Build a Governed Azure Support Catalog

Create a governed Azure catalog with Cosmos DB and AI Search.

Introduction

30 Second Summary

A simple password question can turn into a long hunt through scattered support notes. Without one searchable home, finding the right answer means scanning every record yourself.

In this project, you will build a searchable support catalog in Microsoft Azure using Azure Cosmos DB for NoSQL and Azure AI Search. You will search your support articles to see the most relevant results ranked first.

What You'll Build

Your finished catalog lets you search for password in Search explorer to see the most relevant support articles rise to the top with a score for each match.

By the end of this project, you'll have:

Inspect a governed resource group to trace its subscription, region, tags, access, activity history, and cost scope.
Open four support articles as JSON documents inside the catalog. Query the collection to see every stored article.
Search for a support topic and see ranked results with an @search.score value for each match.
Secret Mission: add a fifth article about account lockout. Run the indexer on demand to prove the new article appears in search.

Are there any prerequisites?

You need an active Azure subscription with permission to create resources. You also need a supported browser plus either unused free-tier eligibility or permission to reuse existing training resources.

Before We Start

Before any hands-on work, lock in the workload you are about to build and why its foundation comes first. You will create a governed Azure resource group containing support articles in Azure Cosmos DB plus an Azure AI Search pipeline before introducing a deployment pipeline.

Set Up a Governed Azure Workspace

A governed Azure workload needs a clear subscription scope. It also needs a region chosen before deployment.

Unknown ownership makes cleanup risky. Unchecked cost eligibility can turn a learning lab into an unapproved bill.

This step captures those decisions in the Azure portal. You will place the lab inside one tagged resource group.

In this step, get ready to:

Confirm the subscription can host this lab without an unapproved charge.
Create the workload boundary in the recorded region.
Verify the resource group's governance state.

Confirm scope, access, and the cost gate

Your Azure subscription is the top-level scope for this lab. Azure RBAC determines which management actions your role can perform at that scope.

The free-service allowances also belong to the subscription. Checking them now protects the rest of the project from an unexpected pricing choice.

Sign in to the Azure portal from earlier with the account that has your active subscription.
Use the portal search bar to open the subscription you plan to use.
Record the selected subscription here: your selected Azure subscription.
Select Access control (IAM) from the subscription menu.
Select Check access.
Select View my access.
Confirm that your current assignment permits resource creation in this subscription.
Stop here if your assignment does not permit resource creation.

How inherited access works

An Azure RBAC assignment can apply directly at the current scope. It can also be inherited from a parent scope.

Either path can grant the access you need. The access view shows where your current permission comes from.

The next check identifies whether your subscription already contains approved training resources. It also confirms which free options remain available.

Stay on the no-charge path

Pricing screens can feel like a commitment. You will inspect each option without submitting a deployment.

Close every draft before resource creation. Stop if the portal offers only a billable option that you have not received approval to use.

Use the portal search bar to find existing Azure Cosmos DB accounts.
Review the accounts shown for your selected Azure subscription.
Identify whether an existing free-tier account is approved for reuse in this lab.
Use the portal search bar to find existing Azure AI Search services.
Review the services shown for your selected Azure subscription.
Identify whether an existing Dedicated Free service is approved for reuse in this lab.

Why existing Free resources matter

An Azure subscription can have one Azure Cosmos DB free-tier account. It can also have one Azure AI Search Dedicated Free service.

An existing Free resource may already consume either allowance. Reusing an approved training resource can preserve the no-charge path.

If you are reusing an approved Azure AI Search Free service, open its Overview.
Record the service region here: your compatible Azure region.

A new search service needs a region where the Dedicated Free tier is offered. The creation page lets you find that region without completing the deployment.

If you are not reusing a search service, select Create a resource from the Azure portal.
Search for Azure AI Search.
Select Azure AI Search to open its creation page.
Select your selected Azure subscription in the Subscription field.
Find a Region where the Dedicated Free tier is offered.
Record that region here: your compatible Azure region.
Close the creation page without submitting the draft.

A reusable Cosmos DB account satisfies its cost gate. A new account needs one extra eligibility check because the discount must be selected during account creation.

For a new account, return to the Azure portal home page.
For a new account, select Create a resource.
For a new account, select Azure Cosmos DB.
For a new account, select Create in NoSQL - Recommend.
For a new account, select your selected Azure subscription in the Subscription field.
For a new account, locate Apply Free Tier Discount.
For a new account, confirm the setting can be changed to Apply.
For a new account, close the creation page without submitting the draft.

Continue only when the Azure Cosmos DB path is covered by an eligible free-tier account or an approved reusable account.
Continue only when the Azure AI Search path is covered by a Dedicated Free service or an approved reusable Free service.
Stop before creating workload resources if either no-charge path remains unconfirmed.

Cannot confirm access or free eligibility?

Ask the subscription owner to confirm an approved scope if your current assignment does not permit resource creation.

Leave every creation page without submitting it if a free option is unavailable. Wait for an approved sandbox or reusable training resource.

Help me confirm a safe Azure subscription and free-tier path for this project.

Create the workload boundary

A resource group holds resources that share a lifecycle. This one becomes the lab's cleanup boundary.

The same scope also gives you one place to inspect access. Later, you will use it to inspect project costs.

Use the Azure portal search bar to open Resource groups.
Select Create.
Select your selected Azure subscription in the Subscription field.
Enter rg-search-foundations-dev in the Resource group field.
Select your compatible Azure region in the Region field.
Select Review + Create.
Review the subscription name.
Select Create.

That is your first governed boundary in place. The group exists without adding any billable workload resources.

Return to Resource groups after creation finishes.
Select rg-search-foundations-dev to open its Overview.

Why create the group first?

Resources with the same lifecycle can be managed as one group. The boundary makes later cleanup easier because the lab has a single home.

The group also provides a shared scope for access checks. It becomes the cost-analysis boundary for this project.

Add governance metadata and inspect access

Tags attach metadata to a resource without changing its workload behavior. One tag names the project.

The second tag marks the environment. Your access view then shows whether your current role applies directly or comes from a parent scope.

From the resource-group Overview, select Add tags.
Enter project in the first Name field.
Enter azure-search-foundations in the matching Value field.
Enter environment in the next Name field.
Enter dev in the matching Value field.
Select Save.

Your resource group now carries metadata that identifies its purpose. It also identifies the environment as development.

Select Access control (IAM) from the resource-group menu.
Select Check access.
Select View my access.
Identify whether your current assignment applies at this resource group or comes from a parent scope.
Record the assignment scope here: resource group or inherited parent scope.

Before the final check, predict whether the workspace should contain any workload resources.

Return to the resource group's Overview.
Confirm the listed subscription matches your selected Azure subscription.
Confirm the listed region matches your compatible Azure region.
Confirm the resource list contains no workload resources.
Open the resource group's Tags view.
Confirm it shows project=azure-search-foundations.
Confirm it shows environment=dev.

The Overview shows your selected subscription. It also shows your recorded region.

The Tags view shows both governance tags. The resource list remains empty because workload deployment has not started.

Do the tags or access details look wrong?

Return to Add tags if either saved value is missing. Check each name against its matching value before selecting Save again.

A missing direct assignment can be normal when access is inherited. Check the parent scope listed in View my access.

Help me verify my Azure resource-group tags and inherited RBAC access.

Your governed Azure workspace is ready. Next, you will create the Cosmos DB support catalog inside this boundary.

Create Your Cosmos DB Support Catalog

Your governed resource group now gives the workload a clear boundary. The empty group still has no data to inspect.

Azure Cosmos DB for NoSQL turns that boundary into a working catalog. Four support articles make its account-to-item hierarchy visible in Data Explorer.

In this step, get ready to:

Create a Cosmos DB account with the approved no-charge settings.
Build the database-to-container hierarchy.
Add four support documents.

Create the Cosmos DB account safely

The free-tier discount has to be selected when the account is created. It cannot be added later.

The full account name must be globally unique. Use lowercase letters or numbers in your unique suffix.

Protect your no-charge path

Creating the account is the billing-sensitive point in this step. Only submit the form when Apply Free Tier Discount shows Apply.

Stop before creation if the portal presents a billable selection that you have not approved.

Select Create a resource in the Azure portal.
Search for Azure Cosmos DB.
Select Azure Cosmos DB from the results.
Select Create in NoSQL - Recommend.
Select the subscription from earlier.
Select rg-search-foundations-dev in the Resource group field.
Enter your final globally unique account name here: cosmos-support-<unique-suffix>.
Select the recorded region.

Why use provisioned throughput?

The approved free-tier path applies to provisioned or autoscale throughput. Serverless accounts cannot use the Cosmos DB free-tier discount.

The throughput cap limits the account to the first 1,000 RU/s covered by the free-tier allowance.

Set the capacity mode to Provisioned throughput.
Set Apply Free Tier Discount to Apply.
Enable the total account throughput cap when that option is available.
Set the total account throughput cap to 1,000 RU/s.
Review the account name.
Review the selected resource group.
Review the recorded region.
Submit the account creation form from the final review page.

Provisioning can take several minutes, so a quiet deployment screen does not mean the process has stalled.

Wait until the portal confirms that deployment has completed.
Return to rg-search-foundations-dev from earlier.
Select cosmos-support-<unique-suffix> from the resource list.
Confirm the account Overview identifies the selected subscription.
Confirm the account Overview identifies the recorded region.

You have the workload's first resource in place, with the approved cost controls applied during creation.

Account creation not completing?

Change only the unique suffix if the portal rejects the account name.
Confirm that rg-search-foundations-dev belongs to the selected subscription.
Stop before submission if the free-tier discount is unavailable.

Help me diagnose my Cosmos DB account creation issue.

Build the database and container hierarchy

The account is the top of the data hierarchy. A database groups related containers.

Each container stores items under a partition key. Using /id aligns every article's routing value with its unique identifier.

Select Data Explorer inside the Cosmos DB account from earlier.
Select New Container.
Choose the option to create a new database in the container form.
Enter supportcatalog as the database name.
Leave database-level shared throughput turned off.

Why use container-level throughput?

Container-level throughput keeps this lab's capacity setting attached to articles. Autoscale sets the maximum capacity in request units.

A maximum of 1000 keeps the container aligned with the account's free-tier throughput allowance.

Enter articles as the container ID.
Enter /id as the partition key.
Select Autoscale as the throughput mode.
Enter 1000 in the Container Max RU/s field.
Select OK to create the database and container.

You will see supportcatalog in Data Explorer. Expanding it shows the articles container.

Hierarchy not appearing?

Reload the portal page if Data Explorer still shows the earlier empty state.
Confirm that you created supportcatalog inside the correct Cosmos DB account.
Check that the container name is exactly articles.

Help me troubleshoot my Cosmos DB database and container setup.

Add four support articles

Each support article is a JSON document. Every document uses the same four business fields.

The article's id also supplies its /id partition-key value. The article text creates a small relevance test for the managed search pipeline later.

Expand supportcatalog in Data Explorer.
Expand the articles container.
Select Items.

First Article Values

A JSON object places field-value pairs inside braces. Use double quotation marks around each field name and text value.

The id value is reset-password.
The title value is Reset a forgotten password.
The content value is Reset your password when you cannot sign in. Complete the account verification steps to create a replacement password.
The category value is identity.

Select New Item.
Replace the editor contents with a valid JSON object that uses the four field-value pairs above.
Select Save.

You have the first record in place, so the catalog is now a visible data store. You will see reset-password under Items.

Second Article Values

The id value is vpn-password.
The title value is Use a new password with VPN.
The content value is Reconnect the VPN after changing your account credentials.
The category value is network.

Select New Item.
Replace the JSON object with the four field-value pairs above.
Select Save.

You will see vpn-password beside the first article in the Items list.

Third Article Values

The id value is mfa-device.
The title value is Replace an MFA device.
The content value is Register a replacement device for multi-factor authentication access.
The category value is identity.

Select New Item.
Replace the JSON object with the four field-value pairs above.
Select Save.

You will see mfa-device added to the Items list.

Fourth Article Values

The id value is email-sync.
The title value is Fix email synchronization.
The content value is Refresh account settings when email stops synchronizing between devices.
The category value is messaging.

Select New Item.
Replace the JSON object with the four field-value pairs above.
Select Save.

That completes the dataset. All four support topics now have visible records in the container.

Before the final check, how many item IDs do you expect to see in the container?

Expand supportcatalog in Data Explorer.
Expand articles.
Select Items.
Open each item in turn.
Confirm that every item contains id, title, content, and category.

You will see four items with IDs reset-password, vpn-password, mfa-device, and email-sync. Each opened document shows all four business fields.

Missing an item or field?

Check that every field name uses double quotation marks.
Check that commas separate the first three field-value pairs.
Open the affected item to compare its field values with the matching article values above.

Help me fix a support article in Cosmos DB Data Explorer.

Your governed catalog now contains a working data hierarchy with four visible documents. Next, you will query those records to see what the database view reveals.

Compare Database Retrieval and Search

Your four support articles now live inside Azure Cosmos DB for NoSQL. The next question is how the database presents them when you need an answer.

A database can retrieve the stored catalog with one query. You need to test whether that result helps you find the most relevant article.

In this step, get ready to:

Inspect the Cosmos DB data hierarchy.
Retrieve the four support articles with an all-items query.
Compare the unranked output with the behavior you need from search.

Inspect the Cosmos DB hierarchy

Cosmos DB uses a visible hierarchy to organize your data. Each level narrows from the account boundary to an individual support article.

In the resource group from earlier, return to the cosmos-support-<unique-suffix> account.
Select Data Explorer from the resource menu.
Expand the supportcatalog database.
Expand the articles container.
Select Items.

How is the data organized?

The account is the top-level service boundary.
The database groups related containers.
The container stores JSON documents called items.
The partition key determines how Cosmos DB distributes each item.

Select each item in turn: reset-password, vpn-password, mfa-device, and email-sync.
Compare each id value with its /id partition-key value.
Identify title, content, and category as the business fields.
Inspect the system metadata shown alongside the business fields.

The business fields hold the support content. The system metadata records details managed by Cosmos DB.

Run the all-items query

The default SELECT * FROM c query requests every item in the container. This gives you the database view of the complete catalog.

Right-click Items under the articles container.
Select New SQL query.
Confirm that the query editor contains SELECT * FROM c.

Before you run it, pause to predict whether the result will rank the articles by relevance.

Select Execute query.

You should see four stored documents returned as JSON. Each document includes the support fields you inspected earlier.

What Does This Query Prove?

The query confirms that Cosmos DB can retrieve every stored article from the container. The result preserves each document's fields for you to inspect.

Missing One of the Documents?

Switch back to Items to confirm that all four article IDs are still listed.
Restore SELECT * FROM c if the text in the query editor changed.
Run the query again after confirming the correct articles container is selected.

Help me diagnose my Cosmos DB query result.

Test the result as a search experience

A useful search experience applies relevance ranking to help you choose between possible matches. The current result gives you a chance to test how much work the database leaves to you.

Use only the current query result to decide which article best answers a password-reset question.
Scan the title value in each returned document.
Compare the content values for reset-password and vpn-password.
Inspect each returned document for an @search.score property.

You will identify reset-password as the strongest match by reading the fields yourself. The database result does not rank that article for you.

You will find no @search.score property in the four documents. This is the intended shortfall of the all-items query.

You found the exact gap the next stage needs to solve. Next, you will connect the catalog to a managed search pipeline that can rank matching articles.

Build a Managed Search Pipeline

Your Azure Cosmos DB catalog now holds four support articles. Its all-items query still makes you scan every JSON document yourself.

Azure AI Search closes that gap with a managed indexer. The indexer pulls the catalog into a search index that can rank matching documents.

In this step, get ready to:

Create a Dedicated Free Azure AI Search service in the governed resource group.
Connect the existing Cosmos DB container through the no-code import wizard.
Build a configured index through a successful four-item indexer run.

Create the search service

The search service provides the managed home for your index. Its tier choice decides whether the service stays inside this project's no-charge path.

Return to the Azure portal tab from earlier.
Select Create a resource.

The marketplace page gives you a catalog of Azure services that can be added to your existing resource group.

Search for Azure AI Search.
Select Azure AI Search from the results.

You should now see the Azure AI Search product page. This confirms that you selected the current search service.

Start the service creation flow.
Select the subscription you confirmed earlier.

The creation page now shows the scope fields for your new service.

Choose rg-search-foundations-dev in the Resource group field.
Enter srch-support-<unique-suffix> in the Service name field.

The portal checks whether your service name is globally unique. A valid name gives this search service its own address.

Check the tier before creating

The tier screen is the risky point because a paid selection can create charges. Your service remains on the planned no-charge path only when Dedicated Free is available.

Stop the creation flow if the Dedicated Free tier is unavailable or already used.

Select the recorded region used by your Cosmos DB account when Azure AI Search offers it.
Select the Dedicated Free tier.

The pricing selection should now show the Dedicated Free tier. This is the no-charge tier confirmed for the project.

Keep public-network connectivity enabled.
Leave semantic ranking disabled.

Your configuration now uses the simple public-network design for this learning workload. The service has no semantic-ranking upgrade.

Leave AI enrichment disabled.
Leave vectorization disabled.

The review should contain no enrichment or vectorization additions.

Leave every other premium capability disabled.
Submit the service creation after portal validation succeeds.

Azure shows deployment progress while it creates the managed service.

Open the created search service when deployment completes.
Confirm its Overview names rg-search-foundations-dev as the resource group.

The service now sits inside the same lifecycle boundary as your database.

Confirm the service uses the Dedicated Free tier.
Confirm the service uses the recorded region when that region was available.

Good progress. The search service now exists beside your database without adding paid capabilities.

Can't create the search service?

Check whether another Free search service already uses the subscription allowance.
Try a different unique suffix if the portal rejects the service name.
Return to the recorded region if a different region does not offer the Dedicated Free tier.

Help me diagnose why my Dedicated Free Azure AI Search service cannot be created.

Connect Cosmos DB with the wizard

A data source is the saved connection that tells the indexer where your four documents live. The Import data wizard uses this connection to pull the articles into search.

Why use a built-in indexer?

The built-in indexer can pull directly from Cosmos DB for NoSQL. You can inspect each synchronization stage in the portal.

An Azure Function would add a runtime before you need one. The managed indexer keeps this lesson focused on synchronization.

Return to the search service's Overview page.
Select Import data.

The import experience now asks what kind of search pipeline you want to create.

Choose Keyword search.
Select Cosmos DB for NoSQL as the data-source option.

The source page now shows the settings needed to connect the existing catalog.

Select the Cosmos DB account from earlier.
Select supportcatalog as the database.

The wizard should now list the containers inside supportcatalog.

Select articles as the container.

How the portal connects

The built-in API key path lets the portal use the Cosmos DB account key internally. You do not expose the credential.

The Dedicated Free tier does not support a managed identity. This lab therefore keeps the portal's built-in path.

Select the portal's built-in API-key path.
Leave the source query empty.

An empty source query lets the indexer read the documents from the selected container.

Keep the default _ts-based change detection.
Continue to the index configuration stage.

You should reach the index configuration stage with supportcatalog shown as the database. You should also see articles as the container.

Can't load the Cosmos DB source?

Confirm the selected Cosmos DB account belongs to rg-search-foundations-dev.
Confirm public-network access remains enabled for the Cosmos DB account.
Confirm the selected database is supportcatalog.
Confirm the selected container is articles.

Help me troubleshoot the Cosmos DB connection in the Azure AI Search Import data wizard.

Shape and run the search pipeline

The inferred schema decides how each article field behaves in search. Field attributes control which properties can match a query or return in a result.

What do the field attributes control?

Searchable enables full-text matching for a field.
Retrievable includes a field in returned search results.
Filterable allows a field to narrow the result set.
Facetable allows a filterable field to group results by value.

Skip the optional skills stage.
Review the inferred index fields.

The field table should include id. It should also include title. You should see content and category as well.

Mark id as the key.
Select Retrievable for id.

The id row now identifies each search document uniquely. Its value can also appear in results.

Select Searchable for title.
Select Retrievable for title.

The title row can now match query terms. Its value can also appear in results.

Select Searchable for content.
Select Retrievable for content.

The article body can now contribute to full-text matching. Its text can also appear in results.

Select Filterable for category.
Select Facetable for category.

The category field can now narrow results. It can also group results into category facets.

Select Retrievable for category.
Enter support as the custom prefix.

The wizard now uses the support prefix for its generated search objects.

Keep the wizard-generated object names.
Leave the recurring schedule disabled.

The pipeline summary should show a one-time initial import with no recurring schedule.

Complete the wizard.

The indexer starts automatically when the wizard creates it. The wizard also displays the generated object names.

Record the generated data-source name here: <wizard-generated-data-source-name>.
Record the generated index name here: <wizard-generated-index-name>.
Record the generated indexer name here: <wizard-generated-indexer-name>.

Before you inspect the execution history, how many documents do you expect the first run to process?

Open Search management from the search-service menu.
Select Indexers.

The indexer list gives you the execution status of each managed synchronization pipeline.

Select <wizard-generated-indexer-name>.
Refresh the execution history until the latest run finishes.

The latest execution should show a successful run with four processed items. It should show no failed items.

Seeing failed or missing items?

Check that the generated data source uses supportcatalog.
Check that the generated data source uses articles.
Check that id is the index key.
Confirm the Cosmos DB container still contains four items.

Help me diagnose my Azure AI Search indexer result.

That is the managed handoff working. Four database documents now sit in a searchable index.

Next, you will query that index to see ranked results. You will also inspect the workload's access history and cost scope.

Query and Audit the Workload

Your managed Azure AI Search pipeline now holds four support articles from Azure Cosmos DB for NoSQL. The first automatic indexer run proved that the data reached the search index.

Now you will use Search explorer to test ranked retrieval. The returned relevance scores make the search behavior visible.

A working result also needs clear ownership. You will connect your current access to the actions you completed.

The resource group provides the scope for auditing resource operations. Cost Analysis reveals the workload's reporting boundary.

In this step, get ready to:

Query the support catalog for password.
Audit the workload's operational evidence.
Confirm the governed workload's cost boundary.

Query the searchable catalog

Search explorer runs free-text queries against your index. Each qualified result includes an @search.score value that represents the strength of its match.

In rg-search-foundations-dev, select your Azure AI Search service.
From its Overview, select Search explorer.
Select Query view.

Before you search, which password article do you think will receive the strongest match?

Search for password.

You'll see matching support articles returned from the search index. Each qualified result includes an @search.score value.

Compare the returned article titles.
Inspect each @search.score value.

What does the score prove?

The earlier Cosmos DB query returned every stored document through SELECT * FROM c. You had to inspect those documents yourself.

Search explorer attaches a relevance score to each qualified match. Those scores give you evidence for comparing the results.

You now have the project's key visible result. The catalog turns a plain-language query into ranked support articles.

No ranked results?

Confirm Search explorer is using the wizard-generated index.
Confirm the query is exactly password.
Return to the generated indexer's execution history to confirm its latest run succeeded.

Help me diagnose missing results in Search explorer.

Inspect operations and access

Execution history shows whether managed synchronization completed cleanly. Azure RBAC explains why your account can manage resources at this scope.

In your Azure AI Search service, select Search management.
Select Indexers.
Select the wizard-generated indexer with the support prefix.
Inspect its execution history.
Review its processed-item count.
Review its warnings.
Review its errors.

The latest execution should show a successful status with four processed items. Its failed-item count should be zero.

That gives you operational proof that the managed pipeline completed its initial synchronization.

Can't find the successful execution?

Confirm you selected the generated indexer with the support prefix.
Refresh the indexer page to reload its execution history.
Inspect any listed warning or error for the affected item count.

Help me inspect my indexer execution history.

The Azure Activity log records resource operations at the selected scope. Recent create or write events show that Azure recorded the workload changes.

Return to rg-search-foundations-dev from earlier.
Select Activity log from the resource-group menu.
Review recent successful create or write operations for the Cosmos DB resource.
Review recent successful create or write operations for the Azure AI Search resource.

You'll see recent management operations associated with the two workload services. These events provide an audit trail for the resources you created.

Your role assignment completes the access side of the audit. Its scope shows whether permission comes directly from this resource group or from a parent scope.

Reopen Access control (IAM) from the resource-group menu.
Select Check access.
Select View my access.
Identify the scope of your current role assignment.

You'll see access assigned at rg-search-foundations-dev or inherited from a parent scope. That assignment explains your ability to complete the resource operations in this project.

Confirm the cost boundary

Microsoft Cost Management can drill from a subscription into a resource group. That scope lets you inspect this workload without mixing it with unrelated resources.

Cost screens can feel high stakes. This check reads the current reporting scope plus the service tiers you already selected.

From rg-search-foundations-dev, select Cost Analysis.

Before you inspect the scope, do you expect Cost Analysis to show the subscription or the project resource group?

Check the selected Cost Analysis scope.

You'll see rg-search-foundations-dev as the selected scope. This confirms that the resource group is the workload's cost-analysis boundary.

Record the current Cost Analysis result here: your current Cost Analysis result.

Your current view may show no usage yet. The selected scope remains the durable verification for this check.

The resource Overview pages provide the final tier check. Both services should still reflect the no-charge path selected earlier.

Return to rg-search-foundations-dev from earlier.
Select your Cosmos DB account.
Confirm its Overview reflects Apply Free Tier Discount.
Return to rg-search-foundations-dev.
Select your Azure AI Search service.
Confirm its Overview shows the Dedicated Free tier.

Can't access Cost Analysis?

Microsoft Cost Management requires Read access. Review your current role through View my access before asking the subscription administrator for help.

Help me understand why I cannot view resource-group Cost Analysis.

Your final audit now shows ranked password results with @search.score values. The resource-group views also show execution history, management activity, current access, and cost scope.

You have closed the loop on this workload. Its search behavior plus its governance evidence are now visible from the Azure portal.

Secret mission

Secret Mission: Prove Incremental Indexing

Your first import proved that the search pipeline could load existing data. Now trace one new support article from Cosmos DB into Azure AI Search with an on-demand indexer run.

Clean Up Your Resources

Choose whether to keep the lab available, step away with it still deployed, or delete it entirely. Both services are configured for their intended free tiers, so the expected ongoing cost is $0 while usage stays within their limits.

Resources you used:

The Azure resource group rg-search-foundations-dev holds the governance tags project=azure-search-foundations and environment=dev.
The Azure Cosmos DB for NoSQL account cosmos-support-<unique-suffix> contains the supportcatalog database. That database contains the articles container with five support articles.
The Azure AI Search service srch-support-<unique-suffix> contains the wizard-generated data source, index, and unscheduled indexer with the support prefix.

Keep everything running

No action is needed. Choose this option if you want to reuse the searchable catalog in the follow-on project.

Return to Cost Analysis in Microsoft Cost Management from earlier to confirm the selected scope is rg-search-foundations-dev.
Return to the cosmos-support-<unique-suffix> Overview from earlier to confirm Apply Free Tier Discount remains set to Apply.
Return to the srch-support-<unique-suffix> Overview from earlier to confirm the Dedicated Free tier remains selected.

Pause - I'll come back to this later

Dedicated Azure AI Search runs continuously. Pausing here means stepping away while both free-tier services remain deployed.

These resources continue to consume your subscription's limited free-service slots.

Return to the cosmos-support-<unique-suffix> Overview from earlier to confirm Apply Free Tier Discount remains set to Apply.
Return to the srch-support-<unique-suffix> Overview from earlier to confirm the Dedicated Free tier remains selected.
Set a reminder to revisit rg-search-foundations-dev when you are ready to continue or clean up.

Delete - I don't want to use this again

This option removes every project resource through the shared lifecycle boundary. Deleting the group looks broad, so the confirmation flow keeps the removal deliberate.

Return to rg-search-foundations-dev from earlier in the Azure portal.
Select Delete resource group.
Complete the confirmation flow to delete the full lab.
Return to Resource groups after deletion finishes to confirm rg-search-foundations-dev is no longer listed.

What Gets Removed?

Deleting rg-search-foundations-dev removes the resource group. Its two governance tags disappear with it.

The cosmos-support-<unique-suffix> account disappears with its supportcatalog database. The articles container and all five JSON items disappear too.

The srch-support-<unique-suffix> service disappears with its generated data source. Its index and indexer disappear too.

Nice Work!

Your first Azure project is complete: a governed support catalog now returns ranked answers from stored articles. This foundation prepares you for the Azure Functions follow-on project.

What you learned:

Built a governed Azure resource group that gives the workload one lifecycle boundary. You applied project and environment tags. You traced access with Azure RBAC. You inspected operations with Azure Monitor Activity log. You inspected cost scope with Microsoft Cost Management.
Created an Azure Cosmos DB for NoSQL support catalog with five JSON articles inside the /id-partitioned articles container. You queried the full catalog with SELECT * FROM c. You identified why database retrieval provides no relevance ranking.
Built an Azure AI Search pipeline with a managed data source. You shaped its searchable index. You synchronized the catalog through an indexer. You searched for password. You compared @search.score values to inspect ranking.
Secret Mission: Proved incremental indexing with a fifth article containing lockout. You ran the existing indexer on demand without resetting it. You confirmed the synchronized article in Search explorer.

Ready to quiz yourself?