You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In this tutorial, learn how to programmatically fetch access policies that were created in Microsoft Purview. This can be used to troubleshoot the communication of policies between Microsoft Purview, where policies are created and updated and the data sources on which these policies are enforced.
16
+
In this tutorial, learn how to programmatically fetch access policies that were created in Microsoft Purview. With this you can troubleshoot the communication of policies between Microsoft Purview, where policies are created and updated and the data sources on which these policies are enforced.
17
17
This guide will use Arc-enabled SQL Server as an example of data source.
18
18
19
19
To get the necessary context about Microsoft Purview policies, see concept guides listed in [next-steps](#next-steps).
@@ -28,7 +28,7 @@ To get the necessary context about Microsoft Purview policies, see concept guide
28
28
## Overview
29
29
There are two ways to fetch access policies from Microsoft Purview
30
30
- Full pull: Provides a complete set of policies for a particular data resource scope.
31
-
- Delta pull: Provides an incremental view of policies, that is, what has changed since the last pull request, whether that one was a full pull or a delta pull.
31
+
- Delta pull: Provides an incremental view of policies, that is, what has changed since the last pull request, whether that one was a full pull or a delta pull. A full pull is required prior to the first delta pull.
32
32
33
33
Microsoft Purview policy model is described using [JSON syntax](https://datatracker.ietf.org/doc/html/rfc8259)
34
34
@@ -49,18 +49,19 @@ GET {{endpoint}}/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupNam
|404|Not found|Error|The request path is invalid or not registered|Error data|
55
55
|500|Internal server error|Error|Backend service unavailable|Error data|
56
56
|503|Backend service unavailable|Error|Backend service unavailable|Error data|
57
57
58
58
### Example for Arc-enabled SQL Server
59
59
60
60
##### Example parameters:
61
+
- Microsoft Purview account = relecloud-pv
61
62
- resourceProvider = Microsoft.AzureArcData
62
63
- resourceType = sqlServerInstances
63
-
-apiVersion = 2021-01-01-preview
64
+
-resourceName = vm-finance
64
65
65
66
##### Example request:
66
67
```
@@ -69,6 +70,8 @@ GET https://relecloud-pv.purview.azure.com/pds/subscriptions/b285630c-8185-456b-
69
70
70
71
##### Example response:
71
72
73
+
`200 OK`
74
+
72
75
```json
73
76
{
74
77
"count": 2,
@@ -95,30 +98,132 @@ GET https://relecloud-pv.purview.azure.com/pds/subscriptions/b285630c-8185-456b-
95
98
}
96
99
```
97
100
101
+
## Delta pull
102
+
103
+
### Request
104
+
To fetch policies via full pull, send a `GET` request to /policyEvents as follows:
105
+
106
+
```
107
+
GET {{endpoint}}/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProvider}/{resourceType}/{resourceName}/policyEvents?api-version={apiVersion}&syncToken={syncToken}
108
+
```
109
+
110
+
Provide the syncToken you got from the prior pull in any successive delta pulls.
There are 3 top-level policy constructs used within the full pull (/policyElements) and delta pull (/policyEvents) requests: PolicySet, Policy and AttributeRule.
100
175
101
176
### PolicySet
102
177
103
178
PolicySet associates Policy to a resource scope. Purview policy decision compute starts with a list of PolicySets. PolicySet evaluation triggers evaluation of Policy referenced in the PolicySet.
104
179
180
+
|member|value|type|cardinality|description|
181
+
|------|-----|----|-----------|-----------|
182
+
|ID||string|1||
183
+
|name||string|1||
184
+
|kind||string|1||
185
+
|version|1|number|1||
186
+
|updatedAt||string|1|String representation of time in yyyy-MM-ddTHH:mm:ss.fffffffZ Ex: "2022-01-11T09:55:52.6472858Z"|
187
+
|preconditionRules||array[Object:Rule]|0..1||
188
+
|policyRefs||array[string]|1|List of policy IDs|
105
189
106
190
### Policy
107
191
108
192
Policy specifies decision that should be emitted if the policy is applicable for the request provided request context attributes satisfy attribute predicates specified in the policy. Evaluation of policy triggers evaluation of AttributeRules referenced in the Policy.
109
193
194
+
|member|value|type|cardinality|description|
195
+
|------|-----|----|-----------|-----------|
196
+
|ID||string|1||
197
+
|name||string|1||
198
+
|kind||string|1||
199
+
|version|1|number|1||
200
+
|updatedAt||string|1|String representation of time in yyyy-MM-ddTHH:mm:ss.fffffffZ Ex: "2022-01-11T09:55:52.6472858Z"|
201
+
|preconditionRules||array[Object:Rule]|0..1|All the rules are 'anded'|
202
+
|decisionRules||array[Object:DecisionRule]|1||
203
+
204
+
110
205
### AttributeRule
111
206
112
207
AttributeRule produces derived attributes and add them to request context attributes. Evaluation of AttributeRule triggers evaluation of additional AttributeRules referenced in the AttributeRule.
## Common sub-constructs used in PolicySet, Policy, AttributeRule
116
221
117
222
#### AttributePredicate
118
223
AttributePredicate checks whether predicate specified on an attribute is satisfied. AttributePredicate can specify the following properties:
119
224
- attributeName: specifies attribute name on which attribute predicate needs to be evaluated.
120
-
- matcherId: Identifier of matcher function that is used to compare the attribute value looked up in request context by the attribute name to the attribute value literal specified in the predicate. At present we support 2 matcherId(s): ExactMatcher, GlobMatcher. If matcherId isn't specified, it defaults to GlobMatcher.
121
-
- fromRule: optional property specifying the identifier of an AttributeRule that needs to be evaluated to populate the request context with attribute values that would be compared in this predicate.
225
+
- matcherId: ID of matcher function that is used to compare the attribute value looked up in request context by the attribute name to the attribute value literal specified in the predicate. At present we support 2 matcherId(s): ExactMatcher, GlobMatcher. If matcherId isn't specified, it defaults to GlobMatcher.
226
+
- fromRule: optional property specifying the ID of an AttributeRule that needs to be evaluated to populate the request context with attribute values that would be compared in this predicate.
122
227
- attributeValueIncludes: scalar literal value that should match the request context attribute values.
123
228
- attributeValueIncludedIn: array of literal values that should match the request context attribute values.
124
229
- attributeValueExcluded: scalar literal value that should not match the request context attribute values.
0 commit comments