You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Use managed identities for Microsoft Energy Data Services on Azure
3
-
description: Learn how to use Managed Identity to access Microsoft Energy Data Services from other Azure services.
3
+
description: Learn how to use a managed identity to access Microsoft Energy Data Services from other Azure services.
4
4
author: sandeepchads
5
5
ms.author: sancha
6
6
ms.service: energy-data-services
7
7
ms.topic: how-to
8
8
ms.date: 01/04/2023
9
9
ms.custom: template-how-to
10
-
#Customer intent: As a developer, I want to use managed identity to access Microsoft Energy Data Services from other Azure services such as Azure Functions.
10
+
#Customer intent: As a developer, I want to use a managed identity to access Microsoft Energy Data Services from other Azure services, such as Azure Functions.
11
11
---
12
12
13
13
14
-
# Use managed identity to access Microsoft Energy Data Services from other Azure services
14
+
# Use a managed identity to access Microsoft Energy Data Services from other Azure services
15
15
16
-
This article provides an overview on how to access data plane or control plane of Microsoft Energy Data Services from other Microsoft Azure Services using *managed identity*.
16
+
This article describes how to access the data plane or control plane of Microsoft Energy Data Services from other Microsoft Azure services by using a*managed identity*.
17
17
18
-
There's a need for services such as Azure Functions etc. to be able to consume Microsoft Energy Data Services APIs. This interoperability will allow you to use the best of multiple Azure services, for example, you can write a script in Azure Function to ingest data in Microsoft Energy Data Services. Here, we should assume that Azure Functions is the source service while Microsoft Energy Data Services is the target service. To understand how this scenario works, it's important to understand the concept of managed identity.
18
+
There's a need for services such as Azure Functions to be able to consume Microsoft Energy Data Services APIs. This interoperability allows you to use the best capabilities of multiple Azure services.
19
19
20
-
## Managed Identity
20
+
For example, you can write a script in Azure Functions to ingest data in Microsoft Energy Data Services. In that scenario, you should assume that Azure Functions is the source service and Microsoft Energy Data Services is the target service.
21
21
22
-
A managed identity from Azure Active Directory (Azure AD) allows your application to easily access other Azure AD-protected resources. The identity is managed by the Azure platform and doesn't require you to create or rotate any secrets. Any Azure service that wants to access Microsoft Energy Data Services control plane or data plane for any operation can use managed identity to do so.
22
+
This article walks you through the five main steps for configuring Azure Functions to access Microsoft Energy Data Services.
23
23
24
-
Managed identity is of two types. It could be a system assigned managed identity or user assigned managed identity. System-assigned managed identities have their lifecycle tied to the resource that created them. User-assigned managed identities can be used on multiple resources. To learn more about managed identities, see [What are managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md)
24
+
## Overview of managed identities
25
25
26
-
Currently, other services can connect to Microsoft Energy Data Services using system or user assigned managed identity. However, Microsoft Energy Data Services doesn't support system assigned managed identity.
26
+
A managed identity from Azure Active Directory (Azure AD) allows your application to easily access other Azure AD-protected resources. The identity is managed by the Azure platform and doesn't require you to create or rotate any secrets. Any Azure service that wants to access Microsoft Energy Data Services control plane or data plane for any operation can use a managed identity to do so.
27
27
28
-
For this scenario, we'll use a user assigned managed identity in Azure Function to call a data plane API in Microsoft Energy Data Services.
28
+
There are two types of managed identities:
29
29
30
-
## Pre-requisites
30
+
-*System-assigned* managed identities have their lifecycle tied to the resource that created them.
31
+
-*User-assigned* managed identities can be used on multiple resources.
31
32
32
-
Before you begin, make sure:
33
+
To learn more about managed identities, see [What are managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md).
33
34
34
-
* You've created a [Microsoft Energy Data Services instance](quickstart-create-microsoft-energy-data-services-instance.md).
35
+
Currently, other services can connect to Microsoft Energy Data Services by using a system-assigned or user-assigned managed identity. However, Microsoft Energy Data Services doesn't support system-assigned managed identities.
35
36
36
-
* You've created a [Azure Function App](../azure-functions/functions-create-function-app-portal.md).
37
+
For the scenario in this article, you'll use a user-assigned managed identity in Azure Functions to call a data plane API in Microsoft Energy Data Services.
37
38
38
-
* You've created a [Python Azure Function using portal](../azure-functions/create-first-function-vs-code-python.md) or using [command line.](../azure-functions/create-first-function-cli-python.md)
39
+
## Prerequisites
39
40
40
-
* You've created [user assigned managed identity](../active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities.md). You can create a system assigned identity as well however, this document will explain the flow using user assigned managed identity.
41
+
Before you begin, create the following resources:
41
42
43
+
*[Microsoft Energy Data Services instance](quickstart-create-microsoft-energy-data-services-instance.md)
42
44
43
-
## Steps for Azure Functions to access Microsoft Energy Data Services using Managed Identity
45
+
*[Azure function app](../azure-functions/functions-create-function-app-portal.md)
44
46
45
-
There are five important steps to configure Azure Functions to access Microsoft Energy Data Services.
47
+
* Python-based Azure function, by using the [Azure portal](../azure-functions/create-first-function-vs-code-python.md) or the [command line](../azure-functions/create-first-function-cli-python.md)
### Step 1: Retrieve the Object ID of system or user-assigned identity that wants to access the Microsoft Energy Data Services APIs.
49
51
50
-
1. You can get the *Object ID* of system assigned identity associated with Azure Functions by navigating to *Identity* screen of the Azure Function.
52
+
## Step 1: Retrieve the object ID
51
53
52
-
[](media/how-to-use-managed-identity/1-object-id-system-assigned-identity.png#lightbox)
53
-
54
-
2. Similarly, navigate to the *Overview* tab of the user assigned identity to find its *Object ID*.
54
+
To retrieve the object ID for the user-assigned identity that will access the Microsoft Energy Data Services APIs:
55
+
56
+
1. Sign in to the [Azure portal](https://portal.azure.com/).
57
+
2. Go to the managed identity, and then select **Overview**.
58
+
3. Under **Essentials**, note the **Object (principal) ID** value.
55
59
56
-
[](media/how-to-use-managed-identity/2-object-id-user-assigned-identity.png#lightbox)
60
+
[](media/how-to-use-managed-identity/2-object-id-user-assigned-identity.png#lightbox)
57
61
58
-
###Step 2. Retrieve the *Application ID* of system or user-assigned identity using the Object ID.
62
+
## Step 2: Retrieve the application ID
59
63
60
-
1. Navigate to *Azure Active Directory (Azure AD)* in Azure
61
-
2. Navigate to *Enterprise Application* tab.
62
-
3. Search for the *Object ID* of the user assigned identity or system assigned identity in the *Search by application name or Object ID* search box.
63
-
4. Copy the *Application ID* from Enterprise Application section of Azure Active Directory.
64
-
65
-
[](media/how-to-use-managed-identity/3-object-id-application-id-user-assigned-identity.png#lightbox)
64
+
Retrieve the application ID of the user-assigned identity by using the object ID:
66
65
67
-
### Step 3: Add the user assigned managed identity to Azure Functions
68
-
69
-
1. Sign in to the Azure portal.
70
-
2. In the Azure portal, navigate to your Azure Function.
71
-
3. Under Account Settings, select Identity.
72
-
4. Select the User assigned tab, and then select Add.
73
-
5. Select your existing user-assigned managed identity and then select Add. You'll then be returned to the User assigned tab.
66
+
1. In the Azure portal, go to **Azure Active Directory**.
67
+
2. On the left menu, select **Enterprise applications**.
68
+
3. In the **Search by application name or object ID** box, enter the object ID.
69
+
4. For the application that appears in the results, note the **Application ID** value.
74
70
75
-
[](media/how-to-use-managed-identity/4-user-assigned-identity-azure-function.png#lightbox)
76
-
77
-
### Step 4: Add the application ID to entitlement groups to access Microsoft Energy Data Services APIs
78
-
Next, you need to add this Application ID to appropriate groups using the entitlement service to access Microsoft Energy Data Services APIs. You need to perform the following actions:
71
+
[](media/how-to-use-managed-identity/3-object-id-application-id-user-assigned-identity.png#lightbox)
79
72
80
-
1. Find the tenant-id, client-id, client-secret, Microsoft Energy Data Services url, and data partition-id and generate the [access token](how-to-manage-users.md#prerequisites). You should have the following information handy with you:
73
+
## Step 3: Add the user-assigned managed identity to Azure Functions
81
74
82
-
* tenant-id
83
-
* client-id
84
-
* client-secret
85
-
* microsoft energy data services uri
86
-
* data-partition-id
87
-
* access token
88
-
* Application ID of the managed identity
75
+
1. In the Azure portal, go to your Azure function.
76
+
2. Under **Account Settings**, select **Identity**.
77
+
3. Select the **User assigned** tab, and then select **Add**.
78
+
4. Select your existing user-assigned managed identity, and then select **Add**. You're then returned to the **User assigned** tab.
79
+
80
+
[](media/how-to-use-managed-identity/4-user-assigned-identity-azure-function.png#lightbox)
89
81
82
+
## Step 4: Add the application ID to entitlement groups
90
83
91
-
2. Next, use the [add-member-api](https://microsoft.github.io/meds-samples/rest-apis/index.html?page=/meds-samples/rest-apis/entitlements_openapi.yaml#/add-member-api/addMemberUsingPOST)to add the Application ID of the user managed identity to appropriate entitlement groups. For example, in this case, we'll add the Application ID to two groups:
84
+
Next, add the application ID to the appropriate groups that will use the entitlement service to access Microsoft Energy Data Services APIs. The following example adds the application ID to two groups:
> In the below commands use the Application ID of the managed identity and not the Object Id of the managed identity in the below command.
98
-
99
-
* Adding Application ID of the managed identity to users@[partition ID].dataservices.energy
100
-
101
-
3. Run the following CURL command on Azure bash:
102
-
103
-
```bash
104
-
curl --location --request POST 'https://<microsoft energy data services uri>/api/entitlements/v2/groups/users@ <data-partition-id>.dataservices.energy/members' \
"email": "<Application ID of the managed identity>",
110
-
"role": "MEMBER"
111
-
}'
112
-
```
113
-
114
-
Sample response:
115
-
```JSON
116
-
{
117
-
"email": "<Application ID of the managed identity>",
118
-
"role": "MEMBER"
119
-
}
120
-
```
121
-
* Adding Application ID of the managed identity to users.datalake.editors@[partition ID].dataservices.energy
122
-
123
-
4. Run the following CURL command on Azure bash:
124
-
125
-
```bash
126
-
curl --location --request POST 'https://<microsoft energy data services uri>/api/entitlements/v2/groups/ users.datalake.editors@ <data-partition-id>.dataservices.energy/members' \
2. Use the [Add Member API](https://microsoft.github.io/meds-samples/rest-apis/index.html?page=/meds-samples/rest-apis/entitlements_openapi.yaml#/add-member-api/addMemberUsingPOST) to add the application ID of the user-assigned managed identity to the appropriate entitlement groups.
102
+
103
+
> [!NOTE]
104
+
> In the following commands, be sure to use the application ID of the managed identity and not the object ID.
105
+
106
+
1. To add the application ID to the users@[partition ID].dataservices.energy group, run the following cURL command via Bash in Azure:
107
+
108
+
```bash
109
+
curl --location --request POST 'https://<Microsoft Energy Data Services URI>/api/entitlements/v2/groups/users@ <data-partition-id>.dataservices.energy/members' \
"email": "<application ID of the managed identity>",
115
+
"role": "MEMBER"
116
+
}'
117
+
```
118
+
119
+
Here's a sample response:
120
+
121
+
```json
122
+
{
123
+
"email": "<application ID of the managed identity>",
124
+
"role": "MEMBER"
125
+
}
126
+
```
127
+
128
+
1. To add the application ID to the users.datalake.editors@[partition ID].dataservices.energy group, run the following cURL command via Bash in Azure:
129
+
130
+
```bash
131
+
curl --location --request POST 'https://<Microsoft Energy Data Services URI>/api/entitlements/v2/groups/ users.datalake.editors@ <data-partition-id>.dataservices.energy/members' \
"email": "<application ID of the managed identity>",
137
+
"role": "MEMBER"
138
+
}'
139
+
```
140
+
141
+
Here's a sample response:
142
+
143
+
```json
144
+
{
145
+
"email": "<application ID of the managed identity>",
146
+
"role": "MEMBER"
147
+
}
148
+
```
149
+
150
+
## Step 5: Generate a token
145
151
146
152
Now Azure Functions is ready to access Microsoft Energy Data Services APIs.
147
153
148
-
In this case, Azure function generates a token using User Assigned identity. The Azure function uses the Application ID present in the Microsoft Energy Data Services instance, while generating the token.
149
-
Sample Azure function code.
154
+
The Azure functiongenerates a token by using the user-assigned identity. The functionuses the application ID that's present in the Microsoft Energy Data Services instance while generating the token.
155
+
156
+
Here's an example of the Azure functioncode:
150
157
151
158
```python
152
159
import logging
@@ -157,16 +164,15 @@ from msrestazure.azure_active_directory import MSIAuthentication
157
164
def main(req: func.HttpRequest) -> str:
158
165
logging.info('Python HTTP trigger function processed a request.')
159
166
160
-
//To Authenticate using Managed Identity, we need to pass the Microsoft Energy Data Services Application IDas the resource.
161
-
//If we want to use a user-assigned identity, we should also include the
162
-
//Client IDas an additional parameter.
163
-
//Managed Identity using System Assigned Identity: MSIAuthentication(resource)
164
-
//Managed Identity using user Assigned Identity: MSIAuthentication(client_id, resource)
167
+
//To authenticate by using a managed identity, you need to pass the Microsoft Energy Data Services application ID as the resource.
168
+
//To use a user-assigned identity, you should include the
169
+
//client ID as an additional parameter.
170
+
//Managed identity using user-assigned identity: MSIAuthentication(client_id, resource)
You should get the following successful response from Azure Function:
185
+
You should get the following successful response from Azure Functions:
180
186
181
-
[](media/how-to-use-managed-identity/5-azure-function-success.png#lightbox)
187
+
[](media/how-to-use-managed-identity/5-azure-function-success.png#lightbox)
182
188
183
-
With the following steps completed, you're now able to use Azure Functions to access Microsoft Energy Data Services APIs with appropriate use of managed identities.
189
+
With the preceding steps completed, you can now use Azure Functions to access Microsoft Energy Data Services APIs with appropriate use of managed identities.
184
190
185
191
## Next steps
186
-
<!-- Add a context sentence for the following links -->
187
-
To learn more about Lockboxin Microsoft Energy Data Services
192
+
193
+
Learn about Lockbox:
188
194
> [!div class="nextstepaction"]
189
195
> [Lockbox in Microsoft Energy Data Services](how-to-create-lockbox.md)
0 commit comments