The archive should stay behind its firewall
A hypothetical museum stores scanned catalog cards in Azure Blob Storage behind network restrictions. Search administrators want to build an internal Azure AI Search index without exposing the storage account through a public endpoint. Merely creating an indexer does not prove it can reach the protected data source. Microsoft documents a shared private link pattern and an indexer configuration property called executionEnvironment that can pin processing to the search service’s private execution environment. The correct goal is a documented network route to an approved source, followed by an indexing and access audit. Do not mistake private connectivity for unrestricted permission to read or publish the underlying collection.
Understand the two indexer environments
Azure AI Search describes a private execution environment on resources dedicated to the search service and a multitenant environment that can offload processing work. The service normally chooses how to allocate workloads when executionEnvironment uses its standard/default behavior. For a protected data source accessed through a shared private link, Microsoft instructs operators to set indexer parameters.configuration.executionEnvironment to private. That is a placement choice, not a document-level filter or an encryption key. Forcing private processing can affect resource capacity and indexing latency. Confirm the search service tier and the specific feature requirements before adopting it.
Check tier and networking prerequisites
The indexer guidance specifies that pinning indexer processing to private execution is supported on Standard2 or higher services. A team on a different tier should not assume that copying the same JSON property grants the same behavior. The protected storage must have the appropriate networking and identity design, including a supported shared private link route and authorization for the source data. Gather the search service name, region, storage account identity and permitted operations without putting secrets into an article or support screenshot. Validate the organization’s network architecture and current Microsoft requirements before changing a production indexer.
Approve the shared private link first
A shared private link resource has its own provisioning and connection states. Microsoft’s guide indicates that provisioningState should be Succeeded and the connection status Approved for a functional link. An indexer can be configured before approval, but attempts to connect to a protected resource may fail until the path is ready. An approval request is a network workflow, not permission to disclose every Blob document in a public search experience. Keep the resource owner and the search service administrator in the review. Do not disable a storage firewall merely to make a short-term indexing test pass.
Set executionEnvironment on the indexer definition
The documented indexer JSON places executionEnvironment under parameters.configuration, with a value of private. Keep dataSourceName, targetIndexName and optional skillset configuration aligned with the authorized archive pipeline. A typo in the property or attaching the value at the wrong JSON level can leave operators believing a private route was enforced when it was not. Record the indexer definition revision and review the retrieved configuration after creating or updating it. Treat indexer PUT changes as production configuration changes requiring approval; use a nonproduction data source for experimentation. Do not paste account keys or private endpoints into published tutorial examples.
Compare default, private and blocked states
A useful diagnostic comparison has three cases. In the standard environment, the service may choose where eligible processing runs; this is not a promise of a dedicated private route. With executionEnvironment=private and a functional approved link, the indexer can use the intended private path subject to credentials and permissions. If the shared private link is not approved or the indexer runs outside the required private environment, connecting to locked-down storage can fail. These are conceptual states, not captured logs from a live tenant. An HTTP error must be investigated in context rather than taken as definitive proof of one cause.
Confirm connection and indexing separately
After configuration, run an authorized test indexer and inspect the documented status and per-document errors. A successful connection only establishes that the pipeline could reach its source under the configured identity. It does not ensure every Blob was indexed correctly, every rights field was mapped or every deleted source record was removed from search. Compare expected and indexed document counts using a synthetic fixture, review source version identifiers and confirm security trimming on queries. If indexer status reports transient network failures, investigate private link status and permissions before changing data-processing logic. Keep sensitive source documents out of unrestricted debug logs.
Plan for capacity and query latency
Microsoft notes that private indexer execution uses search service resources and can compete with query and management workloads. An archive that runs large OCR or enrichment jobs may therefore need a capacity plan separate from the private networking plan. Measure indexer duration, failure counts, query latency and remaining quotas in a nonproduction environment. Do not promise identical throughput to multitenant offloading. Schedule heavyweight work during controlled windows if that is consistent with the museum’s search availability requirements. A private processing configuration is chosen for secure connectivity, not because it necessarily improves relevance or indexing speed.
Keep the public search boundary independent
Network isolation for indexer-to-storage access is different from authorization for visitors querying the resulting Azure AI Search index. A private link can protect ingestion while the search application still needs field selection, document-level rights filters and its own identity controls. Verify that restricted curator notes never appear in public result projections, regardless of how securely they were ingested. If a source contains confidential donor records, check whether ingestion itself is permitted before configuring the endpoint. The release checklist should distinguish source-network approval, search index access and editorial publication rights. Do not call a successful indexer run a compliance certification.
Source-based limits and handoff
We reviewed Microsoft’s current shared-private-link, indexer execution and indexer creation guides for the documented configuration path and prerequisites. We did not create a link, change a firewall, query a private storage account or benchmark any production search service. The diagrams use synthetic archive objects and do not represent tested Azure screens. Service tiers, networking products and API behavior may change, so validate the exact target subscription and current documentation before implementation. A handoff should record link approval, indexer configuration, service tier, test status and document-level access checks. Only authorized owners should approve network and publishing changes.
How We Research
Our November 11, 2026 editorial review consulted these named primary references: Azure AI Search shared private link guide; Azure AI Search indexer execution environments; Azure AI Search create indexer guide. We compared the field definitions, scope, constraints, failure cases and feature-specific caveats against a hypothetical museum operations workflow. We did not access private accounts, send production API requests, record actual user information, measure benchmark outcomes, inspect a live WordPress instance, or present the drawings as real vendor screenshots. Illustrations show synthetic educational scenarios. Product settings, documentation and account entitlements may change; verify the current reference and obtain operational or privacy approval before applying any change.
Frequently Asked Questions
Set parameters.configuration.executionEnvironment to private in the indexer definition, as documented in the Azure shared private link guide.
Microsoft’s indexer guidance identifies Standard2 or higher for forcing private execution; confirm current tier requirements before deployment.
The documented checks are provisioningState Succeeded and connection status Approved for the relevant shared private link.
No. Search query authorization and document-level access controls must be verified separately from ingestion connectivity.
Do not use that as a quick workaround. Diagnose the approved private route, tier and identity permissions under a reviewed network change process.