Skip to content

Commit 3844b3e

Browse files
whhenderwhhender
committed
Freshness updates
1 parent b77aa07 commit 3844b3e

File tree

1 file changed

+132
-131
lines changed

1 file changed

+132
-131
lines changed

‎articles/synapse-analytics/synapse-service-identity.md

Lines changed: 132 additions & 131 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
---
2-
title: Managed identity
2+
title: Managed service identity for Azure Synapse Analytics
33
titleSuffix: Azure Synapse
4-
description: Learn about using managed identities in Azure Synapse.
4+
description: Learn about using and deploying managed identities for Azure Synapse Analytics.
55
author: meenalsri
66
ms.service: azure-synapse-analytics
77
ms.subservice: security
8-
ms.topic: conceptual
9-
ms.date: 01/27/2022
8+
ms.topic: how-to
9+
ms.date: 11/11/2024
1010
ms.author: mesrivas
1111
ms.custom: devx-track-azurepowershell, synapse, subject-rbac-steps
1212
---
1313

14-
# Managed identity for Azure Synapse
14+
# Managed identities for Azure Synapse Analytics
1515

1616
This article helps you understand managed identity (formerly known as Managed Service Identity/MSI) and how it works in Azure Synapse.
1717

@@ -21,10 +21,10 @@ This article helps you understand managed identity (formerly known as Managed Se
2121

2222
Managed identities eliminate the need to manage credentials. Managed identities provide an identity for the service instance when connecting to resources that support Microsoft Entra authentication. For example, the service can use a managed identity to access resources like [Azure Key Vault](/azure/key-vault/general/overview), where data admins can securely store credentials or access storage accounts. The service uses the managed identity to obtain Microsoft Entra tokens.
2323

24-
There are two types of supported managed identities:
24+
There are two types of supported managed identities:
2525

2626
- **System-assigned:** You can enable a managed identity directly on a service instance. When you allow a system-assigned managed identity during the creation of the service, an identity is created in Microsoft Entra tied to that service instance's lifecycle. By design, only that Azure resource can use this identity to request tokens from Microsoft Entra ID. So when the resource is deleted, Azure automatically deletes the identity for you. Azure Synapse Analytics requires that a system-assigned managed identity must be created along with the Synapse workspace.
27-
- **User-assigned:** You may also create a managed identity as a standalone Azure resource. You can [create a user-assigned managed identity](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md) and assign it to one or more instances of a Synapse workspace. In user-assigned managed identities, the identity is managed separately from the resources that use it.
27+
- **User-assigned:** You can also create a managed identity as a standalone Azure resource. You can [create a user-assigned managed identity](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md) and assign it to one or more instances of a Synapse workspace. In user-assigned managed identities, the identity is managed separately from the resources that use it.
2828

2929
Managed identity provides the below benefits:
3030

@@ -35,7 +35,127 @@ Managed identity provides the below benefits:
3535
## System-assigned managed identity
3636

3737
>[!NOTE]
38-
> System-assigned managed identity is also referred to as 'Managed identity' elsewhere in the documentation and in the Synapse Studio UI for backward compatibility purpose. We will explicitly mention 'User-assigned managed identity' when referring to it.
38+
> System-assigned managed identity is also referred to as 'Managed identity' elsewhere in the documentation and in the Synapse Studio UI for backward compatibility purpose. We will explicitly mention 'User-assigned managed identity' when referring to it.
39+
40+
### Retrieve system-assigned managed identity using Azure portal
41+
42+
You can find the managed identity information from Azure portal -> your Synapse workspace -> Properties.
43+
44+
:::image type="content" source="../data-factory/media/data-factory-service-identity/system-managed-identity-in-portal-synapse.png" alt-text="Shows the Azure portal with the system-managed identity object ID for a Synapse workspace." lightbox="../data-factory/media/data-factory-service-identity/system-managed-identity-in-portal-synapse.png":::
45+
46+
- Managed Identity Object ID
47+
48+
The managed identity information will also show up when you create linked service, which supports managed identity authentication, like Azure Blob, Azure Data Lake Storage, Azure Key Vault, etc.
49+
50+
To grant permissions, follow these steps. For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.yml).
51+
52+
1. Select **Access control (IAM)**.
53+
54+
1. Select **Add** > **Add role assignment**.
55+
56+
:::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::
57+
58+
1. On the **Members** tab, select **Managed identity**, and then select **Select members**.
59+
60+
1. Select your Azure subscription.
61+
62+
1. Under **System-assigned managed identity**, select **Synapse workspace**, and then select a workspace. You can also use the object ID or workspace name (as the managed-identity name) to find this identity. To get the managed identity's application ID, use PowerShell.
63+
64+
1. On the **Review + assign** tab, select **Review + assign** to assign the role.
65+
66+
### Retrieve system-assigned managed identity using PowerShell
67+
68+
The managed identity principal ID and tenant ID will be returned when you get a specific service instance as follows. Use the **PrincipalId** to grant access:
69+
70+
```powershell
71+
PS C:\> (Get-AzSynapseWorkspace -ResourceGroupName <resourceGroupName> -Name <workspaceName>).Identity
72+
73+
IdentityType PrincipalId TenantId
74+
------------ ----------- --------
75+
SystemAssigned aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb aaaabbbb-0000-cccc-1111-dddd2222eeee
76+
```
77+
78+
You can get the application ID by copying above principal ID, then running below Microsoft Entra ID command with principal ID as parameter.
79+
80+
```powershell
81+
PS C:\> Get-AzADServicePrincipal -ObjectId aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb
82+
83+
ServicePrincipalNames : {00001111-aaaa-2222-bbbb-3333cccc4444, https://identity.azure.net/P86P8g6nt1QxfPJx22om8MOooMf/Ag0Qf/nnREppHkU=}
84+
ApplicationId : 00001111-aaaa-2222-bbbb-3333cccc4444
85+
DisplayName : <workspaceName>
86+
Id : aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb
87+
Type : ServicePrincipal
88+
```
89+
90+
### Retrieve managed identity using REST API
91+
92+
The managed identity principal ID and tenant ID will be returned when you get a specific service instance as follows.
93+
94+
Call below API in the request:
95+
96+
```
97+
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}?api-version=2018-06-01
98+
```
99+
100+
**Response**: You'll get response like shown in below example. The "identity" section is populated accordingly.
101+
102+
```json
103+
{
104+
"properties": {
105+
"defaultDataLakeStorage": {
106+
"accountUrl": "https://exampledatalakeaccount.dfs.core.windows.net",
107+
"filesystem": "examplefilesystem"
108+
},
109+
"encryption": {
110+
"doubleEncryptionEnabled": false
111+
},
112+
"provisioningState": "Succeeded",
113+
"connectivityEndpoints": {
114+
"web": "https://web.azuresynapse.net?workspace=%2fsubscriptions%2{subscriptionId}%2fresourceGroups%2f{resourceGroupName}%2fproviders%2fMicrosoft.Synapse%2fworkspaces%2f{workspaceName}",
115+
"dev": "https://{workspaceName}.dev.azuresynapse.net",
116+
"sqlOnDemand": "{workspaceName}-ondemand.sql.azuresynapse.net",
117+
"sql": "{workspaceName}.sql.azuresynapse.net"
118+
},
119+
"managedResourceGroupName": "synapseworkspace-managedrg-f77f7cf2-XXXX-XXXX-XXXX-c4cb7ac3cf4f",
120+
"sqlAdministratorLogin": "sqladminuser",
121+
"privateEndpointConnections": [],
122+
"workspaceUID": "e56f5773-XXXX-XXXX-XXXX-a0dc107af9ea",
123+
"extraProperties": {
124+
"WorkspaceType": "Normal",
125+
"IsScopeEnabled": false
126+
},
127+
"publicNetworkAccess": "Enabled",
128+
"cspWorkspaceAdminProperties": {
129+
"initialWorkspaceAdminObjectId": "3746a407-XXXX-XXXX-XXXX-842b6cf1fbcc"
130+
},
131+
"trustedServiceBypassEnabled": false
132+
},
133+
"type": "Microsoft.Synapse/workspaces",
134+
"id": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}",
135+
"location": "eastus",
136+
"name": "{workspaceName}",
137+
"identity": {
138+
"type": "SystemAssigned",
139+
"tenantId": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
140+
"principalId": "aaaaaaaa-bbbb-cccc-1111-222222222222"
141+
},
142+
"tags": {}
143+
}
144+
```
145+
146+
> [!TIP]
147+
> To retrieve the managed identity from an ARM template, add an **outputs** section in the ARM JSON:
148+
149+
```json
150+
{
151+
"outputs":{
152+
"managedIdentityObjectId":{
153+
"type":"string",
154+
"value":"[reference(resourceId('Microsoft.Synapse/workspaces', parameters('<workspaceName>')), '2018-06-01', 'Full').identity.principalId]"
155+
}
156+
}
157+
}
158+
```
39159

40160
### <a name="generate-managed-identity"></a> Generate system-assigned managed identity
41161

@@ -63,6 +183,7 @@ If you find your service instance doesn't have a managed identity associated fol
63183
Call **New-AzSynapseWorkspace** command, then you see "Identity" fields being newly generated:
64184

65185
```powershell
186+
PS C:\> $password = ConvertTo-SecureString -String "****" -AsPlainText -Force
66187
PS C:\> $creds = New-Object System.Management.Automation.PSCredential ("ContosoUser", $password)
67188
PS C:\> New-AzSynapseWorkspace -ResourceGroupName <resourceGroupName> -Name <workspaceName> -Location <region> -DefaultDataLakeStorageAccountName <storageAccountName> -DefaultDataLakeStorageFileSystem <fileSystemName> -SqlAdministratorLoginCredential $creds
68189
@@ -182,127 +303,7 @@ You can retrieve the managed identity from Azure portal or programmatically. The
182303
>[!TIP]
183304
> If you don't see the managed identity, [generate managed identity](#generate-managed-identity) by updating your service instance.
184305
185-
#### Retrieve system-assigned managed identity using Azure portal
186-
187-
You can find the managed identity information from Azure portal -> your Synapse workspace -> Properties.
188-
189-
:::image type="content" source="../data-factory/media/data-factory-service-identity/system-managed-identity-in-portal-synapse.png" alt-text="Shows the Azure portal with the system-managed identity object ID for a Synapse workspace." lightbox="../data-factory/media/data-factory-service-identity/system-managed-identity-in-portal-synapse.png":::
190-
191-
- Managed Identity Object ID
192-
193-
The managed identity information will also show up when you create linked service, which supports managed identity authentication, like Azure Blob, Azure Data Lake Storage, Azure Key Vault, etc.
194-
195-
To grant permissions, follow these steps. For detailed steps, see [Assign Azure roles using the Azure portal](../role-based-access-control/role-assignments-portal.yml).
196-
197-
1. Select **Access control (IAM)**.
198-
199-
1. Select **Add** > **Add role assignment**.
200-
201-
:::image type="content" source="~/reusable-content/ce-skilling/azure/media/role-based-access-control/add-role-assignment-menu-generic.png" alt-text="Screenshot that shows Access control (IAM) page with Add role assignment menu open.":::
202-
203-
1. On the **Members** tab, select **Managed identity**, and then select **Select members**.
204-
205-
1. Select your Azure subscription.
206-
207-
1. Under **System-assigned managed identity**, select **Synapse workspace**, and then select a workspace. You can also use the object ID or workspace name (as the managed-identity name) to find this identity. To get the managed identity's application ID, use PowerShell.
208-
209-
1. On the **Review + assign** tab, select **Review + assign** to assign the role.
210-
211-
#### Retrieve system-assigned managed identity using PowerShell
212-
213-
The managed identity principal ID and tenant ID will be returned when you get a specific service instance as follows. Use the **PrincipalId** to grant access:
214-
215-
```powershell
216-
PS C:\> (Get-AzSynapseWorkspace -ResourceGroupName <resourceGroupName> -Name <workspaceName>).Identity
217-
218-
IdentityType PrincipalId TenantId
219-
------------ ----------- --------
220-
SystemAssigned aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb aaaabbbb-0000-cccc-1111-dddd2222eeee
221-
```
222-
223-
You can get the application ID by copying above principal ID, then running below Microsoft Entra ID command with principal ID as parameter.
224-
225-
```powershell
226-
PS C:\> Get-AzADServicePrincipal -ObjectId aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb
227-
228-
ServicePrincipalNames : {00001111-aaaa-2222-bbbb-3333cccc4444, https://identity.azure.net/P86P8g6nt1QxfPJx22om8MOooMf/Ag0Qf/nnREppHkU=}
229-
ApplicationId : 00001111-aaaa-2222-bbbb-3333cccc4444
230-
DisplayName : <workspaceName>
231-
Id : aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb
232-
Type : ServicePrincipal
233-
```
234-
235-
#### Retrieve managed identity using REST API
236-
237-
The managed identity principal ID and tenant ID will be returned when you get a specific service instance as follows.
238-
239-
Call below API in the request:
240-
241-
```
242-
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}?api-version=2018-06-01
243-
```
244-
245-
**Response**: You will get response like shown in below example. The "identity" section is populated accordingly.
246-
247-
```json
248-
{
249-
"properties": {
250-
"defaultDataLakeStorage": {
251-
"accountUrl": "https://exampledatalakeaccount.dfs.core.windows.net",
252-
"filesystem": "examplefilesystem"
253-
},
254-
"encryption": {
255-
"doubleEncryptionEnabled": false
256-
},
257-
"provisioningState": "Succeeded",
258-
"connectivityEndpoints": {
259-
"web": "https://web.azuresynapse.net?workspace=%2fsubscriptions%2{subscriptionId}%2fresourceGroups%2f{resourceGroupName}%2fproviders%2fMicrosoft.Synapse%2fworkspaces%2f{workspaceName}",
260-
"dev": "https://{workspaceName}.dev.azuresynapse.net",
261-
"sqlOnDemand": "{workspaceName}-ondemand.sql.azuresynapse.net",
262-
"sql": "{workspaceName}.sql.azuresynapse.net"
263-
},
264-
"managedResourceGroupName": "synapseworkspace-managedrg-f77f7cf2-XXXX-XXXX-XXXX-c4cb7ac3cf4f",
265-
"sqlAdministratorLogin": "sqladminuser",
266-
"privateEndpointConnections": [],
267-
"workspaceUID": "e56f5773-XXXX-XXXX-XXXX-a0dc107af9ea",
268-
"extraProperties": {
269-
"WorkspaceType": "Normal",
270-
"IsScopeEnabled": false
271-
},
272-
"publicNetworkAccess": "Enabled",
273-
"cspWorkspaceAdminProperties": {
274-
"initialWorkspaceAdminObjectId": "3746a407-XXXX-XXXX-XXXX-842b6cf1fbcc"
275-
},
276-
"trustedServiceBypassEnabled": false
277-
},
278-
"type": "Microsoft.Synapse/workspaces",
279-
"id": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}",
280-
"location": "eastus",
281-
"name": "{workspaceName}",
282-
"identity": {
283-
"type": "SystemAssigned",
284-
"tenantId": "aaaabbbb-0000-cccc-1111-dddd2222eeee",
285-
"principalId": "aaaaaaaa-bbbb-cccc-1111-222222222222"
286-
},
287-
"tags": {}
288-
}
289-
```
290-
291-
> [!TIP]
292-
> To retrieve the managed identity from an ARM template, add an **outputs** section in the ARM JSON:
293-
294-
```json
295-
{
296-
"outputs":{
297-
"managedIdentityObjectId":{
298-
"type":"string",
299-
"value":"[reference(resourceId('Microsoft.Synapse/workspaces', parameters('<workspaceName>')), '2018-06-01', 'Full').identity.principalId]"
300-
}
301-
}
302-
}
303-
```
304-
305-
### Execute Azure Synapse Spark Notebooks with system assigned managed identity
306+
## Execute Azure Synapse Spark Notebooks with system assigned managed identity
306307

307308
You can easily execute Synapse Spark Notebooks with the system assigned managed identity (or workspace managed identity) by enabling *Run as managed identity* from the *Configure session* menu. To execute Spark Notebooks with workspace managed identity, users need to have following RBAC roles:
308309
- Synapse Compute Operator on the workspace or selected Spark pool
@@ -319,7 +320,7 @@ You can easily execute Synapse Spark Notebooks with the system assigned managed
319320
320321
## User-assigned managed identity
321322

322-
You can create, delete, manage user-assigned managed identities in Microsoft Entra ID. For more details refer to [Create, list, delete, or assign a role to a user-assigned managed identity using the Azure portal](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md).
323+
You can create, delete, manage user-assigned managed identities in Microsoft Entra ID. For more information, see [Create, list, delete, or assign a role to a user-assigned managed identity using the Azure portal](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md).
323324

324325
In order to use a user-assigned managed identity, you must first [create credentials](../data-factory/credentials.md) in your service instance for the UAMI.
325326

@@ -329,7 +330,7 @@ In order to use a user-assigned managed identity, you must first [create credent
329330
## Next steps
330331
- [Create credentials](../data-factory/credentials.md).
331332

332-
See the following topics that introduce when and how to use managed identity:
333+
See the following articles that introduce when and how to use managed identity:
333334

334335
- [Store credential in Azure Key Vault](../data-factory/store-credentials-in-key-vault.md).
335336
- [Copy data from/to Azure Data Lake Store using managed identities for Azure resources authentication](../data-factory/connector-azure-data-lake-store.md).

0 commit comments

Comments
 (0)