You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Access policies allow data owners to manage access to datasets from Azure Purview. Data owners can monitor and manage data use from within the Azure Purview Studio, without directly modifying the resource where the data is housed.
17
+
18
+
This tutorial describes how a data owner can create, update, and publish access policies in Azure Purview.
15
19
16
20
## Prerequisites
17
-
The following actions are needed before authoring access policies in Azure Purview:
18
-
1. Configure permissions in the data source and in Azure Purview
19
-
1. Register the data source in Azure Purview for Data Use Governance
20
21
21
-
These tutorials list the pre-requisites of supported data sources
-[Resource Groups and Subscriptions](./tutorial-data-owner-policies-resource-group.md#configuration)
22
+
### Required permissions
23
+
24
+
>[!IMPORTANT]
25
+
> - Currently, policy operations are only supported at **root collection level** and not child collection level.
26
+
27
+
- User needs Azure Purview *Data source administrator* role at the root collection level to:
28
+
- Register a data source, resource group or subscription for *Data use governance*.
29
+
- Publish a policy.
30
+
- User needs Azure Purview *Policy authors* role at root collection level to create or edit policies.
31
+
32
+
For more information, see the guide on [managing Azure Purview role assignments](catalog-permissions.md#assign-permissions-to-your-users).
33
+
34
+
### Source configuration
35
+
36
+
To apply these policies to data sources in your environment, you'll need to configure your sources.
37
+
38
+
1. Your source needs to already be registered to Azure Purview. To register a resource, follow the **Prerequisites** and **Register** sections of the [source pages](azure-purview-connector-overview.md) for your resources.
39
+
1.[Enable data use governance on your resource](how-to-enable-data-use-governance.md#enable-data-use-governance).
40
+
1. Follow any policy-specific prerequisites for your source. Check the [Azure Purview supported data sources table](azure-purview-connector-overview.md#azure-purview-data-sources) and select the link in the **Access Policy** column for sources where access policies are available. Follow any steps listed in the Access policy or Prerequisites sections.
24
41
25
42
## Create a new policy
26
43
27
44
This section describes the steps to create a new policy in Azure Purview.
28
45
29
-
1. Sign in to Azure Purview Studio.
46
+
1. Sign in to the [Azure Purview Studio](https://web.purview.azure.com/resource/).
30
47
31
48
1. Navigate to the **Data policy** feature using the left side panel. Then select **Data policies**.
32
49
33
50
1. Select the **New Policy** button in the policy page.
34
51
35
-
52
+
:::image type="content" source="./media/access-policies-common/policy-onboard-guide-1.png" alt-text="Data owner can access the Policy functionality in Azure Purview when it wants to create policies.":::
36
53
37
54
1. The new policy page will appear. Enter the policy **Name** and **Description**.
38
55
39
56
1. To add policy statements to the new policy, select the **New policy statement** button. This will bring up the policy statement builder.
40
57
41
-
58
+
:::image type="content" source="./media/access-policies-common/create-new-policy.png" alt-text="Data owner can create a new policy statement.":::
42
59
43
60
1. Select the **Effect** button and choose *Allow* from the drop-down list.
44
61
@@ -50,63 +67,64 @@ This section describes the steps to create a new policy in Azure Purview.
50
67
- To create a broad policy statement that covers an entire data source, resource group, or subscription that was previously registered, use the **Data sources** box and select its **Type**.
51
68
- To create a fine-grained policy, use the **Assets** box instead. Enter the **Data Source Type** and the **Name** of a previously registered and scanned data source. See example in the image.
52
69
53
-
70
+
:::image type="content" source="./media/access-policies-common/select-data-source-type.png" alt-text="Data owner can select a Data Resource when editing a policy statement.":::
54
71
55
-
1. Select the **Continue** button and transverse the hierarchy to select and underlying data-object (e.g. folder, file, etc). Select **Recursive** to apply the policy from that point in the hierarchy down to any child data-objects. Then select the **Add** button. This will take you back to the policy editor.
72
+
1. Select the **Continue** button and transverse the hierarchy to select and underlying data-object (for example: folder, file, etc.). Select **Recursive** to apply the policy from that point in the hierarchy down to any child data-objects. Then select the **Add** button. This will take you back to the policy editor.
56
73
57
-
74
+
:::image type="content" source="./media/access-policies-common/select-asset.png" alt-text="Data owner can select the asset when creating or editing a policy statement.":::
58
75
59
76
1. Select the **Subjects** button and enter the subject identity as a principal, group, or MSI. Then select the **OK** button. This will take you back to the policy editor
60
77
61
-
78
+
:::image type="content" source="./media/access-policies-common/select-subject.png" alt-text="Data owner can select the subject when creating or editing a policy statement.":::
62
79
63
80
1. Repeat the steps #5 to #11 to enter any more policy statements.
64
81
65
-
1. Select the **Save** button to save the policy
82
+
1. Select the **Save** button to save the policy.
66
83
67
-
## Update or delete a policy
84
+
Now that you have created your policy, you will need to publish it for it to become active.
68
85
69
-
Steps to create a new policy in Azure Purview are as follows.
86
+
## Publish a policy
70
87
71
-
1. Sign in to Azure Purview Studio.
88
+
A newly created policy is in the **draft** state. The process of publishing associates the new policy with one or more data sources under governance. This is called "binding" a policy to a data source.
72
89
73
-
1. Navigate to the **Data policy** feature using the left side panel. Then select **Data policies**.
90
+
The steps to publish a policy are as follows:
74
91
75
-
92
+
1. Sign in to the [Azure Purview Studio](https://web.purview.azure.com/resource/).
76
93
77
-
1.The Policy portal will present the list of existing policies in Azure Purview. Select the policy that needs to be updated.
94
+
1.Navigate to the **Data policy** feature using the left side panel. Then select **Data policies**.
78
95
79
-
1. The policy details page will appear, including Edit and Delete options. Select the **Edit** button, which brings up the policy statement builder. Now, any parts of the statements in this policy can be updated. To delete the policy, use the **Delete** button.
96
+
:::image type="content" source="./media/access-policies-common/policy-onboard-guide-2.png" alt-text="Data owner can access the Policy functionality in Azure Purview when it wants to update a policy by selecting 'Data policies'.":::
80
97
81
-
98
+
1. The Policy portal will present the list of existing policies in Azure Purview. Locate the policy that needs to be published. Select the **Publish** button on the right top corner of the page.
82
99
83
-
## Publish the policy
100
+
:::image type="content" source="./media/access-policies-common/publish-policy.png" alt-text="Data owner can publish a policy.":::
84
101
85
-
A newly created policy is in the draft state. The process of publishing associates the new policy with one or more data sources under governance. This is called "binding" a policy to a data source.
102
+
1. A list of data sources is displayed. You can enter a name to filter the list. Then, select each data source where this policy is to be published and then select the **Publish** button.
86
103
87
-
The steps to publish a policy are as follows
104
+
:::image type="content" source="./media/access-policies-common/select-data-sources-publish-policy.png" alt-text="Data owner can select the data source where the policy will be published.":::
88
105
89
-
1. Sign in to Azure Purview Studio.
106
+
>[!Note]
107
+
> After making changes to a policy, there is no need to publish it again for it to take effect if the data source(s) continues to be the same.
90
108
91
-
1. Navigate to the **Data policy** feature using the left side panel. Then select **Data policies**.
109
+
## Update or delete a policy
92
110
93
-
111
+
Steps to update or delete a policy in Azure Purview are as follows.
94
112
95
-
1.The Policy portal will present the list of existing policies in Azure Purview. Locate the policy that needs to be published. Select the **Publish** button on the right top corner of the page.
113
+
1.Sign in to the [Azure Purview Studio](https://web.purview.azure.com/resource/).
96
114
97
-
115
+
1. Navigate to the **Data policy** feature using the left side panel. Then select **Data policies**.
98
116
99
-
1. A list of data sources is displayed. You can enter a name to filter the list. Then, select each data source where this policy is to be published and then select the **Publish** button.
117
+
:::image type="content" source="./media/access-policies-common/policy-onboard-guide-2.png" alt-text="Data owner can access the Policy functionality in Azure Purview when it wants to update a policy.":::
100
118
101
-
119
+
1. The Policy portal will present the list of existing policies in Azure Purview. Select the policy that needs to be updated.
102
120
103
-
>[!Note]
104
-
> - After making changes to a policy, there is no need to publish it again for it to take effect if the data source(s) continues to be the same.
121
+
1. The policy details page will appear, including Edit and Delete options. Select the **Edit** button, which brings up the policy statement builder. Now, any parts of the statements in this policy can be updated. To delete the policy, use the **Delete** button.
122
+
123
+
:::image type="content" source="./media/access-policies-common/edit-policy.png" alt-text="Data owner can edit or delete a policy statement.":::
105
124
106
125
## Next steps
107
-
Check blog, demo and related tutorials
108
126
109
-
*[What's New in Azure Purview at Microsoft Ignite 2021](https://techcommunity.microsoft.com/t5/azure-purview/what-s-new-in-azure-purview-at-microsoft-ignite-2021/ba-p/2915954)
110
-
*[Demo of data owner access policies for Azure Storage](https://www.youtube.com/watch?v=CFE8ltT19Ss)
111
-
*[Enable Azure Purview data owner policies on all data sources in a subscription or a resource group](./tutorial-data-owner-policies-resource-group.md)
112
-
*[Enable Azure Purview data owner policies on an Azure Storage account](./tutorial-data-owner-policies-storage.md)
127
+
For specific guides on creating policies, you can follow these tutorials:
128
+
129
+
-[Enable Azure Purview data owner policies on all data sources in a subscription or a resource group](./tutorial-data-owner-policies-resource-group.md)
130
+
-[Enable Azure Purview data owner policies on an Azure Storage account](./tutorial-data-owner-policies-storage.md)
Data use governance is a feature within your registered Azure Purview resources that lets Azure Purview administrators manage data use from within Azure Purview.
18
+
19
+
## Prerequisites
20
+
21
+
To register a data source, resource group, or subscription in Azure Purview with the *Data use Governance* option set, a user needs to have **either one of the following** IAM role combinations on that resource:
22
+
23
+
- IAM *Owner*
24
+
- Both IAM *Contributor* + IAM *User Access Administrator*
25
+
26
+
Follow this [guide to configure Azure RBAC role permissions](../role-based-access-control/check-access.md).
27
+
28
+
29
+
## Enable data use governance
30
+
31
+
To enable data use governance for a resource, the resource will first need to be registered in Azure Purview.
32
+
To register a resource, follow the **Prerequisites** and **Register** sections of the [source pages](azure-purview-connector-overview.md) for your resources.
33
+
34
+
Once you have your resource registered, follow the rest of the steps to enable an individual resource for data use governance.
35
+
36
+
1. Go to the [Azure Purview Studio](https://web.purview.azure.com/resource/).
37
+
38
+
1. Select the **Data map** tab in the left menu.
39
+
40
+
1. Select the **Sources** tab in the left menu.
41
+
42
+
1. Select the source you want to enable data use governance for.
43
+
44
+
1. At the top of the source page, select **Edit source**.
45
+
46
+
1. Enable the data source for data use governance in Azure Purview by setting the **Data use governance** toggle to **Enabled**, as shown in the image below.
47
+
48
+
:::image type="content" source="./media/tutorial-data-owner-policies-storage/register-data-source-for-policy-storage.png" alt-text="Set Data use governance toggle to **Enabled** at the bottom of the menu.":::
49
+
50
+
> [!WARNING]
51
+
> **Known issues** related to source registration:
52
+
>
53
+
> - Moving data sources to a different resource group or subscription is not yet supported. If want to do that, de-register the data source in Azure Purview before moving it and then register it again after that happens.
54
+
> - Once a subscription gets disabled for *Data use governance* any underlying assets that are enabled for *Data use governance* will be disabled, which is the right behavior. However, policy statements based on those assets will still be allowed after that.
55
+
56
+
57
+
## Disable data use governance
58
+
59
+
>[!Note]
60
+
>If your resource is currently a part of any active access policy, you will not be able to disable data use governance. First [remove the resource from the policy](how-to-data-owner-policy-authoring-generic.md#update-or-delete-a-policy), then disable data use governance.
61
+
62
+
To disable data use governance for a source, resource group, or subscription, a user needs to either be a data source **Owner** or an Azure Purview **Data source admin**. Once you have those permissions follow these steps:
63
+
64
+
1. Go to the [Azure Purview Studio](https://web.purview.azure.com/resource/).
65
+
66
+
1. Select the **Data map** tab in the left menu.
67
+
68
+
1. Select the **Sources** tab in the left menu.
69
+
70
+
1. Select the source you want to disable data use governance for.
71
+
72
+
1. At the top of the source page, select **Edit source**.
73
+
74
+
1. Set the **Data use governance** toggle to **Disabled**.
75
+
76
+
>[!NOTE]
77
+
> Disabling **Data use governance** for a subscription source will disable it also for all assets registered in that subscription.
78
+
79
+
## Data use governance best practices
80
+
81
+
- We highly encourage registering data sources for *Data use governance* and managing all associated access policies in a single Azure Purview account.
82
+
- Should you have multiple Azure Purview accounts, be aware that **all** data sources belonging to a subscription must be registered for *Data use governance* in a single Azure Purview account. That Azure Purview account can be in any subscription in the tenant. The *Data use governance* toggle will become greyed out when there are invalid configurations. Some examples of valid and invalid configurations follow in the diagram below:
83
+
-**Case 1** shows a valid configuration where a Storage account is registered in an Azure Purview account in the same subscription.
84
+
-**Case 2** shows a valid configuration where a Storage account is registered in an Azure Purview account in a different subscription.
85
+
-**Case 3** shows an invalid configuration arising because Storage accounts S3SA1 and S3SA2 both belong to Subscription 3, but are registered to different Azure Purview accounts. In that case, the *Data use governance* toggle will only work in the Azure Purview account that wins and registers a data source in that subscription first. The toggle will then be greyed out for the other data source.
86
+
87
+
:::image type="content" source="./media/access-policies-common/valid-and-invalid-configurations.png" alt-text="Diagram shows valid and invalid configurations when using multiple Azure Purview accounts to manage policies.":::
88
+
89
+
## Next steps
90
+
91
+
-[Create data owner policies for your resources](how-to-data-owner-policy-authoring-generic.md)
92
+
-[Enable Azure Purview data owner policies on all data sources in a subscription or a resource group](./tutorial-data-owner-policies-resource-group.md)
93
+
-[Enable Azure Purview data owner policies on an Azure Storage account](./tutorial-data-owner-policies-storage.md)
0 commit comments