You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/synapse-analytics/sql/access-control.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -164,4 +164,8 @@ REVOKE CONTROL ON DATABASE::<SQLpoolname> TO <workspacename>;
164
164
165
165
--Deleting the user in the DB
166
166
DROP USER [<workspacename>];
167
-
```
167
+
```
168
+
169
+
## Next steps
170
+
171
+
For an overview of access and control in Synapse SQL, see [Synapse SQL access control](../sql/access-control.md). To learn more about database principals, see [Principals](https://msdn.microsoft.com/library/ms181127.aspx). Additional information about database roles, can be found in the [Database roles](https://msdn.microsoft.com/library/ms189121.aspx) article.
Copy file name to clipboardExpand all lines: articles/synapse-analytics/sql/active-directory-authentication.md
+14-13Lines changed: 14 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Azure Active Directory
3
-
description: Learn about how to use Azure Active Directory for authentication with SQL Database, Managed Instance, and SQL Analytics
3
+
description: Learn about how to use Azure Active Directory for authentication with SQL Database, Managed Instance, and Synapse SQL
4
4
services: synapse-analytics
5
5
author: vvasic-msft
6
6
ms.service: synapse-analytics
@@ -9,7 +9,7 @@ ms.date: 1/23/2020
9
9
ms.author: vvasic
10
10
ms.reviewer: jrasnick
11
11
---
12
-
# Use Azure Active Directory Authentication for authentication with SQL Analytics
12
+
# Use Azure Active Directory Authentication for authentication with Synapse SQL
13
13
14
14
Azure Active Directory authentication is a mechanism of connecting to [Azure Synapse Analytics](../overview-faq.md) by using identities in Azure Active Directory (Azure AD).
15
15
@@ -22,7 +22,7 @@ With Azure AD authentication, you can centrally manage the identities of users h
22
22
- It can eliminate storing passwords by enabling integrated Windows authentication and other forms of authentication supported by Azure Active Directory.
23
23
- Azure AD supports token-based authentication for applications connecting to Azure Synapse.
24
24
- Azure AD authentication supports ADFS (domain federation) or native user/password authentication for a local Azure Active Directory without domain synchronization.
25
-
- Azure AD supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes Multi-Factor Authentication (MFA). MFA includes strong authentication with a range of easy verification options — phone call, text message, smart cards with pin, or mobile app notification. For more information, see [SSMS support for Azure AD MFA with SQL Analytics](mfa-authentication.md).
25
+
- Azure AD supports connections from SQL Server Management Studio that use Active Directory Universal Authentication, which includes Multi-Factor Authentication (MFA). MFA includes strong authentication with a range of easy verification options — phone call, text message, smart cards with pin, or mobile app notification. For more information, see [SSMS support for Azure AD MFA with Synapse SQL](mfa-authentication.md).
26
26
- Azure AD supports similar connections from SQL Server Data Tools (SSDT) that use Active Directory Interactive Authentication. For more information, see
27
27
[Azure Active Directory support in SQL Server Data Tools (SSDT)](/sql/ssdt/azure-active-directory?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest).
28
28
@@ -41,7 +41,7 @@ Defining access rights on the files and data that is respected in different data
41
41
42
42
## Trust architecture
43
43
44
-
The following high-level diagram summarizes the solution architecture of using Azure AD authentication with SQL Analytics. To support Azure AD native user password, only the Cloud portion and Azure AD/Synapse SQL Analytics is considered. To support Federated authentication (or user/password for Windows credentials), the communication with ADFS block is required. The arrows indicate communication pathways.
44
+
The following high-level diagram summarizes the solution architecture of using Azure AD authentication with Synapse SQL. To support Azure AD native user password, only the Cloud portion and Azure AD/Synapse Synapse SQL is considered. To support Federated authentication (or user/password for Windows credentials), the communication with ADFS block is required. The arrows indicate communication pathways.
45
45
46
46
![aad auth diagram][1]
47
47
@@ -51,26 +51,28 @@ The following diagram indicates the federation, trust, and hosting relationships
51
51
52
52
## Administrator structure
53
53
54
-
When using Azure AD authentication, there are two Administrator accounts for the SQL Analytics; the original SQL Server administrator and the Azure AD administrator. Only the administrator based on an Azure AD account can create the first Azure AD contained database user in a user database. The Azure AD administrator login can be an Azure AD user or an Azure AD group. When the administrator is a group account, it can be used by any group member, enabling multiple Azure AD administrators for the SQL Analytics instance. Using group account as an administrator enhances manageability by allowing you to centrally add and remove group members in Azure AD without changing the users or permissions in Synapse Analytics workspace. Only one Azure AD administrator (a user or group) can be configured at any time.
54
+
When using Azure AD authentication, there are two Administrator accounts for the Synapse SQL; the original SQL Server administrator and the Azure AD administrator. Only the administrator based on an Azure AD account can create the first Azure AD contained database user in a user database. The Azure AD administrator login can be an Azure AD user or an Azure AD group.
55
+
56
+
When the administrator is a group account, it can be used by any group member, enabling multiple Azure AD administrators for the Synapse SQL instance. Using group account as an administrator enhances manageability by allowing you to centrally add and remove group members in Azure AD without changing the users or permissions in Synapse Analytics workspace. Only one Azure AD administrator (a user or group) can be configured at any time.
55
57
56
58
![admin structure][3]
57
59
58
60
## Permissions
59
61
60
62
To create new users, you must have the `ALTER ANY USER` permission in the database. The `ALTER ANY USER` permission can be granted to any database user. The `ALTER ANY USER` permission is also held by the server administrator accounts, and database users with the `CONTROL ON DATABASE` or `ALTER ON DATABASE` permission for that database, and by members of the `db_owner` database role.
61
63
62
-
To create a contained database user in SQL Analytics, you must connect to the database or instance using an Azure AD identity. To create the first contained database user, you must connect to the database by using an Azure AD administrator (who is the owner of the database). Any Azure AD authentication is only possible if the Azure AD admin was created for SQL Analytics. If the Azure Active Directory admin was removed from the server, existing Azure Active Directory users created previously inside SQL Analytics can no longer connect to the database using their Azure Active Directory credentials.
64
+
To create a contained database user in Synapse SQL, you must connect to the database or instance using an Azure AD identity. To create the first contained database user, you must connect to the database by using an Azure AD administrator (who is the owner of the database). Any Azure AD authentication is only possible if the Azure AD admin was created for Synapse SQL. If the Azure Active Directory admin was removed from the server, existing Azure Active Directory users created previously inside Synapse SQL can no longer connect to the database using their Azure Active Directory credentials.
63
65
64
66
## Azure AD features and limitations
65
67
66
-
- The following members of Azure AD can be provisioned in SQL Analytics:
68
+
- The following members of Azure AD can be provisioned in Synapse SQL:
67
69
68
70
- Native members: A member created in Azure AD in the managed domain or in a customer domain. For more information, see [Add your own domain name to Azure AD](../../active-directory/fundamentals/add-custom-domain.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json).
69
71
- Federated domain members: A member created in Azure AD with a federated domain. For more information, see [Microsoft Azure now supports federation with Windows Server Active Directory](https://azure.microsoft.com/blog/20../../windows-azure-now-supports-federation-with-windows-server-active-directory/).
70
72
- Imported members from other Azure AD's who are native or federated domain members.
71
73
- Active Directory groups created as security groups.
72
74
73
-
- Azure AD users that are part of a group that has `db_owner` server role cannot use the **[CREATE DATABASE SCOPED CREDENTIAL](/sql/t-sql/statements/create-database-scoped-credential-transact-sql?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest)** syntax against SQL Analytics. You will see the following error:
75
+
- Azure AD users that are part of a group that has `db_owner` server role cannot use the **[CREATE DATABASE SCOPED CREDENTIAL](/sql/t-sql/statements/create-database-scoped-credential-transact-sql?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest)** syntax against Synapse SQL. You will see the following error:
74
76
75
77
`SQL Error [2760] [S0001]: The specified schema name '[email protected]' either does not exist or you do not have permission to use it.`
76
78
@@ -102,9 +104,9 @@ The following authentication methods are supported for Azure AD server principal
102
104
### Additional considerations
103
105
104
106
- To enhance manageability, we recommend you provision a dedicated Azure AD group as an administrator.
105
-
- Only one Azure AD administrator (a user or group) can be configured for SQL Analytics pool at any time.
107
+
- Only one Azure AD administrator (a user or group) can be configured for Synapse SQL pool at any time.
106
108
- The addition of Azure AD server principals (logins) for SQL on-demand (preview) allows the possibility of creating multiple Azure AD server principals (logins) that can be added to the `sysadmin` role.
107
-
- Only an Azure AD administrator for SQL Analytics can initially connect to the SQL Analytics using an Azure Active Directory account. The Active Directory administrator can configure subsequent Azure AD database users.
109
+
- Only an Azure AD administrator for Synapse SQL can initially connect to the Synapse SQL using an Azure Active Directory account. The Active Directory administrator can configure subsequent Azure AD database users.
108
110
- We recommend setting the connection timeout to 30 seconds.
109
111
- SQL Server 2016 Management Studio and SQL Server Data Tools for Visual Studio 2015 (version 14.0.60311.1April 2016 or later) support Azure Active Directory authentication. (Azure AD authentication is supported by the **.NET Framework Data Provider for SqlServer**; at least version .NET Framework 4.6). Therefore the newest versions of these tools and data-tier applications (DAC and .BACPAC) can use Azure AD authentication.
110
112
- Beginning with version 15.0.1, [sqlcmd utility](/sql/tools/sqlcmd-utility?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest) and [bcp utility](/sql/tools/bcp-utility?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest) support Active Directory Interactive authentication with MFA.
@@ -113,9 +115,8 @@ The following authentication methods are supported for Azure AD server principal
113
115
114
116
## Next steps
115
117
116
-
- For an overview of access and control in SQL Analytics, see [SQL Analytics access control](../sql/access-control.md).
117
-
- For more information about database principals, see [Principals](/sql/relational-databases/security/authentication-access/principals-database-engine?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest).
118
-
- For more information about database roles, see [Database roles](/sql/relational-databases/security/authentication-access/database-level-roles?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest).
118
+
For an overview of access and control in Synapse SQL, see [Synapse SQL access control](../sql/access-control.md). To learn more about database principals, see [Principals](https://msdn.microsoft.com/library/ms181127.aspx). Additional information about database roles, can be found in the [Database roles](https://msdn.microsoft.com/library/ms189121.aspx) article.
Copy file name to clipboardExpand all lines: articles/synapse-analytics/sql/best-practices-sql-on-demand.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -63,4 +63,4 @@ As CETAS generates Parquet files, statistics will be automatically created when
63
63
64
64
## Next steps
65
65
66
-
Review the [Troubleshooting](../sql-data-warehouse/sql-data-warehouse-troubleshoot.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json) article for common issues and solutions. If you're working with SQL pools rather than SQL on-demand, please see the [Best Practices for SQL pools](best-practices-sql-pool.md) article for specific guidance.
66
+
Review the [Troubleshooting](../sql-data-warehouse/sql-data-warehouse-troubleshoot.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json) article for common issues and solutions. If you're working with SQL pool rather than SQL on-demand, please see the [Best Practices for SQL pool](best-practices-sql-pool.md) article for specific guidance.
Copy file name to clipboardExpand all lines: articles/synapse-analytics/sql/develop-transaction-best-practices.md
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -401,7 +401,11 @@ END
401
401
402
402
## Pause and scaling guidance
403
403
404
-
Azure Synapse Analytics lets you [pause, resume, and scale](../sql-data-warehouse/sql-data-warehouse-manage-compute-overview.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json) your SQL pool on demand. When you pause or scale your SQL pool, it is important to understand that any in-flight transactions are terminated immediately; causing any open transactions to be rolled back. If your workload had issued a long running and incomplete data modification prior to the pause or scale operation, then this work will need to be undone. This undoing might impact the time it takes to pause or scale your SQL pool.
404
+
Azure Synapse Analytics lets you [pause, resume, and scale](../sql-data-warehouse/sql-data-warehouse-manage-compute-overview.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json) your SQL pool on demand.
405
+
406
+
When you pause or scale your SQL pool, it is important to understand that any in-flight transactions are terminated immediately; causing any open transactions to be rolled back.
407
+
408
+
If your workload had issued a long running and incomplete data modification prior to the pause or scale operation, then this work will need to be undone. This undoing might impact the time it takes to pause or scale your SQL pool.
405
409
406
410
> [!IMPORTANT]
407
411
> Both `UPDATE` and `DELETE` are fully logged operations and so these undo/redo operations can take significantly longer than equivalent minimally logged operations.
Copy file name to clipboardExpand all lines: articles/synapse-analytics/sql/develop-transactions.md
+6-3Lines changed: 6 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,11 +22,14 @@ As you would expect, SQL pool supports transactions as part of the data warehous
22
22
23
23
## Transaction isolation levels
24
24
25
-
SQL pool implements ACID transactions. The isolation level of the transactional support is default to READ UNCOMMITTED. You can change it to READ COMMITTED SNAPSHOT ISOLATION by turning ON the READ_COMMITTED_SNAPSHOT database option for a user database when connected to the master database. Once enabled, all transactions in this database are executed under READ COMMITTED SNAPSHOT ISOLATION and setting READ UNCOMMITTED on session level will not be honored. Check [ALTER DATABASE SET options (Transact-SQL)](/sql/t-sql/statements/alter-database-transact-sql-set-options?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json&view=azure-sqldw-latest) for details.
25
+
SQL pool implements ACID transactions. The isolation level of the transactional support is default to READ UNCOMMITTED. You can change it to READ COMMITTED SNAPSHOT ISOLATION by turning ON the READ_COMMITTED_SNAPSHOT database option for a user database when connected to the master database.
26
+
27
+
Once enabled, all transactions in this database are executed under READ COMMITTED SNAPSHOT ISOLATION and setting READ UNCOMMITTED on session level will not be honored. Check [ALTER DATABASE SET options (Transact-SQL)](https://docs.microsoft.com/sql/t-sql/statements/alter-database-transact-sql-set-options?view=azure-sqldw-latest) for details.
26
28
27
29
## Transaction size
30
+
A single data modification transaction is limited in size. The limit is applied per distribution. Therefore, the total allocation can be calculated by multiplying the limit by the distribution count.
28
31
29
-
A single data modification transaction is limited in size. The limit is applied per distribution. Therefore, the total allocation can be calculated by multiplying the limit by the distribution count. To approximate the maximum number of rows in the transaction divide the distribution cap by the total size of each row. For variable length columns, consider taking an average column length rather than using the maximum size.
32
+
To approximate the maximum number of rows in the transaction divide the distribution cap by the total size of each row. For variable length columns, consider taking an average column length rather than using the maximum size.
30
33
31
34
In the table below the following assumptions have been made:
32
35
@@ -199,4 +202,4 @@ They are as follows:
199
202
200
203
## Next steps
201
204
202
-
To learn more about optimizing transactions, see [Transactions best practices](../sql-data-warehouse/sql-data-warehouse-develop-best-practices-transactions.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json). Additional best practices guides are also provided for [SQL pools](best-practices-sql-pool.md) and [SQL on-demand (preview)](on-demand.md).
205
+
To learn more about optimizing transactions, see [Transactions best practices](../sql-data-warehouse/sql-data-warehouse-develop-best-practices-transactions.md?toc=/azure/synapse-analytics/toc.json&bc=/azure/synapse-analytics/breadcrumb/toc.json). Additional best practices guides are also provided for [SQL pool](best-practices-sql-pool.md) and [SQL on-demand (preview)](on-demand.md).
0 commit comments