Search Administrator
Manage Microsoft Search configuration and editorial content.
Least-privilege guidance: Use for search curators without broader SharePoint or Global Administrator rights.
Assignment playbook
Grant the role without creating standing risk
Choose the narrowest role, scope, duration, and activation model that still completes the task.
Decision checks
- Confirm the operator needs to perform one of the listed tasks, not a broader adjacent task.
- Does not grant access to otherwise protected content returned by search.
- Check whether a workload-specific role or administrative-unit scope can narrow access further.
Recommended assignment
- Use for search curators without broader SharePoint or Global Administrator rights.
- Prefer an eligible PIM assignment for occasional administration; use a time-bound active assignment only when the workflow requires it.
- Scope the assignment to an administrative unit or application when the role supports that scope.
- Require MFA, justification, approval, and a short activation duration for privileged roles where practical.
Verify
- Confirm the assignment appears at the expected scope and as eligible or active as designed.
- Activate the role if required, then test the smallest intended task and one nearby task that should remain denied.
- Review Entra audit logs for the assignment/activation and record the ticket or business justification.
Escalate when
- The role documentation lists the action but the activated, correctly scoped assignment still cannot perform it.
- The task succeeds only with a broader role; verify whether an additional Graph permission, workload RBAC role, ownership, or license is required.
- You can provide the principal, role, assignment scope/type, activation time, target resource, correlation ID, and sanitized audit event.
Role assignment evidence template
Role: Search Administrator
Principal object ID: <guid>
Assignment scope: <tenant | administrative unit | application>
Assignment type: <eligible | active>
UTC activation/test time: <yyyy-mm-dd hh:mm:ssZ>
Correlation ID: <guid>Template only. Record object IDs in a private ticket; never include credentials or tokens.
Read role assignment schedule instances
GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances?$filter=principalId eq '<object-id>'Read-only Microsoft Graph request. Requires an appropriately permissioned administrative session.
Advertisement
Common tasks
- Configure search answers
- Manage bookmarks and acronyms
- Administer supported Microsoft Search settings
What it cannot do
Does not grant access to otherwise protected content returned by search.