Permission aware retrieval
Reindex protected documents without opening a gap
A search migration must preserve access rules as carefully as content. Use a parallel index and an explicit cutover check so incomplete permissions never become public results.
In this article
Decide what changes during the rebuild
List the changes the new index introduces. A new embedding model changes the representation used for semantic search. A new passage strategy changes which text is retrieved together. A new access field changes the permission query. Combining all three in one migration makes a failed result harder to explain.
Where practical, separate these changes or give each its own test evidence. Keep the old index available while building the new one. A separate index gives the team a place to inspect records and compare queries without exposing partially loaded content to ordinary users.
Define a migration identity for the new index and record the source snapshot or ingestion checkpoint used to create it. "Built this morning" is not enough when documents and permissions continue changing throughout the day.
Copy access state with the content
The migration job should not treat access fields as optional enrichment. A document that has been copied without a verified permission state stays unavailable in the new index. Track incomplete records separately from successfully indexed records.
Compare source identifiers and versions across the source, old index and new index. Investigate unexpected additions as well as missing records. An obsolete document that appears only in the new index can be more serious than a document that is temporarily absent.
For ongoing changes, define how the rebuild catches up. One approach is to load a snapshot and then replay changes after its checkpoint. That requires a durable change feed with clear ordering or version checks. If the source cannot provide one, the cutover plan may need a short pause or a final reconciliation pass.
Compare decisions before comparing scores
Run the same account and question against both indexes in a controlled comparison. First compare which document identifiers are permitted. Only then compare rankings and answer quality. A more relevant answer from the wrong document is a migration failure.
Include users with narrow access and documents whose permissions changed during the rebuild. Test deletions as well. A migration that handles new uploads correctly can still revive a document removed from the source before the cutover.
Keep comparison output restricted. Running a shadow query against a broader index should not put its passages into an ordinary application's trace or analytics stream. The testing process needs the same care as the serving path.
Make rollback about access as well as availability
At cutover, record the old and new serving versions, the last reconciled change and the person responsible for the decision. Route a small, understood portion of traffic first if the application supports it. Watch access failures separately from latency and answer quality.
Rollback is safe only if the old index still reflects current restrictions. If access has been revoked since it was last updated, switching back can restore forbidden content. Either keep the old index current for the rollback period or define a restricted fallback that does not serve stale protected records.
Retire the old index only after the agreed observation period and recovery checks. Remove temporary comparison permissions and migration credentials too. Those are easy to forget once the visible search feature is working.
Primary sources
Microsoft Learn: index updates and rebuildsMicrosoft Learn: document access filteringReferences checked 11 September 2026.