Skip to content

Commit 0dc0028

Browse files
ShannonLeavittShannonLeavitt
authored
Merge pull request #184994 from zxue/master
Update export to storage accounts behind firewalls docs
2 parents f4fcd9f + 1b116c5 commit 0dc0028

File tree

12 files changed

+168
-80
lines changed

12 files changed

+168
-80
lines changed

‎articles/healthcare-apis/azure-api-for-fhir/media/move/move-review.png

86.7 KB
Loading

‎articles/healthcare-apis/azure-api-for-fhir/media/move/move-source-target.png

88.7 KB
Loading

‎articles/healthcare-apis/azure-api-for-fhir/media/move/move-validation.png

100 KB
Loading

‎articles/healthcare-apis/azure-api-for-fhir/move-fhir-service.md

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
title: Move FHIR service to another subscription or resource group
3+
description: This article describes how to move Azure an API for FHIR service instance
4+
author: zxue
5+
ms.service: healthcare-apis
6+
ms.subservice: fhir
7+
ms.topic: conceptual
8+
ms.date: 01/14/2022
9+
ms.author: zxue
10+
---
11+
12+
# Move FHIR service to another subscription or resource group
13+
14+
In this article, you'll learn how to move an Azure API for FHIR service instance to another subscription or another resource group.
15+
16+
17+
Moving to a different region is not supported, though the option may be available from the list. See more information on [Move operation support for resources](../../azure-resource-manager/management/move-support-resources.md).
18+
19+
> [!Note]
20+
> Moving an instance of Azure API for FHIR between subscriptions or resource groups is supported, as long as Private Link is NOT enabled and no IoMT connectors are created.
21+
22+
## Move to another subscription
23+
24+
You can move an Azure API for FHIR service instance to another subscription from the portal. However, the runtime and data for the service are not moved. On average the **move** operation takes approximately 15 minutes or so, and the actual time may vary.
25+
26+
The **move** operation takes a few simple steps.
27+
28+
1. Select a FHIR service instance
29+
30+
Select the FHIR service from the source subscription and then the target subscription.
31+
32+
:::image type="content" source="media/move/move-source-target.png" alt-text="Screenshot of Move to another subscription with source and target." lightbox="media/move/move-source-target.png":::
33+
34+
2. Validate the move operation
35+
36+
This step validates whether the selected resource can be moved. It takes a few minutes and returns a status from **Pending validation** to **Succeeded** or **Failed**. If the validation failed, you can view the error details, fix the error, and restart the **move** operation.
37+
38+
:::image type="content" source="media/move/move-validation.png" alt-text="Screenshot of Move to another subscription with validation." lightbox="media/move/move-validation.png":::
39+
40+
3. Review and confirm the move operation
41+
42+
After reviewing the move operation summary, select the confirmation checkbox at the bottom of the screen and press the Move button to complete the operation.
43+
44+
:::image type="content" source="media/move/move-review.png" alt-text="Screenshot of Move to another subscription with confirmation." lightbox="media/move/move-review.png":::
45+
46+
Optionally, you can check the activity log in the source subscription and target subscription.
47+
48+
## Move to another resource group
49+
50+
The process works similarly to **Move to another subscription**, except the selected FHIR service will be moved to a different resource group in the same subscription.
51+
52+
## Next steps
53+
54+
In this article, you've learned how to move the FHIR service. For more information about the FHIR service, see
55+
56+
>[!div class="nextstepaction"]
57+
>[Supported FHIR Features](fhir-features-supported.md)
58+

‎articles/healthcare-apis/azure-api-for-fhir/toc.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,8 @@ items:
152152
href: get-healthcare-apis-access-token-cli.md
153153
- name: Troubleshoot failures in Azure IoT Connector for FHIR (preview)
154154
href: iot-troubleshoot-guide.md
155+
- name: Move FHIR service
156+
href: move-fhir-service.md
155157
- name: Concepts
156158
expanded: true
157159
items:

‎articles/healthcare-apis/fhir/configure-export-data.md

Lines changed: 99 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ author: ranvijaykumar
55
ms.service: healthcare-apis
66
ms.subservice: fhir
77
ms.topic: reference
8-
ms.date: 12/16/2021
8+
ms.custom: references_regions
9+
ms.date: 01/14/2022
910
ms.author: cavoeg
1011
---
1112

@@ -56,9 +57,104 @@ After you've completed this final step, you're ready to export the data using $e
5657
> [!Note]
5758
> Only storage accounts in the same subscription as that for FHIR service are allowed to be registered as the destination for $export operations.
5859
60+
## Use Azure storage accounts behind firewalls
61+
62+
FHIR service supports a secure export operation. Choose one of the two options below:
63+
64+
* Allowing FHIR service as a Microsoft Trusted Service to access the Azure storage account.
65+
66+
* Allowing specific IP addresses associated with FHIR service to access the Azure storage account.
67+
This option provides two different configurations depending on whether the storage account is in the same location as, or is in a different location from that of the FHIR service.
68+
69+
### Allowing FHIR service as a Microsoft Trusted Service
70+
71+
Select a storage account from the Azure portal, and then select the **Networking** blade. Select **Selected networks** under the **Firewalls and virtual networks** tab.
72+
73+
:::image type="content" source="media/export-data/storage-networking-1.png" alt-text="Screenshot of Azure Storage Networking Settings." lightbox="media/export-data/storage-networking-1.png":::
74+
75+
Select **Microsoft.HealthcareApis/workspaces** from the **Resource type** dropdown list and your workspace from the **Instance name** dropdown list.
76+
77+
Under the **Exceptions** section, select the box **Allow trusted Microsoft services to access this storage account** and save the setting.
78+
79+
:::image type="content" source="media/export-data/exceptions.png" alt-text="Allow trusted Microsoft services to access this storage account.":::
80+
81+
Next, specify the FHIR service instance in the selected workspace instance for the storage account using the PowerShell command.
82+
83+
```
84+
$subscription="xxx"
85+
$tenantId = "xxx"
86+
$resourceGroupName = "xxx"
87+
$storageaccountName = "xxx"
88+
$workspacename="xxx"
89+
$fhirname="xxx"
90+
$resourceId = "/subscriptions/$subscription/resourceGroups/$resourcegroup/providers/Microsoft.HealthcareApis/workspaces/$workspacename/fhirservices/$fhirname"
91+
92+
Add-AzStorageAccountNetworkRule -ResourceGroupName $resourceGroupName -Name $storageaccountName -TenantId $tenantId -ResourceId $resourceId
93+
```
94+
95+
You can see that the networking setting for the storage account shows **two selected** in the **Instance name** dropdown list. One is linked to the workspace instance and the second is linked to the FHIR service instance.
96+
97+
:::image type="content" source="media/export-data/storage-networking-2.png" alt-text="Screenshot of Azure Storage Networking Settings with resource type and instance names." lightbox="media/export-data/storage-networking-2.png":::
98+
99+
Note that you'll need to install "Add-AzStorageAccountNetworkRule" using an administrator account. For more information, see [Configure Azure Storage firewalls and virtual networks](../../storage/common/storage-network-security.md)
100+
101+
`
102+
Install-Module Az.Storage -Repository PsGallery -AllowClobber -Force
103+
`
104+
105+
You're now ready to export FHIR data to the storage account securely. Note that the storage account is on selected networks and is not publicly accessible. To access the files, you can either enable and use private endpoints for the storage account, or enable all networks for the storage account to access the data there if possible.
106+
107+
> [!IMPORTANT]
108+
> The user interface will be updated later to allow you to select the Resource type for FHIR service and a specific service instance.
109+
110+
### Allowing specific IP addresses for the Azure storage account in a different region
111+
112+
Select **Networking** of the Azure storage account from the
113+
portal.
114+
115+
Select **Selected networks**. Under the Firewall section, specify the IP address in the **Address range** box. Add IP ranges to
116+
allow access from the internet or your on-premises networks. You can
117+
find the IP address in the table below for the Azure region where the
118+
FHIR service is provisioned.
119+
120+
|**Azure Region** |**Public IP Address** |
121+
|:----------------------|:-------------------|
122+
| Australia East | 20.53.44.80 |
123+
| Canada Central | 20.48.192.84 |
124+
| Central US | 52.182.208.31 |
125+
| East US | 20.62.128.148 |
126+
| East US 2 | 20.49.102.228 |
127+
| East US 2 EUAP | 20.39.26.254 |
128+
| Germany North | 51.116.51.33 |
129+
| Germany West Central | 51.116.146.216 |
130+
| Japan East | 20.191.160.26 |
131+
| Korea Central | 20.41.69.51 |
132+
| North Central US | 20.49.114.188 |
133+
| North Europe | 52.146.131.52 |
134+
| South Africa North | 102.133.220.197 |
135+
| South Central US | 13.73.254.220 |
136+
| Southeast Asia | 23.98.108.42 |
137+
| Switzerland North | 51.107.60.95 |
138+
| UK South | 51.104.30.170 |
139+
| UK West | 51.137.164.94 |
140+
| West Central US | 52.150.156.44 |
141+
| West Europe | 20.61.98.66 |
142+
| West US 2 | 40.64.135.77 |
143+
144+
> [!NOTE]
145+
> The above steps are similar to the configuration steps described in the document How to convert data to FHIR (Preview). For more information, see [Host and use templates](./convert-data.md#host-and-use-templates)
146+
147+
### Allowing specific IP addresses for the Azure storage account in the same region
148+
149+
The configuration process is the same as above except a specific IP
150+
address range in Classless Inter-Domain Routing (CIDR) format is used instead, 100.64.0.0/10. The reason why the IP address range, which includes 100.64.0.0 – 100.127.255.255, must be specified is because the actual IP address used by the service varies, but will be within the range, for each $export request.
151+
152+
> [!Note]
153+
> It is possible that a private IP address within the range of 10.0.2.0/24 may be used instead. In that case, the $export operation will not succeed. You can retry the $export request, but there is no guarantee that an IP address within the range of 100.64.0.0/10 will be used next time. That's the known networking behavior by design. The alternative is to configure the storage account in a different region.
154+
59155
## Next steps
60156

61-
In this article, you learned about the three steps in configuring export settings that allows you to export data out of FHIR service account to a storage account. For more information about the Bulk Export feature that allows data to be exported from the FHIR service, see
157+
In this article, you learned about the three steps in configuring export settings that allow you to export data out of FHIR service account to a storage account. For more information about the Bulk Export feature that allows data to be exported from the FHIR service, see
62158

63159
>[!div class="nextstepaction"]
64-
>[How to export FHIR data](export-data.md)
160+
>[How to export FHIR data](export-data.md)

‎articles/healthcare-apis/fhir/convert-data.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: ranvijaykumar
66
ms.service: healthcare-apis
77
ms.subservice: fhir
88
ms.topic: overview
9-
ms.date: 12/10/2021
9+
ms.date: 01/14/2022
1010
ms.author: ranku
1111
---
1212

@@ -198,7 +198,7 @@ In the table below, you'll find the IP address for the Azure region where the FH
198198

199199

200200
> [!NOTE]
201-
> The above steps are similar to the configuration steps described in the document How to export FHIR data. For more information, see [Secure Export to Azure Storage](./export-data.md#secure-export-to-azure-storage)
201+
> The above steps are similar to the configuration steps described in the document How to configure FHIR export settings. For more information, see [Configure export settings](./configure-export-data.md)
202202

203203
For a private network access (i.e. private link), you can also disable the public network access of ACR.
204204
* Select Networking blade of the Azure storage account from the portal.

‎articles/healthcare-apis/fhir/export-data.md

Lines changed: 2 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ Currently we support $export for ADLS Gen2 enabled storage accounts, with the fo
4444
- User cannot take advantage of [hierarchical namespaces](../../storage/blobs/data-lake-storage-namespace.md), yet there isn't a way to target export to a specific subdirectory within the container. We only provide the ability to target a specific container (where we create a new folder for each export).
4545
- Once an export is complete, we never export anything to that folder again, since subsequent exports to the same container will be inside a newly created folder.
4646

47+
To export data to storage accounts behind the firewalls, see [Configure settings for export](configure-export-data.md).
4748

4849
## Settings and parameters
4950

@@ -65,78 +66,6 @@ The FHIR service supports the following query parameters. All of these parameter
6566

6667
> [!Note]
6768
> Only storage accounts in the same subscription as that for FHIR service are allowed to be registered as the destination for $export operations.
68-
69-
## Secure Export to Azure Storage
70-
71-
FHIR service supports a secure export operation. Choose one of the two options below:
72-
73-
* Allowing FHIR service as a Microsoft Trusted Service to access the Azure storage account.
74-
75-
* Allowing specific IP addresses associated with FHIR service to access the Azure storage account.
76-
This option provides two different configurations depending on whether the storage account is in the same location as, or is in a different location from that of the FHIR service.
77-
78-
### Allowing FHIR service as a Microsoft Trusted Service
79-
80-
Select a storage account from the Azure portal, and then select the **Networking** blade. Select **Selected networks** under the **Firewalls and virtual networks** tab.
81-
82-
> [!IMPORTANT]
83-
> Ensure that you’ve granted access permission to the storage account for FHIR service using its managed identity. For more details, see [Configure export setting and set up the storage account](./configure-export-data.md).
84-
85-
:::image type="content" source="media/export-data/storage-networking.png" alt-text="Azure Storage Networking Settings." lightbox="media/export-data/storage-networking.png":::
86-
87-
Under the **Exceptions** section, select the box **Allow trusted Microsoft services to access this storage account** and save the setting.
88-
89-
:::image type="content" source="media/export-data/exceptions.png" alt-text="Allow trusted Microsoft services to access this storage account.":::
90-
91-
You're now ready to export FHIR data to the storage account securely. Note that the storage account is on selected networks and is not publicly accessible. To access the files, you can either enable and use private endpoints for the storage account, or enable all networks for the storage account for a short period of time.
92-
93-
> [!IMPORTANT]
94-
> The user interface will be updated later to allow you to select the Resource type for FHIR service and a specific service instance.
95-
96-
### Allowing specific IP addresses for the Azure storage account in a different region
97-
98-
Select **Networking** of the Azure storage account from the
99-
portal.
100-
101-
Select **Selected networks**. Under the Firewall section, specify the IP address in the **Address range** box. Add IP ranges to
102-
allow access from the internet or your on-premises networks. You can
103-
find the IP address in the table below for the Azure region where the
104-
FHIR service service is provisioned.
105-
106-
|**Azure Region** |**Public IP Address** |
107-
|:----------------------|:-------------------|
108-
| Australia East | 20.53.44.80 |
109-
| Canada Central | 20.48.192.84 |
110-
| Central US | 52.182.208.31 |
111-
| East US | 20.62.128.148 |
112-
| East US 2 | 20.49.102.228 |
113-
| East US 2 EUAP | 20.39.26.254 |
114-
| Germany North | 51.116.51.33 |
115-
| Germany West Central | 51.116.146.216 |
116-
| Japan East | 20.191.160.26 |
117-
| Korea Central | 20.41.69.51 |
118-
| North Central US | 20.49.114.188 |
119-
| North Europe | 52.146.131.52 |
120-
| South Africa North | 102.133.220.197 |
121-
| South Central US | 13.73.254.220 |
122-
| Southeast Asia | 23.98.108.42 |
123-
| Switzerland North | 51.107.60.95 |
124-
| UK South | 51.104.30.170 |
125-
| UK West | 51.137.164.94 |
126-
| West Central US | 52.150.156.44 |
127-
| West Europe | 20.61.98.66 |
128-
| West US 2 | 40.64.135.77 |
129-
130-
> [!NOTE]
131-
> The above steps are similar to the configuration steps described in the document How to convert data to FHIR (Preview). For more information, see [Host and use templates](./convert-data.md#host-and-use-templates)
132-
133-
### Allowing specific IP addresses for the Azure storage account in the same region
134-
135-
The configuration process is the same as above except a specific IP
136-
address range in CIDR format is used instead, 100.64.0.0/10. The reason why the IP address range, which includes 100.64.0.0 – 100.127.255.255, must be specified is because the actual IP address used by the service varies, but will be within the range, for each $export request.
137-
138-
> [!Note]
139-
> It is possible that a private IP address within the range of 10.0.2.0/24 may be used instead. In that case, the $export operation will not succeed. You can retry the $export request, but there is no guarantee that an IP address within the range of 100.64.0.0/10 will be used next time. That's the known networking behavior by design. The alternative is to configure the storage account in a different region.
14069
14170
## Next steps
14271

@@ -146,4 +75,4 @@ In this article, you've learned how to export FHIR resources using the $export c
14675
>[Export de-identified data](de-identified-export.md)
14776
14877
>[!div class="nextstepaction"]
149-
>[Export to Synapse](move-to-synapse.md)
78+
>[Export to Synapse](move-to-synapse.md)

‎articles/healthcare-apis/fhir/media/export-data/storage-networking-1.png

476 KB
Loading

‎articles/healthcare-apis/fhir/media/export-data/storage-networking-2.png

485 KB
Loading

0 commit comments

Comments
 (0)