You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/data-share/concepts-roles-permissions.md
+50-12Lines changed: 50 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,26 +15,64 @@ This article describes the roles required to share data using Azure Data Share P
15
15
16
16
## Roles and requirements
17
17
18
-
To share or receive data using Azure Data Share, the user account that you use to sign in to Azure must be able to grant Data Share permissions to the Storage account that you are sharing data from or receiving data in to. Typically this is a permission that exists in the **owner** role, or a custom role with Microsoft.Authorization/role assignments/write permission assigned.
18
+
Azure Data Share uses Managed Identities for Azure Services (previously known as MSIs) to authenticate to underlying storage accounts in order to be able to read data to be shared by a data provider, as well as receive data shared as a data consumer. As a result, there is no exchange of credentials between the data provider and the data consumer.
19
19
20
-
To share or receive data from or to an Azure Storage account, you must be an owner of the storage account. Even if you have created the Storage account, this does not automatically grant you ownership of the Storage account. To add yourself in to the owner role of your Azure Storage account, follow these steps.
20
+
The Managed Service Identity needs to be granted access to the underlying storage accounts. The Azure Data Share service uses the Azure Data Share resource's Managed Service Identity to read and write data. The user of Azure Data Share needs the ability to create a role assignment for the Managed Service Identity to the storage account that they are sharing data from/to. Permission to create role assignments exists in the **owner** role, User Access Administrator role, or a custom role with Microsoft.Authorization/role assignments/write permission assigned.
21
21
22
-
1. Navigate to Storage account in Azure portal
23
-
1. Select **Access control (IAM)**
24
-
1. Click **Add**
25
-
1. Add yourself in as owner
22
+
If you are not an owner of the storage account in question, and you are unable to create a role assignment for the Azure Data Share resource's Managed Identity yourself, you can request an Azure Administrator to create a role assignment on your behalf.
26
23
27
-
To view the permissions that you have in the subscription, in the Azure portal, select your username in the upper-right corner, and then select **Permissions**. If you have access to multiple subscriptions, select the appropriate subscription.
24
+
Below is a summary of the roles assigned to Data Share resource-Managed Identity:
|Azure Blob Storage| Storage Blob Data Reader | Storage Blob Data Contributor
30
+
|Azure Data Lake Gen1 | Owner | Not Supported
31
+
|Azure Data Lake Gen2 | Storage Blob Data Reader | Storage Blob Data Contributor
32
+
|
33
+
### Data Providers
34
+
To add a dataset to an Azure Data Share, the data providers data share resource-managed identity needs to be added to the Storage Blob Data Reader role. This is done automatically by the Azure Data Share service if the user is adding datasets via Azure and is an owner of the storage account, or is a member of a custom role that has the Microsoft.Authorization/role assignments/write permission assigned.
35
+
36
+
Alternatively, the user can have an Azure Administrator add the data share resource-managed identity to the Storage Blob Data Reader role manually. Creating this role assignment manually by the Administrator will void having to be an owner of the Storage account or have a custom role assignment. This applies to data being shared from Azure Storage or Azure Data Lake Gen2.
37
+
38
+
If sharing data from Azure Data Lake Gen1, the role assignment must be made to the Owner role.
39
+
40
+
To create a role assignment for the Data Share resource's Managed Identity, follow the below steps:
41
+
42
+
1. Navigate to the Storage account.
43
+
1. Select **Access Control (IAM)**.
44
+
1. Select **Add a role assignment**.
45
+
1. Under *Role*, select *Storage Blob Data Reader*.
46
+
1. Under *Select*, type in the name of your Azure Data Share account.
47
+
1. Click *Save*.
48
+
49
+
### Data Consumers
50
+
To receive data, the data consumers data share resource-managed identity needs to be added to the Storage Blob Data Contributor role. This role is required to enable the Azure Data Share service to be able to write to the storage account. This is done automatically by the Azure Data Share service if the user is adding datasets via Azure and is an owner of the storage account, or is a member of a custom role which has the Microsoft.Authorization/role assignments/write permission assigned.
51
+
52
+
Alternatively, the user can have an Azure Administrator add the data share resource-managed identity to the Storage Blob Data Contributor role manually. Creating this role assignment manually by the Administrator will void having to be an owner of the Storage account or have a custom role assignment. Note that this applies to data being shared to Azure Storage or Azure Data Lake Gen2. Receiving data to Azure Data Lake Gen1 is not supported.
53
+
54
+
To create a role assignment for the Data Share resource's Managed Identity manually, follow the below steps:
55
+
56
+
1. Navigate to the Storage account.
57
+
1. Select **Access Control (IAM)**.
58
+
1. Select **Add a role assignment**.
59
+
1. Under *Role*, select *Storage Blob Data Contributor*.
60
+
1. Under *Select*, type in the name of your Azure Data Share account.
61
+
1. Click *Save*.
62
+
63
+
If you are sharing data using our REST APIs, you will need to create these role assignments manually by adding the data share account in to the appropriate roles.
64
+
65
+
To learn more about how to add a role assignment, refer to [this documentation,](https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal#add-a-role-assignment) which outlines how to add a role assignment to an Azure resource.
28
66
29
67
## Resource Provider registration
30
68
31
69
When accepting an Azure Data Share invitation, you will need to manually register the Microsoft.DataShare resource provider in to your subscription. Follow these steps to register the Microsoft.DataShare resource provider into your Azure Subscription.
32
70
33
-
1. In the Azure portal, navigate to **Subscriptions**
34
-
1. Select the subscription that you're using for Azure Data Share
35
-
1. Click on **Resource Providers**
36
-
1. Search for Microsoft.DataShare
37
-
1. Click **Register**
71
+
1. In the Azure portal, navigate to **Subscriptions**.
72
+
1. Select the subscription that you're using for Azure Data Share.
Copy file name to clipboardExpand all lines: articles/data-share/scripts/powershell/create-view-trigger-powershell.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -42,8 +42,8 @@ This script uses the following commands:
42
42
43
43
| Command | Notes |
44
44
|---|---|
45
-
|[New-AzDataShareTrigger](/powershell/module/az.resources/new-azdatasharetrigger)| Create a share snapshot trigger. |
46
-
|[Get-AzDataShareTrigger](/powershell/module/az.resources/get-azdatasharetrigger)| Gets synchronization settings of a share synchronization. |
45
+
|[New-AzDataShareTrigger](/powershell/module/az.datashare/new-azdatasharetrigger?view=azps-2.6.0)| Create a share snapshot trigger. |
46
+
|[Get-AzDataShareTrigger](/powershell/module/az.datashare/get-azdatasharesynchronizationsetting?view=azps-2.6.0)| Gets synchronization settings of a share synchronization. |
Copy file name to clipboardExpand all lines: articles/data-share/scripts/powershell/monitor-usage-powershell.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,8 +39,8 @@ This script uses the following commands:
39
39
40
40
| Command | Notes |
41
41
|---|---|
42
-
|[Get-AzDataShareSynchronization](/powershell/module/az.resources/get-azdatasharesynchronizationdetails)| List synchronizations on a share. |
43
-
|[Get-AzDataShareSynchronizationDetails](/powershell/module/az.resources/get-azdatasharesynchronizationdetails)| Gets synchronization details of a share synchronization. |
42
+
|[Get-AzDataShareSynchronization](/powershell/module/az.datashare/get-azdatasharesynchronization?view=azps-2.6.0)| List synchronizations on a share. |
43
+
|[Get-AzDataShareSynchronizationDetails](/powershell/module/az.datashare/get-azdatasharesynchronizationdetail?view=azps-2.6.0)| Gets synchronization details of a share synchronization. |
Copy file name to clipboardExpand all lines: articles/data-share/scripts/powershell/set-view-synchronizations-powershell.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -43,8 +43,8 @@ This script uses the following commands:
43
43
44
44
| Command | Notes |
45
45
|---|---|
46
-
|[New-AzDataShareSynchronizationSetting](/powershell/module/az.resources/new-azdatasharesynchronizationsettings)| Create a share synchronization. |
47
-
|[Get-AzDataShareSynchronizationSetting](/powershell/module/az.resources/get-azdatasharesynchronizationsetting)| Gets synchronization settings of a share synchronization. |
46
+
|[New-AzDataShareSynchronizationSetting](/powershell/module/az.datashare/new-azdatasharesynchronizationsetting?view=azps-2.6.0)| Create a share synchronization. |
47
+
|[Get-AzDataShareSynchronizationSetting](/powershell/module/az.datashare/get-azdatasharesynchronizationsetting?view=azps-2.6.0)| Gets synchronization settings of a share synchronization. |
0 commit comments