Skip to content

Commit 11dd891

Browse files
Albertyang0Albertyang0
authored
Merge pull request #303753 from MicrosoftDocs/release-storage-discovery-2025
release-storage-discovery-2025 -> main -- 08/01 - 17:00
2 parents 23d1012 + 8c5654e commit 11dd891

27 files changed

+774
-0
lines changed

‎articles/storage-discovery/TOC.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
items:
2+
- name: Azure Storage Discovery documentation
3+
href: ./index.yml
4+
- name: Overview
5+
items:
6+
- name: What is Azure Storage Discovery?
7+
href: overview.md
8+
expanded: true
9+
- name: Concepts
10+
items:
11+
- name: Management components
12+
href: management-components.md
13+
- name: Planning for deployment
14+
href: deployment-planning.md
15+
- name: Pricing
16+
href: pricing.md
17+
- name: How-To
18+
items:
19+
- name: Deploy
20+
items:
21+
- name: Create Storage Discovery Workspace
22+
href: create-workspace.md
23+
- name: Resources
24+
items:
25+
- name: Release notes
26+
href: release-notes.md
27+
- name: Frequently Asked Questions
28+
href: frequently-asked-questions.md

‎articles/storage-discovery/create-workspace.md

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
---
2+
title: Create and manage an Azure Storage Discovery Workspace
3+
titleSuffix: Azure Storage Discovery
4+
description: Learn how to create an Azure Storage Discovery Workspace.
5+
author: fauhse
6+
7+
ms.service: azure-storage-discovery
8+
ms.topic: overview
9+
ms.date: 07/22/2025
10+
ms.author: fauhse
11+
---
12+
13+
<!--
14+
!########################################################
15+
STATUS: DRAFT
16+
17+
CONTENT: IN PROGRESS
18+
19+
REVIEW Stephen/Fabian: IN PROGRESS
20+
EDIT PASS: IN PROGRESS
21+
22+
Document score: 100 - 495/0 (words, issues)
23+
24+
!########################################################
25+
-->
26+
27+
# Create and manage a storage discovery workspace
28+
29+
The Azure Storage Discovery Workspace (ASDW) is a central resource within the Azure Storage Discovery platform. A discovery workspace is designed to help users manage and visualize storage data across various scopes such as tenants, subscriptions, and resource groups.
30+
31+
Follow the steps in this article to create an ASDW resource.
32+
33+
## Create a storage discovery workspace
34+
35+
You can create a storage discovery workspace using the Azure portal, Azure CLI, or ARM templates.
36+
37+
### [Azure portal](#tab/portal)
38+
39+
Create an ASDW resource by selecting **Create** as shown in the following image.
40+
41+
:::image source="media/create-workspace/create-resource-sml.png" alt-text="Screenshot of the Create ASDW page." lightbox="media/create-workspace/create-resource.png":::
42+
43+
Choose the **Subscription** and **Resource group** in which to create the discovery workspace. The following table describes each element.
44+
45+
| Element | Description |
46+
|----------------|-------------------------------------------------------------------|
47+
| `Name` | The name of the Discovery workspace resource. |
48+
| `Description` | Optional. Description of the Discovery workspace resource. |
49+
| `Region` | Azure region where the Discovery resource is created.<sup>1</sup> |
50+
| `Pricing plan` | Storage Discovery pricing plan.<sup>2</sup> |
51+
52+
<sup>1</sup> For information on regions covered, see [Storage Discovery workspace regions](deployment-planning.md).
53+
<sup>2</sup> For information on Storage Discovery pricing plan, see [Understand Storage Discovery Pricing](pricing.md).
54+
55+
## Define workspaceRoots
56+
57+
A workspaceRoot specifies the top-level Azure resource identifiers where Storage Discovery initiates its scan for storage accounts. These identifiers are typically subscriptions or resource groups, and serve as the root of the discovery process. WorkspaceRoots define the overall scope and boundaries of your Azure estate for analysis.
58+
59+
Select the subscriptions and/or resource groups you want to include in the workspace.
60+
61+
> [!NOTE]
62+
> - Ensure that the user or service principal deploying the workspace is granted at least **Reader** access to each specified root.
63+
> - Up to 100 resources - subscriptions and/or resource groups can be included in one ASDW.
64+
65+
:::image source="media/create-workspace/workspace-roots-checks-sml.png" alt-text="Screenshot of the workspaceRoots." lightbox="media/create-workspace/workspace-roots-checks.png":::
66+
67+
After you add your subscriptions, resource groups, or tenant to your workspace, the service runs an access check to verify that the user has `Microsoft.Storage/storageAccounts/read` on the added resources. The following image provides an example of an access check failure with the associated status message.
68+
69+
:::image source="media/create-workspace/create-access-sml.png" alt-text="Screenshot of the access check on workspaceRoots." lightbox="media/create-workspace/create-access.png":::
70+
71+
If you don't have `Microsoft.Storage/storageAccounts/read` on any of the resources added, remove the resource from the workSpaceRoots to proceed with the creation of workspace or resolve the access issue and try again.
72+
73+
## Create a Scope
74+
Scopes are logical groupings of storage accounts within the defined workspaceRoots. Scopes allow you to filter and organize data using tags and resource types, enabling targeted insights. For example, you can create scopes for individual departments, environments, or compliance zones.
75+
76+
:::image source="media/create-workspace/create-scope-sml.png" alt-text="Screenshot of a scope." lightbox="media/create-workspace/create-scope.png":::
77+
78+
> [!IMPORTANT]
79+
> A **default Scope** is added automatically, which includes all storage accounts within subscriptions or resource groups added in the **workspaceRoots**.
80+
81+
Add tags on the ASDW resource, if needed, and select **Review and Create**. You aren't able to deploy the resource until an access validation is complete. If the check for the workspaceRoots resources isn't complete, a message is displayed.
82+
83+
:::image source="media/create-workspace/access-check-sml.png" alt-text="Screenshot of access checks running." lightbox="media/create-workspace/access-check.png":::
84+
85+
> [!NOTE]
86+
> Discovery resource creation fails if the access checks on any subscription, resource group, or tenant isn't successful.
87+
88+
After the access checks complete successfully, the resource can be deployed as shown in the following sample image.
89+
90+
:::image source="media/create-workspace/deploy-resource-sml.png" alt-text="Screenshot of the deployment complete." lightbox="media/create-workspace/deploy-resource.png":::
91+
92+
### [Azure PowerShell](#tab/powershell)
93+
94+
Something like this:
95+
96+
```powershell
97+
98+
# Set variables for the resources
99+
$resGroupName = "MyResourceGroup"
100+
$workSpaceName = "MyStorageDiscoveryWorkspace"
101+
$location = "East US"
102+
$DiscoveryScopeLevel1 = "MyScopeLevel1"
103+
$DiscoveryScopeLevel2 = "MyScopeLevel2"
104+
105+
# First, prepare local DiscoveryScope object, which can be used to
106+
# both create/update Workspace
107+
$scope1 = New-AzStorageDiscoveryScopeObject -DisplayName "test1" `
108+
-ResourceType "Microsoft.Storage/storageAccounts" `
109+
-TagKeysOnly "e2etest1" -Tag @{"tag1" = "value1"; "tag2" = "value2" }
110+
$scope2 = New-AzStorageDiscoveryScopeObject -DisplayName "test2" `
111+
-ResourceType "Microsoft.Storage/storageAccounts" `
112+
-TagKeysOnly "e2etest2" -Tag @{"tag3" = "value3" }
113+
114+
# CVreate the discovery workspace
115+
New-AzStorageDiscoveryWorkspace -Name $workSpaceName -ResourceGroupName $resGroupName `
116+
-Location $location -Description 123 -WorkspaceRoot $DiscoveryScopeLevel1 `
117+
-Sku Standard -Scope $scope1 # -debug
118+
119+
```
120+
121+
---
122+
123+
> [!NOTE]
124+
> It can take up to 24 hours after scope creation for metrics to begin appearing in reports.

‎articles/storage-discovery/deployment-planning.md

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
---
2+
title: Planning for an Azure Storage Discovery deployment
3+
titleSuffix: Azure Storage Discovery
4+
description: Considerations and best-practices for deploying the Azure Storage Discovery service
5+
author: fauhse
6+
ms.service: azure-storage-mover
7+
ms.topic: overview
8+
ms.date: 08/01/2025
9+
ms.author: fauhse
10+
---
11+
12+
# Planning for an Azure Storage Discovery deployment
13+
14+
Before you continue, be sure to get an [overview of the Storage Discovery service](overview.md) and the value it can provide to you.
15+
16+
## Make sure the service works for your scenario
17+
18+
Azure Storage Discovery currently surfaces insights for resources of the Azure Blob Storage service.
19+
Coverage also includes storage accounts configured with the [hierarchical namespace feature](../storage/blobs/data-lake-storage-namespace.md) to enable [Azure Data Lake Storage](../storage/blobs/data-lake-storage-introduction.md).
20+
21+
Discovery currently doesn't work for [Azure Files](../storage/files/storage-files-introduction.md) or other storage types.
22+
23+
## Deployment basics
24+
25+
Your Azure Storage resources (like storage accounts) experience no transactions or performance impact when analyzing them with Azure Storage Discovery.
26+
27+
Deploying the service means deploying and configuring a *Storage Discovery workspace resource* into a resource group in one of your subscriptions.
28+
The Discovery service works to compute and store insights about your Azure Blob Storage estate. These computed insights are stored in the region of the workspace you created. Other than the Storage Discovery workspace, no other infrastructure needs to be deployed.
29+
30+
The workspace can be configured to aggregate insights across any subscriptions in the Azure tenant the workspace is deployed in.
31+
To generate insights about Azure Storage resources, such as storage accounts, you need to be a member of the RBAC (Role Based Access Control) Reader role for every storage resource.
32+
33+
> [!IMPORTANT]
34+
> To get accurate insights, you need to configure your workspace for resources you have permissions to.<br> The [permissions section](#permissions) in this article has important details you should review.
35+
36+
## Getting your subscription ready
37+
38+
You need to choose a subscription governed by the same Azure tenant as the Azure Storage resources (such as storage accounts) you want to receive insights for. When you decided on an Azure subscription and resource group for your Storage Discovery workspace, review the following sections to ensure your subscription is prepared.
39+
40+
### Resource provider namespace
41+
42+
Before a service is used for the first time in an Azure subscription, its resource provider namespace must be registered once with the chosen subscription. Azure Storage Discovery has the same requirement. A subscription *Owner* or *Contributor* can perform this action. Performing this registration action before the actual Storage Discovery workspace deployment enables admins with fewer rights to deploy and use the Storage Discovery service.
43+
44+
> [!IMPORTANT]
45+
> The subscription must be registered with the resource provider namespaces *Microsoft.StorageDiscovery*.
46+
47+
Register a resource provider:
48+
49+
- [via the Azure portal](../azure-resource-manager/management/resource-providers-and-types.md#azure-portal)
50+
- [via Azure PowerShell](../azure-resource-manager/management/resource-providers-and-types.md#azure-powershell)
51+
- [via Azure CLI](../azure-resource-manager/management/resource-providers-and-types.md#azure-cli)
52+
53+
> [!TIP]
54+
> When you deploy a Storage Discovery workspace as a subscription *Owner* or *Contributor* through the Azure portal, your subscription is automatically registered with this resource provider namespace. You only need to perform the registration manually when using Azure PowerShell or CLI.
55+
56+
Once a subscription is enabled for this resource provider namespace, it remains enabled until manually unregistered. You can even delete the last Storage Discovery workspace and your subscription still remains enabled. Subsequent Storage Discovery workspace deployments then require reduced permissions from an admin. The following section contains a breakdown of different management scenarios and their required permissions.
57+
58+
### Decide on the number of workspaces you need
59+
60+
A Storage Discovery workspace needs to be configured with *scopes*. The management components article shares [details about workspace scopes](management-components.md).
61+
Scopes are logical groups of storage resources. For instance, a scope can refer to all the storage resources of a specific workload or department that you want to get insights for separately.
62+
63+
Since you can only configure a limited number of scopes in a workspace, you may need more than one workspace to cover your insights reporting needs.
64+
65+
If a workspace is to be used for higher-level insights, you can create one with one scope for your entire Azure Storage estate and then add scopes for each department.
66+
If a workspace is designated to provide insights for specific workloads, then you can create a workspace containing a scope for each workload.
67+
68+
> [!IMPORTANT]
69+
> During the Azure Storage Discovery preview period, the Discovery service covers only storage accounts located in select regions. <br>The [Understand region limitations](#understand-region-limitations) section in this article has details.
70+
71+
### Review your Azure resource tags
72+
73+
You can select which storage resources are included in a [workspace scope](management-components.md) by first selecting specific subscriptions or resource groups, and then filtering the storage resources within them by [Azure resource tags](../azure-resource-manager/management/tag-resources.md).
74+
It's important that you familiarize yourself with the available resource tags on your storage resources. Ensure they're consistently applied and then catalog them for building the scopes in your workspace. Plan the scopes you need in order to have insights available per department, workload, or other grouping you have a use for.
75+
76+
## Select an Azure region for your deployment
77+
78+
When you deploy a Storage Discovery workspace, you need to choose a region. The region you select determines where the computed insights about your Azure Storage resources are stored. You can still capture insights for Azure Storage resources that are located in other regions. A general best practice is to choose the region for your workspace according to metadata residency requirements that apply to you and in closer proximity to your location. Visualizing your insights from a workspace closer to you can have a slight performance advantage.
79+
80+
Storage Discovery workspaces can be created in the following regions. More regions are added throughout the preview period.
81+
82+
[!INCLUDE [control-plane-regions](includes/control-plane-regions.md)]
83+
84+
## Understand region limitations
85+
86+
While a Storage Discovery workspace can cover storage accounts from other subscriptions and resource groups, and even other regions, there's an important region limitation you need to be aware of for a successful Storage Discovery deployment.
87+
88+
The Discovery service covers only storage accounts located in the following regions:
89+
<br><br>
90+
[!INCLUDE [data-plane-regions](includes/data-plane-regions.md)]
91+
<br>
92+
93+
> [!WARNING]
94+
> The Discovery service currently can't consider storage accounts located in regions not included in the previously listed locations. Including storage accounts from unsupported regions in a scope can lead to an incomplete set of insights. A short-term limitation of the preview period.
95+
96+
## Permissions
97+
98+
Permissions are managed via the familiar Azure [Role Based Access Control](../role-based-access-control/overview.md) (RBAC).
99+
This sections covers:
100+
* Permission to the storage resources you want to get insights for from the Discovery service.
101+
* Permission considerations for a workspace resource.
102+
103+
### Permissions to your storage resources
104+
105+
During the creation of a Storage Discovery workspace, you configure the [workspace root](management-components.md). The [management components](management-components.md) article provides more details for this configuration.
106+
In the workspace root, you list at least one and at most 100 Azure resources of different types:
107+
- subscriptions
108+
- resource groups
109+
- storage accounts
110+
111+
The person deploying the workspace must have at least the RBAC role assignment *Reader* for every resource in the workspace root.
112+
*Reader* is the minimum permission level required. *Contributor* and *Owner* are also supported.
113+
114+
It's possible that you see a subscription listed in the Azure portal, for which you don't have this direct *Reader* role assignment. When you can see a resource you don't have a role assignment to, then most likely you have permissions to a sub resource in this subscription. In this case, the existence of this "parent" was revealed to you, but you have no rights on the subscription resource itself. This example can be extended to resource groups as well. Missing a *Reader* or higher direct role assignment disqualifies an Azure resource from being the basis (root) of a workspace.
115+
116+
Permissions are only validated when a workspace is created. Any change to permissions of the Azure account that created the workspace, including its deletion, has no effect on the workspace or the Discovery service functionality.
117+
118+
### Permission considerations for a workspace resource
119+
120+
The Azure Storage Discovery workspace stores the computed insights for your storage estate. You can access reports in the Azure portal, or use these insights via the Azure Copilot. In order to access insights stored in a workspace, a user must have at least the RBAC role *Reader* on the workspace. *Contributor* and *Owner* role assignments also work. You can provide insights-access to another user by assigning them one of the three previously listed roles on the workspace.
121+
122+
123+
|Scenario |Minimal RBAC role assignments needed |
124+
|:--------|--------------------------------------------------------------------------------:|
125+
|Register a resource provider namespace with a subscription| Subscription: `Contributor` |
126+
|Deploy a Storage Discovery workspace <br>*([Resource provider namespace already registered](#resource-provider-namespace))*| Resource group: `Contributor` |
127+
|Share the Storage Discovery insights with another person | Storage Discovery workspace: `Reader`|
128+
|Enable a person to make changes to the workspace configuration| Storage Discovery workspace: `Contributor`|
129+
|Enable a person to share these insights with others | Storage Discovery workspace: `Owner`|
130+
131+
> [!CAUTION]
132+
> When you provide other users access to a workspace, you're disclosing all insights of the workspace. Other users might not be privileged to know about the existence of the Azure resources or insights about the data they store. Providing access to a workspace doesn't provide access to an individual storage account, resource group, or subscription. Individual resources remain governed by RBAC.
133+
134+
## Next steps
135+
136+
- [Review the Storage Discovery management components](management-components.md)
137+
- [Understand Storage Discovery pricing](pricing.md)
138+
- [Create a Storage Discovery workspace](create-workspace.md)

0 commit comments

Comments
 (0)