Skip to content

Commit 4a070d9

Browse files
v-stsavellv-stsavell
authored
Merge pull request #206281 from jonburchel/2022-07-28-breakout-synapse-managed-identity-docs
Break out Synapse managed identity doc from ADF doc.
2 parents 13b3e87 + 6215f00 commit 4a070d9

File tree

3 files changed

+350
-241
lines changed

3 files changed

+350
-241
lines changed

‎articles/data-factory/data-factory-service-identity.md

Lines changed: 17 additions & 239 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
---
22
title: Managed identity
3-
titleSuffix: Azure Data Factory & Azure Synapse
4-
description: Learn about using managed identities in Azure Data Factory and Azure Synapse.
3+
titleSuffix: Azure Data Factory
4+
description: Learn about using managed identities in Azure Data Factory.
55
author: nabhishek
66
ms.service: data-factory
77
ms.subservice: security
88
ms.topic: conceptual
99
ms.date: 01/27/2022
1010
ms.author: abnarain
11-
ms.custom: devx-track-azurepowershell, synapse, subject-rbac-steps
11+
ms.custom: devx-track-azurepowershell, subject-rbac-steps
1212
---
1313

14-
# Managed identity for Azure Data Factory and Azure Synapse
14+
# Managed identity for Azure Data Factory
1515

16-
[!INCLUDE[appliesto-adf-asa-md](includes/appliesto-adf-asa-md.md)]
16+
[!INCLUDE[appliesto-adf-xxx-md](includes/appliesto-adf-xxx-md.md)]
1717

18-
This article helps you understand managed identity (formerly known as Managed Service Identity/MSI) and how it works in Azure Data Factory and Azure Synapse.
18+
This article helps you understand managed identity (formerly known as Managed Service Identity/MSI) and how it works in Azure Data Factory.
1919

2020
[!INCLUDE [updated-for-az](../../includes/updated-for-az.md)]
2121

@@ -25,8 +25,9 @@ Managed identities eliminate the need to manage credentials. Managed identities
2525

2626
There are two types of supported managed identities:
2727

28-
- **System-assigned:** You can enable a managed identity directly on a service instance. When you allow a system-assigned managed identity during the creation of the service, an identity is created in Azure AD tied to that service instance's lifecycle. By design, only that Azure resource can use this identity to request tokens from Azure AD. So when the resource is deleted, Azure automatically deletes the identity for you. Azure Synapse Analytics requires that a system-assigned managed identity must be created along with the Synapse workspace.
29-
- **User-assigned:** You may also create a managed identity as a standalone Azure resource. You can [create a user-assigned managed identity](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md) and assign it to one or more instances of a data factory or Synapse workspace. In user-assigned managed identities, the identity is managed separately from the resources that use it.
28+
- **System-assigned:** You can enable a managed identity directly on a service instance. When you allow a system-assigned managed identity during the creation of the service, an identity is created in Azure AD tied to that service instance's lifecycle. By design, only that Azure resource can use this identity to request tokens from Azure AD. So when the resource is deleted, Azure automatically deletes the identity for you.
29+
-
30+
- **User-assigned:** You may also create a managed identity as a standalone Azure resource. You can [create a user-assigned managed identity](../active-directory/managed-identities-azure-resources/how-to-manage-ua-identity-portal.md) and assign it to one or more instances of a data factory. In user-assigned managed identities, the identity is managed separately from the resources that use it.
3031

3132
Managed identity provides the below benefits:
3233

@@ -37,15 +38,15 @@ Managed identity provides the below benefits:
3738
## System-assigned managed identity
3839

3940
>[!NOTE]
40-
> System-assigned managed identity is also referred to as 'Managed identity' elsewhere in the documentation and in the Data Factory Studio and Synapse Studio UI for backward compatibility purpose. We will explicitly mention 'User-assigned managed identity' when referring to it.
41+
> System-assigned managed identity is also referred to as 'Managed identity' elsewhere in the documentation and in the Data Factory Studio for backward compatibility purpose. We will explicitly mention 'User-assigned managed identity' when referring to it.
4142
4243
### <a name="generate-managed-identity"></a> Generate system-assigned managed identity
4344

4445
System-assigned managed identity is generated as follows:
4546

46-
- When creating a data factory or Synapse workspace through **Azure portal or PowerShell**, managed identity will always be created automatically.
47-
- When creating data factory or workspace through **SDK**, managed identity will be created only if you specify "Identity = new FactoryIdentity()" in the factory object or Identity = new ManagedIdentity" in the Synapse workspace object for creation." See example in [.NET Quickstart - Create data factory](quickstart-create-data-factory-dot-net.md#create-a-data-factory).
48-
- When creating data factory or Synapse workspace through **REST API**, managed identity will be created only if you specify "identity" section in request body. See example in [REST quickstart - create data factory](quickstart-create-data-factory-rest-api.md#create-a-data-factory).
47+
- When creating a data factory through **Azure portal or PowerShell**, managed identity will always be created automatically.
48+
- When creating data factory through **SDK**, managed identity will be created only if you specify "Identity = new FactoryIdentity()" in the factory object for creation." See example in [.NET Quickstart - Create data factory](quickstart-create-data-factory-dot-net.md#create-a-data-factory).
49+
- When creating a data factory through **REST API**, managed identity will be created only if you specify "identity" section in request body. See example in [REST quickstart - create data factory](quickstart-create-data-factory-rest-api.md#create-a-data-factory).
4950

5051
If you find your service instance doesn't have a managed identity associated following [retrieve managed identity](#retrieve-managed-identity) instruction, you can explicitly generate one by updating it with identity initiator programmatically:
5152

@@ -57,13 +58,11 @@ If you find your service instance doesn't have a managed identity associated fol
5758
>[!NOTE]
5859
>
5960
>- Managed identity cannot be modified. Updating a service instance which already has a managed identity won't have any impact, and the managed identity is kept unchanged.
60-
>- If you update a service instance which already has a managed identity without specifying the "identity" parameter in the factory or workspace objects or without specifying "identity" section in REST request body, you will get an error.
61+
>- If you update a service instance which already has a managed identity without specifying the "identity" parameter in the factory objects or without specifying "identity" section in REST request body, you will get an error.
6162
>- When you delete a service instance, the associated managed identity will be deleted along.
6263
6364
#### Generate system-assigned managed identity using PowerShell
6465

65-
# [Azure Data Factory](#tab/data-factory)
66-
6766
Call **Set-AzDataFactoryV2** command, then you see "Identity" fields being newly generated:
6867

6968
```powershell
@@ -77,40 +76,9 @@ Tags : {}
7776
Identity : Microsoft.Azure.Management.DataFactory.Models.FactoryIdentity
7877
ProvisioningState : Succeeded
7978
```
80-
# [Azure Synapse](#tab/synapse-analytics)
81-
82-
Call **New-AzSynapseWorkspace** command, then you see "Identity" fields being newly generated:
83-
84-
```powershell
85-
PS C:\> $creds = New-Object System.Management.Automation.PSCredential ("ContosoUser", $password)
86-
PS C:\> New-AzSynapseWorkspace -ResourceGroupName <resourceGroupName> -Name <workspaceName> -Location <region> -DefaultDataLakeStorageAccountName <storageAccountName> -DefaultDataLakeStorageFileSystem <fileSystemName> -SqlAdministratorLoginCredential $creds
87-
88-
DefaultDataLakeStorage : Microsoft.Azure.Commands.Synapse.Models.PSDataLakeStorageAccountDetails
89-
ProvisioningState : Succeeded
90-
SqlAdministratorLogin : ContosoUser
91-
VirtualNetworkProfile :
92-
Identity : Microsoft.Azure.Commands.Synapse.Models.PSManagedIdentity
93-
ManagedVirtualNetwork :
94-
PrivateEndpointConnections : {}
95-
WorkspaceUID : <workspaceUid>
96-
ExtraProperties : {[WorkspaceType, Normal], [IsScopeEnabled, False]}
97-
ManagedVirtualNetworkSettings :
98-
Encryption : Microsoft.Azure.Commands.Synapse.Models.PSEncryptionDetails
99-
WorkspaceRepositoryConfiguration :
100-
Tags :
101-
TagsTable :
102-
Location : <region>
103-
Id : /subscriptions/<subsID>/resourceGroups/<resourceGroupName>/providers/
104-
Microsoft.Synapse/workspaces/<workspaceName>
105-
Name : <workspaceName>
106-
Type : Microsoft.Synapse/workspaces
107-
```
108-
---
10979

11080
#### Generate system-assigned managed identity using REST API
11181

112-
# [Azure Data Factory](#tab/data-factory)
113-
11482
> [!NOTE]
11583
> If you attempt to update a service instance that already has a managed identity without either specifying the **identity** parameter in the factory object or providing an **identity** section in the REST request body, you will get an error.
11684
@@ -155,57 +123,9 @@ PATCH https://management.azure.com/subscriptions/<subsID>/resourceGroups/<resour
155123
"location": "<region>"
156124
}
157125
```
158-
# [Azure Synapse](#tab/synapse-analytics)
159-
160-
> [!NOTE]
161-
> If you attempt to update a service instance that already has a managed identity without either specifying the **identity** parameter in the workspace object or providing an **identity** section in the REST request body, you will get an error.
162-
163-
Call the API below with the "identity" section in the request body:
164-
165-
```
166-
PATCH https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}?api-version=2018-06-01
167-
```
168-
169-
**Request body**: add "identity": { "type": "SystemAssigned" }.
170-
171-
```json
172-
{
173-
"name": "<workspaceName>",
174-
"location": "<region>",
175-
"properties": {},
176-
"identity": {
177-
"type": "SystemAssigned"
178-
}
179-
}
180-
```
181-
182-
**Response**: managed identity is created automatically, and "identity" section is populated accordingly.
183-
184-
```json
185-
{
186-
"name": "<workspaceName>",
187-
"tags": {},
188-
"properties": {
189-
"provisioningState": "Succeeded",
190-
"loggingStorageAccountKey": "**********",
191-
"createTime": "2021-09-26T04:10:01.1135678Z",
192-
"version": "2018-06-01"
193-
},
194-
"identity": {
195-
"type": "SystemAssigned",
196-
"principalId": "765ad4ab-XXXX-XXXX-XXXX-51ed985819dc",
197-
"tenantId": "72f988bf-XXXX-XXXX-XXXX-2d7cd011db47"
198-
},
199-
"id": "/subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>/providers/Microsoft.Synapse/workspaces/<workspaceName>",
200-
"type": "Microsoft.Synapse/workspaces",
201-
"location": "<region>"
202-
}
203-
```
204-
---
205126

206127
#### Generate system-assigned managed identity using an Azure Resource Manager template
207128

208-
# [Azure Data Factory](#tab/data-factory)
209129
**Template**: add "identity": { "type": "SystemAssigned" }.
210130

211131
```json
@@ -223,29 +143,9 @@ PATCH https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups
223143
}]
224144
}
225145
```
226-
# [Azure Synapse](#tab/synapse-analytics)
227-
**Template**: add "identity": { "type": "SystemAssigned" }.
228-
229-
```json
230-
{
231-
"contentVersion": "1.0.0.0",
232-
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
233-
"resources": [{
234-
"name": "<workspaceName>",
235-
"apiVersion": "2018-06-01",
236-
"type": "Microsoft.Synapse/workspaces",
237-
"location": "<region>",
238-
"identity": {
239-
"type": "SystemAssigned"
240-
}
241-
}]
242-
}
243-
```
244-
---
245146

246147
#### Generate system-assigned managed identity using SDK
247148

248-
# [Azure Data Factory](#tab/data-factory)
249149
Call the create_or_update function with Identity=new FactoryIdentity(). Sample code using .NET:
250150

251151
```csharp
@@ -256,26 +156,6 @@ Factory dataFactory = new Factory
256156
};
257157
client.Factories.CreateOrUpdate(resourceGroup, dataFactoryName, dataFactory);
258158
```
259-
# [Azure Synapse](#tab/synapse-analytics)
260-
```csharp
261-
Workspace workspace = new Workspace
262-
{
263-
Identity = new ManagedIdentity
264-
{
265-
Type = ResourceIdentityType.SystemAssigned
266-
},
267-
DefaultDataLakeStorage = new DataLakeStorageAccountDetails
268-
{
269-
AccountUrl = <defaultDataLakeStorageAccountUrl>,
270-
Filesystem = <DefaultDataLakeStorageFilesystem>
271-
},
272-
SqlAdministratorLogin = <SqlAdministratorLoginCredentialUserName>
273-
SqlAdministratorLoginPassword = <SqlAdministratorLoginCredentialPassword>,
274-
Location = <region>
275-
};
276-
client.Workspaces.CreateOrUpdate(resourceGroupName, workspaceName, workspace);
277-
```
278-
---
279159

280160
### <a name="retrieve-managed-identity"></a> Retrieve system-assigned managed identity
281161

@@ -286,21 +166,13 @@ You can retrieve the managed identity from Azure portal or programmatically. The
286166
287167
#### Retrieve system-assigned managed identity using Azure portal
288168

289-
# [Azure Data Factory](#tab/data-factory)
290-
You can find the managed identity information from Azure portal -> your data factory or Synapse workspace -> Properties.
169+
You can find the managed identity information from Azure portal -> your data factory -> Properties.
291170

292171
:::image type="content" source="media/data-factory-service-identity/system-managed-identity-in-portal.png" alt-text="Shows the Azure portal with the system-managed identity object ID and Identity Tenant for an Azure Data Factory." lightbox="media/data-factory-service-identity/system-managed-identity-in-portal.png":::
293172

294-
# [Synapse Analytics](#tab/synapse-analytics)
295-
296-
You can find the managed identity information from Azure portal -> your data factory or Synapse workspace -> Properties.
297-
298-
:::image type="content" source="media/data-factory-service-identity/system-managed-identity-in-portal-synapse.png" alt-text="Shows the Azure portal with the system-managed identity object ID for a Synapse workspace." lightbox="media/data-factory-service-identity/system-managed-identity-in-portal-synapse.png":::
299-
300-
---
301173

302174
- Managed Identity Object ID
303-
- Managed Identity Tenant (only applicable for Azure Data Factory)
175+
- Managed Identity Tenant
304176

305177
The managed identity information will also show up when you create linked service, which supports managed identity authentication, like Azure Blob, Azure Data Lake Storage, Azure Key Vault, etc.
306178

@@ -322,7 +194,6 @@ To grant permissions, follow these steps. For detailed steps, see [Assign Azure
322194

323195
#### Retrieve system-assigned managed identity using PowerShell
324196

325-
# [Azure Data Factory](#tab/data-factory)
326197
The managed identity principal ID and tenant ID will be returned when you get a specific service instance as follows. Use the **PrincipalId** to grant access:
327198

328199
```powershell
@@ -344,33 +215,9 @@ DisplayName : ADFV2DemoFactory
344215
Id : 765ad4ab-XXXX-XXXX-XXXX-51ed985819dc
345216
Type : ServicePrincipal
346217
```
347-
# [Azure Synapse](#tab/synapse-analytics)
348-
The managed identity principal ID and tenant ID will be returned when you get a specific service instance as follows. Use the **PrincipalId** to grant access:
349-
350-
```powershell
351-
PS C:\> (Get-AzSynapseWorkspace -ResourceGroupName <resourceGroupName> -Name <workspaceName>).Identity
352-
353-
IdentityType PrincipalId TenantId
354-
------------ ----------- --------
355-
SystemAssigned cadadb30-XXXX-XXXX-XXXX-ef3500e2ff05 72f988bf-XXXX-XXXX-XXXX-2d7cd011db47
356-
```
357-
358-
You can get the application ID by copying above principal ID, then running below Azure Active Directory command with principal ID as parameter.
359-
360-
```powershell
361-
PS C:\> Get-AzADServicePrincipal -ObjectId cadadb30-XXXX-XXXX-XXXX-ef3500e2ff05
362-
363-
ServicePrincipalNames : {76f668b3-XXXX-XXXX-XXXX-1b3348c75e02, https://identity.azure.net/P86P8g6nt1QxfPJx22om8MOooMf/Ag0Qf/nnREppHkU=}
364-
ApplicationId : 76f668b3-XXXX-XXXX-XXXX-1b3348c75e02
365-
DisplayName : <workspaceName>
366-
Id : cadadb30-XXXX-XXXX-XXXX-ef3500e2ff05
367-
Type : ServicePrincipal
368-
```
369-
---
370218

371219
#### Retrieve managed identity using REST API
372220

373-
# [Azure Data Factory](#tab/data-factory)
374221
The managed identity principal ID and tenant ID will be returned when you get a specific service instance as follows.
375222

376223
Call below API in the request:
@@ -423,75 +270,6 @@ GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{
423270
}
424271
}
425272
```
426-
# [Azure Synapse](#tab/synapse-analytics)
427-
The managed identity principal ID and tenant ID will be returned when you get a specific service instance as follows.
428-
429-
Call below API in the request:
430-
431-
```
432-
GET https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}?api-version=2018-06-01
433-
```
434-
435-
**Response**: You will get response like shown in below example. The "identity" section is populated accordingly.
436-
437-
```json
438-
{
439-
"properties": {
440-
"defaultDataLakeStorage": {
441-
"accountUrl": "https://exampledatalakeaccount.dfs.core.windows.net",
442-
"filesystem": "examplefilesystem"
443-
},
444-
"encryption": {
445-
"doubleEncryptionEnabled": false
446-
},
447-
"provisioningState": "Succeeded",
448-
"connectivityEndpoints": {
449-
"web": "https://web.azuresynapse.net?workspace=%2fsubscriptions%2{subscriptionId}%2fresourceGroups%2f{resourceGroupName}%2fproviders%2fMicrosoft.Synapse%2fworkspaces%2f{workspaceName}",
450-
"dev": "https://{workspaceName}.dev.azuresynapse.net",
451-
"sqlOnDemand": "{workspaceName}-ondemand.sql.azuresynapse.net",
452-
"sql": "{workspaceName}.sql.azuresynapse.net"
453-
},
454-
"managedResourceGroupName": "synapseworkspace-managedrg-f77f7cf2-XXXX-XXXX-XXXX-c4cb7ac3cf4f",
455-
"sqlAdministratorLogin": "sqladminuser",
456-
"privateEndpointConnections": [],
457-
"workspaceUID": "e56f5773-XXXX-XXXX-XXXX-a0dc107af9ea",
458-
"extraProperties": {
459-
"WorkspaceType": "Normal",
460-
"IsScopeEnabled": false
461-
},
462-
"publicNetworkAccess": "Enabled",
463-
"cspWorkspaceAdminProperties": {
464-
"initialWorkspaceAdminObjectId": "3746a407-XXXX-XXXX-XXXX-842b6cf1fbcc"
465-
},
466-
"trustedServiceBypassEnabled": false
467-
},
468-
"type": "Microsoft.Synapse/workspaces",
469-
"id": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}",
470-
"location": "eastus",
471-
"name": "{workspaceName}",
472-
"identity": {
473-
"type": "SystemAssigned",
474-
"tenantId": "72f988bf-XXXX-XXXX-XXXX-2d7cd011db47",
475-
"principalId": "cadadb30-XXXX-XXXX-XXXX-ef3500e2ff05"
476-
},
477-
"tags": {}
478-
}
479-
```
480-
481-
> [!TIP]
482-
> To retrieve the managed identity from an ARM template, add an **outputs** section in the ARM JSON:
483-
484-
```json
485-
{
486-
"outputs":{
487-
"managedIdentityObjectId":{
488-
"type":"string",
489-
"value":"[reference(resourceId('Microsoft.Synapse/workspaces', parameters('<workspaceName>')), '2018-06-01', 'Full').identity.principalId]"
490-
}
491-
}
492-
}
493-
```
494-
---
495273

496274
## User-assigned managed identity
497275

@@ -508,4 +286,4 @@ See the following topics that introduce when and how to use managed identity:
508286
- [Store credential in Azure Key Vault](store-credentials-in-key-vault.md).
509287
- [Copy data from/to Azure Data Lake Store using managed identities for Azure resources authentication](connector-azure-data-lake-store.md).
510288

511-
See [Managed Identities for Azure Resources Overview](../active-directory/managed-identities-azure-resources/overview.md) for more background on managed identities for Azure resources, on which managed identity in Azure Data Factory and Azure Synapse is based.
289+
See [Managed Identities for Azure Resources Overview](../active-directory/managed-identities-azure-resources/overview.md) for more background on managed identities for Azure resources, on which managed identity in Azure Data Factory is based.

0 commit comments

Comments
 (0)