Skip to content

Commit 52a96ce

Browse files
huypubhuypub
authored
Merge pull request #216229 from MicrosoftDocs/release-ga-purview-policy
Release ga purview policy-- scheduled release at 3PM of 10/28
2 parents 2fd239f + e45138e commit 52a96ce

15 files changed

+424
-7
lines changed

‎articles/purview/concept-policies-devops.md

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
title: Microsoft Purview DevOps policies concepts
3+
description: Understand Microsoft Purview DevOps policies
4+
author: inward-eye
5+
ms.author: vlrodrig
6+
ms.service: purview
7+
ms.subservice: purview-data-policies
8+
ms.topic: conceptual
9+
ms.date: 10/07/2022
10+
---
11+
12+
# Concepts for Microsoft Purview DevOps policies
13+
14+
[!INCLUDE [feature-in-preview](includes/feature-in-preview.md)]
15+
16+
This article discusses concepts related to managing access to data sources in your data estate from within the Microsoft Purview governance portal. In particular, it focuses on DevOps policies.
17+
18+
> [!Note]
19+
> This capability is different from access control for Microsoft Purview itself, which is described in [Access control in Microsoft Purview](./catalog-permissions.md).
20+
21+
## Overview
22+
Access to system metadata is crucial for database administrators and other DevOps users to perform their job. That access can be granted and revoked efficiently and at-scale through Microsoft Purview DevOps policies.
23+
24+
### Microsoft Purview access policies vs. DevOps policies
25+
Microsoft Purview access policies enable customers to manage access to different data systems across their entire data estate, all from a central location in the cloud. These policies are access grants that can be created through Microsoft Purview Studio, avoiding the need for code. They dictate whether a set of Azure AD principals (users, groups, etc.) should be allowed or denied a specific type of access to a data source or asset within it. These policies get communicated to the data sources where they get natively enforced.
26+
27+
DevOps policies are a special type of Microsoft Purview access policies. They grant access to database system metadata instead of user data. They simplify access provisioning for IT operations and security auditing functions. DevOps policies only grant access, that is, they don't deny access.
28+
29+
## Elements of a DevOps policy
30+
A DevOps policy is defined by three elements: The *data resource path*, the *role* and the *subject*. In essence, the DevOps policy assigns the *subject* to the *role* for the scope of the *data resource path*.
31+
32+
#### The subject
33+
Is a set of Azure AD users, groups or service principals.
34+
35+
#### The role
36+
The role maps to a set of actions that the policy permits on the data resource. DevOps policies support a couple of roles: *SQL Performance Monitor* and *SQL Security Auditor*. The DevOps policy how-to docs detail the role definition for each data source, that is, the mapping between the role in Microsoft Purview and the actions that get permitted in the data source. For example, the role definition for SQL Performance Monitor and SQL Security Auditor includes Connect actions at server and database level on the data source side.
37+
38+
#### The data resource
39+
Microsoft Purview DevOps policies currently support SQL-type data sources and can be configured on individual data sources, resource groups and subscriptions. DevOps policies can only be created if the data source is first registered in Microsoft Purview with the option *Data use management enabled*. The data resource path is the composition of subscription > resource group > data source.
40+
41+
#### Hierarchical enforcement of policies
42+
A DevOps policy on a data resource is enforced on the data resource itself and all children contained by it. For example, a DevOps policy on an Azure subscription applies to all resource groups, to all policy-enabled data sources within each resource group, and to all databases contained within each data source.
43+
44+
## A sample scenario to demonstrate the concept and the benefits
45+
Bob and Alice are DevOps users at their company. Given their role, they need to log in to dozens of Azure SQL logical servers to monitor their performance so that critical DevOps processes don’t break. Their manager, Mateo, creates an Azure AD group and includes Alice and Bob. He then uses Microsoft Purview DevOps policies (Policy 1 in the diagram below) to grant this Azure AD group access at resource group level, to Resource Group 1, which hosts the Azure SQL servers.
46+
47+
![Diagram shows an example of DevOps policy on resource group.](./media/concept-policies-devops/devops-policy-on-resource-group.png).
48+
49+
#### These are the benefits:
50+
- Mateo doesn't have to create local logins in each logical server
51+
- The policies from Microsoft Purview improve security by helping limit local privileged access. This is what we call PoLP (Principle of Least Privilege). In the scenario, Mateo only grants the minimum access necessary that Bob and Alice need to perform the task of monitoring performance.
52+
- When new Azure SQL servers are added to the Resource Group, Mateo doesn't need to update the policies in Microsoft Purview for them to be effective on the new logical servers.
53+
- If Alice or Bob leave their job and get backfilled, Mateo just updates the Azure AD group, without having to make any changes to the servers or to the policies he created in Microsoft Purview.
54+
- At any point in time, Mateo or the company’s auditor can see what access has been granted directly in Microsoft Purview Studio.
55+
56+
## More info
57+
- DevOps policies can be created, updated and deleted by any user holding *Policy Author* role at root collection level in Microsoft Purview.
58+
- Once saved, DevOps policies get automatically published.
59+
60+
## Next steps
61+
To get started with DevOps policies, consult the following guides:
62+
* Document: [Microsoft Purview DevOps policies on Arc-enabled SQL Server](./how-to-policies-devops-arc-sql-server.md)
63+
* Document: [Microsoft Purview DevOps policies on Azure SQL DB](./how-to-policies-devops-azure-sql-db.md)
64+
* Blog: [New granular permissions for SQL Server 2022 and Azure SQL to help PoLP](https://techcommunity.microsoft.com/t5/sql-server-blog/new-granular-permissions-for-sql-server-2022-and-azure-sql-to/ba-p/3607507)

‎articles/purview/how-to-policies-devops-arc-sql-server.md

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
---
2+
title: Provision access to Arc-enabled SQL Server for DevOps actions (preview)
3+
description: Step-by-step guide on provisioning access to Arc-enabled SQL Server through Microsoft Purview DevOps policies
4+
author: inward-eye
5+
ms.author: vlrodrig
6+
ms.service: purview
7+
ms.subservice: purview-data-policies
8+
ms.topic: how-to
9+
ms.date: 10/11/2022
10+
ms.custom:
11+
---
12+
# Provision access to Arc-enabled SQL Server for DevOps actions (preview)
13+
14+
[!INCLUDE [feature-in-preview](includes/feature-in-preview.md)]
15+
16+
[DevOps policies](concept-policies-devops.md) are a type of Microsoft Purview access policies. They allow you to manage access to system metadata on data sources that have been registered for *Data use management* in Microsoft Purview. These policies are configured directly in the Microsoft Purview governance portal, and after publishing, they get enforced by the data source.
17+
18+
This how-to guide covers how to provision access from Microsoft Purview to Arc-enabled SQL Server system metadata (DMVs and DMFs) via *SQL Performance Monitoring* or *SQL Security Auditing* actions. Microsoft Purview access policies apply to Azure AD Accounts only.
19+
20+
## Prerequisites
21+
[!INCLUDE [Access policies generic pre-requisites](./includes/access-policies-prerequisites-generic.md)]
22+
[!INCLUDE [Access policies Arc enabled SQL Server pre-requisites](./includes/access-policies-prerequisites-arc-sql-server.md)]
23+
24+
## Microsoft Purview configuration
25+
26+
### Register data sources in Microsoft Purview
27+
The Arc-enabled SQL Server data source needs to be registered first with Microsoft Purview, before policies can be created.
28+
29+
1. Sign in to Microsoft Purview Studio.
30+
31+
1. Navigate to the **Data map** feature on the left pane, select **Sources**, then select **Register**. Type "Azure Arc" in the search box and select **SQL Server on Azure Arc**. Then select **Continue**
32+
![Screenshot shows how to select a source for registration.](./media/how-to-policies-data-owner-sql/select-arc-sql-server-for-registration.png)
33+
34+
1. Enter a **Name** for this registration. It is best practice to make the name of the registration the same as the server name in the next step.
35+
36+
1. select an **Azure subscription**, **Server name** and **Server endpoint**.
37+
38+
1. **Select a collection** to put this registration in.
39+
40+
1. Enable Data Use Management. Data Use Management needs certain permissions and can affect the security of your data, as it delegates to certain Microsoft Purview roles to manage access to the data sources. **Go through the secure practices related to Data Use Management in this guide**: [How to enable Data Use Management](./how-to-enable-data-use-management.md)
41+
42+
1. Upon enabling Data Use Management, Microsoft Purview will automatically capture the **Application ID** of the App Registration related to this Arc-enabled SQL server. Come back to this screen and hit the refresh button on the side of it to refresh, in case the association between the Arc-enabled SQL server and the App Registration changes in the future.
43+
44+
1. Select **Register** or **Apply** at the bottom
45+
46+
Once your data source has the **Data Use Management** toggle *Enabled*, it will look like this picture.
47+
![Screenshot shows how to register a data source for policy.](./media/how-to-policies-data-owner-sql/register-data-source-for-policy-arc-sql.png)
48+
49+
> [!Note]
50+
> If you want to create a policy on a resource group or subscription and have it enforced in Arc-enabled SQL servers, you will need to also register those servers independently for *Data use management* to provide their App ID.
51+
52+
## Create a new DevOps policy
53+
Follow this link for the steps to [create a new DevOps policy in Microsoft Purview](how-to-policies-devops-authoring-generic.md#create-a-new-devops-policy).
54+
55+
## List DevOps policies
56+
Follow this link for the steps to [list DevOps policies in Microsoft Purview](how-to-policies-devops-authoring-generic.md#list-devops-policies).
57+
58+
## Update a DevOps policy
59+
Follow this link for the steps to [update a DevOps policies in Microsoft Purview](how-to-policies-devops-authoring-generic.md#update-a-devops-policy).
60+
61+
## Delete a DevOps policy
62+
Follow this link for the steps to [delete a DevOps policies in Microsoft Purview](how-to-policies-devops-authoring-generic.md#delete-a-devops-policy).
63+
64+
>[!Important]
65+
> DevOps policies are auto-published and changes can take up to **5 minutes** to be enforced by the data source.
66+
67+
### Test the policy
68+
69+
The Azure AD Accounts referenced in the access policies should now be able to connect to any database in the server to which the policies are published.
70+
71+
#### Force policy download
72+
It is possible to force an immediate download of the latest published policies to the current SQL database by running the following command. The minimal permission required to run it is membership in ##MS_ServerStateManager##-server role.
73+
74+
```sql
75+
-- Force immediate download of latest published policies
76+
exec sp_external_policy_refresh reload
77+
```
78+
79+
#### Analyze downloaded policy state from SQL
80+
The following DMVs can be used to analyze which policies have been downloaded and are currently assigned to Azure AD accounts. The minimal permission required to run them is VIEW DATABASE SECURITY STATE - or assigned Action Group *SQL Security Auditor*.
81+
82+
```sql
83+
84+
-- Lists generally supported actions
85+
SELECT * FROM sys.dm_server_external_policy_actions
86+
87+
-- Lists the roles that are part of a policy published to this server
88+
SELECT * FROM sys.dm_server_external_policy_roles
89+
90+
-- Lists the links between the roles and actions, could be used to join the two
91+
SELECT * FROM sys.dm_server_external_policy_role_actions
92+
93+
-- Lists all Azure AD principals that were given connect permissions
94+
SELECT * FROM sys.dm_server_external_policy_principals
95+
96+
-- Lists Azure AD principals assigned to a given role on a given resource scope
97+
SELECT * FROM sys.dm_server_external_policy_role_members
98+
99+
-- Lists Azure AD principals, joined with roles, joined with their data actions
100+
SELECT * FROM sys.dm_server_external_policy_principal_assigned_actions
101+
```
102+
103+
## Additional information
104+
105+
### Policy action mapping
106+
107+
This section contains a reference of how actions in Microsoft Purview data policies map to specific actions in SQL Server on Azure Arc-enabled servers.
108+
109+
| **Microsoft Purview policy action** | **Data source specific actions** |
110+
|-------------------------------------|--------------------------------------|
111+
| | |
112+
| *SQL Performance Monitor* |Microsoft.Sql/sqlservers/Connect |
113+
||Microsoft.Sql/sqlservers/databases/Connect |
114+
||Microsoft.Sql/sqlservers/databases/SystemViewsAndFunctions/DatabasePerformanceState/rows/select |
115+
||Microsoft.Sql/sqlservers/databases/SystemViewsAndFunctions/ServerPerformanceState/rows/select |
116+
|||
117+
| *SQL Security Auditor* |Microsoft.Sql/sqlservers/Connect |
118+
||Microsoft.Sql/sqlservers/databases/Connect |
119+
||Microsoft.Sql/sqlservers/SystemViewsAndFunctions/ServerSecurityState/rows/select |
120+
||Microsoft.Sql/sqlservers/databases/SystemViewsAndFunctions/DatabaseSecurityState/rows/select |
121+
||Microsoft.Sql/sqlservers/SystemViewsAndFunctions/ServerSecurityMetadata/rows/select |
122+
||Microsoft.Sql/sqlservers/databases/SystemViewsAndFunctions/DatabaseSecurityMetadata/rows/select |
123+
|||
124+
125+
## Next steps
126+
Check the blog and related docs
127+
* Blog: [Microsoft Purview DevOps policies enable at scale access provisioning for IT operations](https://techcommunity.microsoft.com/t5/microsoft-purview-blog/microsoft-purview-devops-policies-enable-at-scale-access/ba-p/3604725)
128+
* Video: [Pre-requisite for policies: The "Data use management" option](https://youtu.be/v_lOzevLW-Q)
129+
* Video: [Microsoft Purview DevOps policies on data sources and resource groups](https://youtu.be/YCDJagrgEAI)
130+
* Video: [Reduce the effort with Microsoft Purview DevOps policies on resource groups](https://youtu.be/yMMXCeIFCZ8)
131+
* Doc: [Microsoft Purview DevOps policies on Azure SQL DB](./how-to-policies-devops-azure-sql-db.md)
132+
* Blog: [Deep dive on SQL Performance Monitor and SQL Security Auditor permissions](https://techcommunity.microsoft.com/t5/sql-server-blog/new-granular-permissions-for-sql-server-2022-and-azure-sql-to/ba-p/3607507)

0 commit comments

Comments
 (0)