An Azure AI Search service with public network access enabled puts your whole RAG corpus behind one query key

Why it happens

AI Search services get created as a supporting resource, one step in a copilot or RAG tutorial, and every quickstart authenticates with an API key against the public endpoint because that works instantly. The service then inherits the security attention of a side component even though it holds a concentrated copy of the data from every source it indexed.

The knobs also mislead. The IP firewall (networkRuleSet.ipRules) only applies while public access is enabled, so an empty rule list means an open front door, and adding a private endpoint does not close the public path: publicNetworkAccess is a separate switch that stays enabled until someone explicitly turns it off. The admin key compounds it, because that single key grants full read and write across every index on the service.

What it costs / blast radius

The blast radius is the union of everything the service ever indexed. A query key leaking from a client app, a repo, or a browser bundle lets anyone run searches against the corpus from anywhere; an admin key leaking hands over read, write, and delete on all of it. Because RAG pipelines deliberately funnel an organization's most useful internal content into the index, the index is often more sensitive than any single source system that fed it. There is little direct cost here; the harm is data exposure. (This is an assessment of Azure's exposure behavior, not a measured breach statistic.)

See it

resource search 'Microsoft.Search/searchServices@2023-11-01' = {
  name: 'corp-search'
  location: location
  sku: { name: 'standard' }
  properties: {
    publicNetworkAccess: 'enabled'   // note: this provider wants lowercase
    networkRuleSet: {
      ipRules: []                    // no firewall rules narrowing the open door
    }
  }
}

resource search 'Microsoft.Search/searchServices@2023-11-01' = {
  name: 'corp-search'
  location: location
  sku: { name: 'standard' }
  properties: {
    publicNetworkAccess: 'disabled'  // ipRules stop mattering; Private Link only
    disableLocalAuth: true           // optional but wise: Entra ID instead of keys
  }
}