Skip to content

Commit 1029607

Browse files
authored
Merge pull request #110732 from Kat-Campise/next_steps_2
synapse SQL next steps
2 parents f5c8563 + eca1195 commit 1029607

17 files changed

+140
-71
lines changed

articles/synapse-analytics/sql/access-control.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,4 +164,8 @@ REVOKE CONTROL ON DATABASE::<SQLpoolname> TO <workspacename>;
164164
165165
--Deleting the user in the DB
166166
DROP USER [<workspacename>];
167-
```
167+
```
168+
169+
## Next steps
170+
171+
For an overview of access and control in Synapse SQL, see [Synapse SQL access control](../sql/access-control.md). To learn more about database principals, see [Principals](https://msdn.microsoft.com/library/ms181127.aspx). Additional information about database roles, can be found in the [Database roles](https://msdn.microsoft.com/library/ms189121.aspx) article.

articles/synapse-analytics/sql/active-directory-authentication.md

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Azure Active Directory
3-
description: Learn about how to use Azure Active Directory for authentication with SQL Database, Managed Instance, and SQL Analytics
3+
description: Learn about how to use Azure Active Directory for authentication with SQL Database, Managed Instance, and Synapse SQL
44
services: synapse-analytics
55
author: vvasic-msft
66
ms.service: synapse-analytics
@@ -9,7 +9,7 @@ ms.date: 1/23/2020
99
ms.author: vvasic
1010
ms.reviewer: jrasnick
1111
---
12-
# Use Azure Active Directory Authentication for authentication with SQL Analytics
12+
# Use Azure Active Directory Authentication for authentication with Synapse SQL
1313

1414
Azure Active Directory authentication is a mechanism of connecting to [Azure Synapse Analytics](../overview-faq.md) by using identities in Azure Active Directory (Azure AD).
1515

@@ -22,7 +22,7 @@ With Azure AD authentication, you can centrally manage the identities of users h
2222
- It can eliminate storing passwords by enabling integrated Windows authentication and other forms of authentication supported by Azure Active Directory.
2323
- Azure AD supports token-based authentication for applications connecting to Azure Synapse.
2424
- Azure AD authentication supports ADFS (domain federation) or native user/password authentication for a local Azure Active Directory without domain synchronization.
25-
- Azure AD supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes Multi-Factor Authentication (MFA). MFA includes strong authentication with a range of easy verification options — phone call, text message, smart cards with pin, or mobile app notification. For more information, see [SSMS support for Azure AD MFA with SQL Analytics](mfa-authentication.md).
25+
- Azure AD supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes Multi-Factor Authentication (MFA). MFA includes strong authentication with a range of easy verification options — phone call, text message, smart cards with pin, or mobile app notification. For more information, see [SSMS support for Azure AD MFA with Synapse SQL](mfa-authentication.md).
2626
- Azure AD supports similar connections from SQL Server Data Tools (SSDT) that use Active Directory Interactive Authentication. For more information, see
2727
[Azure Active Directory support in SQL Server Data Tools (SSDT)](/sql/ssdt/azure-active-directory?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest).
2828

@@ -41,7 +41,7 @@ Defining access rights on the files and data that is respected in different data
4141

4242
## Trust architecture
4343

44-
The following high-level diagram summarizes the solution architecture of using Azure AD authentication with SQL Analytics. To support Azure AD native user password, only the Cloud portion and Azure AD/Synapse SQL Analytics is considered. To support Federated authentication (or user/password for Windows credentials), the communication with ADFS block is required. The arrows indicate communication pathways.
44+
The following high-level diagram summarizes the solution architecture of using Azure AD authentication with Synapse SQL. To support Azure AD native user password, only the Cloud portion and Azure AD/Synapse Synapse SQL is considered. To support Federated authentication (or user/password for Windows credentials), the communication with ADFS block is required. The arrows indicate communication pathways.
4545

4646
![aad auth diagram][1]
4747

@@ -51,26 +51,28 @@ The following diagram indicates the federation, trust, and hosting relationships
5151

5252
## Administrator structure
5353

54-
When using Azure AD authentication, there are two Administrator accounts for the SQL Analytics; the original SQL Server administrator and the Azure AD administrator. Only the administrator based on an Azure AD account can create the first Azure AD contained database user in a user database. The Azure AD administrator login can be an Azure AD user or an Azure AD group. When the administrator is a group account, it can be used by any group member, enabling multiple Azure AD administrators for the SQL Analytics instance. Using group account as an administrator enhances manageability by allowing you to centrally add and remove group members in Azure AD without changing the users or permissions in Synapse Analytics workspace. Only one Azure AD administrator (a user or group) can be configured at any time.
54+
When using Azure AD authentication, there are two Administrator accounts for the Synapse SQL; the original SQL Server administrator and the Azure AD administrator. Only the administrator based on an Azure AD account can create the first Azure AD contained database user in a user database. The Azure AD administrator login can be an Azure AD user or an Azure AD group.
55+
56+
When the administrator is a group account, it can be used by any group member, enabling multiple Azure AD administrators for the Synapse SQL instance. Using group account as an administrator enhances manageability by allowing you to centrally add and remove group members in Azure AD without changing the users or permissions in Synapse Analytics workspace. Only one Azure AD administrator (a user or group) can be configured at any time.
5557

5658
![admin structure][3]
5759

5860
## Permissions
5961

6062
To create new users, you must have the `ALTER ANY USER` permission in the database. The `ALTER ANY USER` permission can be granted to any database user. The `ALTER ANY USER` permission is also held by the server administrator accounts, and database users with the `CONTROL ON DATABASE` or `ALTER ON DATABASE` permission for that database, and by members of the `db_owner` database role.
6163

62-
To create a contained database user in SQL Analytics, you must connect to the database or instance using an Azure AD identity. To create the first contained database user, you must connect to the database by using an Azure AD administrator (who is the owner of the database). Any Azure AD authentication is only possible if the Azure AD admin was created for SQL Analytics. If the Azure Active Directory admin was removed from the server, existing Azure Active Directory users created previously inside SQL Analytics can no longer connect to the database using their Azure Active Directory credentials.
64+
To create a contained database user in Synapse SQL, you must connect to the database or instance using an Azure AD identity. To create the first contained database user, you must connect to the database by using an Azure AD administrator (who is the owner of the database). Any Azure AD authentication is only possible if the Azure AD admin was created for Synapse SQL. If the Azure Active Directory admin was removed from the server, existing Azure Active Directory users created previously inside Synapse SQL can no longer connect to the database using their Azure Active Directory credentials.
6365

6466
## Azure AD features and limitations
6567

66-
- The following members of Azure AD can be provisioned in SQL Analytics:
68+
- The following members of Azure AD can be provisioned in Synapse SQL:
6769

6870
- Native members: A member created in Azure AD in the managed domain or in a customer domain. For more information, see [Add your own domain name to Azure AD](../../active-directory/fundamentals/add-custom-domain.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json).
6971
- Federated domain members: A member created in Azure AD with a federated domain. For more information, see [Microsoft Azure now supports federation with Windows Server Active Directory](https://azure.microsoft.com/blog/20../../windows-azure-now-supports-federation-with-windows-server-active-directory/).
7072
- Imported members from other Azure AD's who are native or federated domain members.
7173
- Active Directory groups created as security groups.
7274

73-
- Azure AD users that are part of a group that has `db_owner` server role cannot use the **[CREATE DATABASE SCOPED CREDENTIAL](/sql/t-sql/statements/create-database-scoped-credential-transact-sql?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest)** syntax against SQL Analytics. You will see the following error:
75+
- Azure AD users that are part of a group that has `db_owner` server role cannot use the **[CREATE DATABASE SCOPED CREDENTIAL](/sql/t-sql/statements/create-database-scoped-credential-transact-sql?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest)** syntax against Synapse SQL. You will see the following error:
7476

7577
`SQL Error [2760] [S0001]: The specified schema name '[email protected]' either does not exist or you do not have permission to use it.`
7678

@@ -102,9 +104,9 @@ The following authentication methods are supported for Azure AD server principal
102104
### Additional considerations
103105

104106
- To enhance manageability, we recommend you provision a dedicated Azure AD group as an administrator.
105-
- Only one Azure AD administrator (a user or group) can be configured for SQL Analytics pool at any time.
107+
- Only one Azure AD administrator (a user or group) can be configured for Synapse SQL pool at any time.
106108
- The addition of Azure AD server principals (logins) for SQL on-demand (preview) allows the possibility of creating multiple Azure AD server principals (logins) that can be added to the `sysadmin` role.
107-
- Only an Azure AD administrator for SQL Analytics can initially connect to the SQL Analytics using an Azure Active Directory account. The Active Directory administrator can configure subsequent Azure AD database users.
109+
- Only an Azure AD administrator for Synapse SQL can initially connect to the Synapse SQL using an Azure Active Directory account. The Active Directory administrator can configure subsequent Azure AD database users.
108110
- We recommend setting the connection timeout to 30 seconds.
109111
- SQL Server 2016 Management Studio and SQL Server Data Tools for Visual Studio 2015 (version 14.0.60311.1April 2016 or later) support Azure Active Directory authentication. (Azure AD authentication is supported by the **.NET Framework Data Provider for SqlServer**; at least version .NET Framework 4.6). Therefore the newest versions of these tools and data-tier applications (DAC and .BACPAC) can use Azure AD authentication.
110112
- Beginning with version 15.0.1, [sqlcmd utility](/sql/tools/sqlcmd-utility?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest) and [bcp utility](/sql/tools/bcp-utility?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest) support Active Directory Interactive authentication with MFA.
@@ -113,9 +115,8 @@ The following authentication methods are supported for Azure AD server principal
113115

114116
## Next steps
115117

116-
- For an overview of access and control in SQL Analytics, see [SQL Analytics access control](../sql/access-control.md).
117-
- For more information about database principals, see [Principals](/sql/relational-databases/security/authentication-access/principals-database-engine?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest).
118-
- For more information about database roles, see [Database roles](/sql/relational-databases/security/authentication-access/database-level-roles?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest).
118+
For an overview of access and control in Synapse SQL, see [Synapse SQL access control](../sql/access-control.md). To learn more about database principals, see [Principals](https://msdn.microsoft.com/library/ms181127.aspx). Additional information about database roles, can be found in the [Database roles](https://msdn.microsoft.com/library/ms189121.aspx) article.
119+
119120

120121
<!--Image references-->
121122

articles/synapse-analytics/sql/best-practices-sql-on-demand.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,4 +63,4 @@ As CETAS generates Parquet files, statistics will be automatically created when
6363

6464
## Next steps
6565

66-
Review the [Troubleshooting](../sql-data-warehouse/sql-data-warehouse-troubleshoot.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json) article for common issues and solutions. If you're working with SQL pools rather than SQL on-demand, please see the [Best Practices for SQL pools](best-practices-sql-pool.md) article for specific guidance.
66+
Review the [Troubleshooting](../sql-data-warehouse/sql-data-warehouse-troubleshoot.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json) article for common issues and solutions. If you're working with SQL pool rather than SQL on-demand, please see the [Best Practices for SQL pool](best-practices-sql-pool.md) article for specific guidance.

articles/synapse-analytics/sql/develop-transaction-best-practices.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,11 @@ END
401401

402402
## Pause and scaling guidance
403403

404-
Azure Synapse Analytics lets you [pause, resume, and scale](../sql-data-warehouse/sql-data-warehouse-manage-compute-overview.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json) your SQL pool on demand. When you pause or scale your SQL pool, it is important to understand that any in-flight transactions are terminated immediately; causing any open transactions to be rolled back. If your workload had issued a long running and incomplete data modification prior to the pause or scale operation, then this work will need to be undone. This undoing might impact the time it takes to pause or scale your SQL pool.
404+
Azure Synapse Analytics lets you [pause, resume, and scale](../sql-data-warehouse/sql-data-warehouse-manage-compute-overview.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json) your SQL pool on demand.
405+
406+
When you pause or scale your SQL pool, it is important to understand that any in-flight transactions are terminated immediately; causing any open transactions to be rolled back.
407+
408+
If your workload had issued a long running and incomplete data modification prior to the pause or scale operation, then this work will need to be undone. This undoing might impact the time it takes to pause or scale your SQL pool.
405409

406410
> [!IMPORTANT]
407411
> Both `UPDATE` and `DELETE` are fully logged operations and so these undo/redo operations can take significantly longer than equivalent minimally logged operations.

articles/synapse-analytics/sql/develop-transactions.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,14 @@ As you would expect, SQL pool supports transactions as part of the data warehous
2222

2323
## Transaction isolation levels
2424

25-
SQL pool implements ACID transactions. The isolation level of the transactional support is default to READ UNCOMMITTED. You can change it to READ COMMITTED SNAPSHOT ISOLATION by turning ON the READ_COMMITTED_SNAPSHOT database option for a user database when connected to the master database. Once enabled, all transactions in this database are executed under READ COMMITTED SNAPSHOT ISOLATION and setting READ UNCOMMITTED on session level will not be honored. Check [ALTER DATABASE SET options (Transact-SQL)](/sql/t-sql/statements/alter-database-transact-sql-set-options?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest) for details.
25+
SQL pool implements ACID transactions. The isolation level of the transactional support is default to READ UNCOMMITTED. You can change it to READ COMMITTED SNAPSHOT ISOLATION by turning ON the READ_COMMITTED_SNAPSHOT database option for a user database when connected to the master database.
26+
27+
Once enabled, all transactions in this database are executed under READ COMMITTED SNAPSHOT ISOLATION and setting READ UNCOMMITTED on session level will not be honored. Check [ALTER DATABASE SET options (Transact-SQL)](https://docs.microsoft.com/sql/t-sql/statements/alter-database-transact-sql-set-options?view=azure-sqldw-latest) for details.
2628

2729
## Transaction size
30+
A single data modification transaction is limited in size. The limit is applied per distribution. Therefore, the total allocation can be calculated by multiplying the limit by the distribution count.
2831

29-
A single data modification transaction is limited in size. The limit is applied per distribution. Therefore, the total allocation can be calculated by multiplying the limit by the distribution count. To approximate the maximum number of rows in the transaction divide the distribution cap by the total size of each row. For variable length columns, consider taking an average column length rather than using the maximum size.
32+
To approximate the maximum number of rows in the transaction divide the distribution cap by the total size of each row. For variable length columns, consider taking an average column length rather than using the maximum size.
3033

3134
In the table below the following assumptions have been made:
3235

@@ -199,4 +202,4 @@ They are as follows:
199202

200203
## Next steps
201204

202-
To learn more about optimizing transactions, see [Transactions best practices](../sql-data-warehouse/sql-data-warehouse-develop-best-practices-transactions.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json). Additional best practices guides are also provided for [SQL pools](best-practices-sql-pool.md) and [SQL on-demand (preview)](on-demand.md).
205+
To learn more about optimizing transactions, see [Transactions best practices](../sql-data-warehouse/sql-data-warehouse-develop-best-practices-transactions.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json). Additional best practices guides are also provided for [SQL pool](best-practices-sql-pool.md) and [SQL on-demand (preview)](on-demand.md).

articles/synapse-analytics/sql/get-started-power-bi-professional.md

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.reviewer: jrasnick, carlrab
1212
---
1313

1414

15-
# Connect to SQL Analytics with Power BI Professional
15+
# Connect to Synapse SQL with Power BI Professional
1616

1717
> [!div class="op_single_selector"]
1818
>
@@ -103,6 +103,5 @@ Write URL for the database and name of the database where view is residing.
103103

104104
## Next steps
105105

106-
Advance to the next article to learn how to connect to SQL on-demand using Azure Data Studio.
107-
> [!div class="nextstepaction"]
108-
> [Query storage files](get-started-azure-data-studio.md)
106+
Advance to [Query storage files](get-started-azure-data-studio.md) to learn how to connect to SQL on-demand using Azure Data Studio.
107+

0 commit comments

Comments
 (0)