=2025-11-01-preview "
-}
-```
-100 documents are returned in the response.
-
-For filters, you can also use Logical operators (and, or, not) and comparison operators (eq, ne, gt, lt, ge, le). String comparisons are case-sensitive. For more information and examples, see [Examples of simple search queries](search-query-simple-examples.md).
-
-> [!NOTE]
-> The `$filter` parameter only works on fields that were marked filterable during index creation.
-
-```http
-### Query for only images
-POST {{searchUrl}}/indexes/doc-extraction-multimodal-embedding-index/docs/search?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-  
-  {
-    "search": "*",
-    "count": true,
-    "filter": "image_document_id ne null"
-  }
-```
-
-```http
-### Query for text or images with content related to energy, returning the id, parent document, and text (only populated for text chunks), and the content path where the image is saved in the knowledge store (only populated for images)
-POST {{searchUrl}}/indexes/doc-extraction-multimodal-embedding-index/docs/search?api-version=2025-11-01-preview   HTTP/1.1
-  Content-Type: application/json
-  api-key: {{searchApiKey}}
-  
-
-  {
-    "search": "energy",
-    "count": true,
-    "select": "content_id, document_title, content_text, content_path"
-  }
-```
-
-## Reset and rerun
-
-Indexers can be reset to clear the high-water mark, which allows a full rerun. The following POST requests are for reset, followed by rerun.
-
-```http
-### Reset the indexer
-POST {{searchUrl}}/indexers/doc-extraction-multimodal-embedding-indexer/reset?api-version=2025-11-01-preview   HTTP/1.1
-  api-key: {{searchApiKey}}
-```
-
-```http
-### Run the indexer
-POST {{searchUrl}}/indexers/doc-extraction-multimodal-embedding-indexer/run?api-version=2025-11-01-preview   HTTP/1.1
-  api-key: {{searchApiKey}}
-```
-
-```http
-### Check indexer status 
-GET {{searchUrl}}/indexers/doc-extraction-multimodal-embedding-indexer/status?api-version=2025-11-01-preview   HTTP/1.1
-  api-key: {{searchApiKey}}
-```
-
-## Clean up resources
-
-When you're working in your own subscription, at the end of a project, it's a good idea to remove the resources that you no longer need. Resources left running can cost you money. You can delete resources individually or delete the resource group to delete the entire set of resources.
-
-You can use the Azure portal to delete indexes, indexers, and data sources.
-
-## See also
-
-Now that you're familiar with a sample implementation of a multimodal indexing scenario, check out:
-
-* [Azure Vision multimodal embeddings skill](cognitive-search-skill-vision-vectorize.md)
-* [Vectors in Azure AI Search](vector-search-overview.md)
-* [Semantic ranking in Azure AI Search](semantic-search-overview.md)
-* [Tutorial: Verbalize images from a structured document layout](tutorial-document-layout-image-verbalization.md)