You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There are three types of service accounts in Azure Active Directory (Azure AD): [managed identities](service-accounts-managed-identities.md), [service principals](service-accounts-principal.md), and user accounts employed as service accounts. As you create these service accounts for automated use, they're granted permissions to access resources in Azure and Azure AD. Resources can include Microsoft 365 services, software as a service (SaaS) applications, custom applications, databases, HR systems, and so on. Governing Azure AD service accounts means that you manage their creation, permissions, and lifecycle to ensure security and continuity.
21
21
22
22
> [!IMPORTANT]
23
-
> We do not recommend using user accounts as service accounts as they are inherently less secure. This includes on-premises service accounts that are synced to Azure AD, as they are not converted to service principals. Instead, we recommend the use of managed identities or service principals. Note that at this time the use of conditional access policies is not possible with service principals, but the functionality is coming.
23
+
> We do not recommend using user accounts as service accounts as they are inherently less secure. This includes on-premises service accounts that are synced to Azure AD, as they are not converted to service principals. Instead, we recommend the use of managed identities or service principals. Note that at this time the use of conditional access policies with service principals is called Conditional Access for workload identities and it's in public preview.
Copy file name to clipboardExpand all lines: articles/cognitive-services/LUIS/luis-reference-regions.md
+1Lines changed: 1 addition & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -75,6 +75,7 @@ The authoring region app can only be published to a corresponding publish region
75
75
| Asia |`westus`<br>[www.luis.ai][www.luis.ai]| East Asia<br>`eastasia`|`https://eastasia.api.cognitive.microsoft.com/luis/v2.0/apps/YOUR-APP-ID?subscription-key=YOUR-SUBSCRIPTION-KEY`|
76
76
| Asia |`westus`<br>[www.luis.ai][www.luis.ai]| Japan East<br>`japaneast`|`https://japaneast.api.cognitive.microsoft.com/luis/v2.0/apps/YOUR-APP-ID?subscription-key=YOUR-SUBSCRIPTION-KEY`|
77
77
| Asia |`westus`<br>[www.luis.ai][www.luis.ai]| Japan West<br>`japanwest`|`https://japanwest.api.cognitive.microsoft.com/luis/v2.0/apps/YOUR-APP-ID?subscription-key=YOUR-SUBSCRIPTION-KEY`|
78
+
| Asia |`westus`<br>[www.luis.ai][www.luis.ai]| Jio India West<br>`jioindiawest`|`https://jioindiawest.api.cognitive.microsoft.com/luis/v2.0/apps/YOUR-APP-ID?subscription-key=YOUR-SUBSCRIPTION-KEY`|
78
79
| Asia |`westus`<br>[www.luis.ai][www.luis.ai]| Korea Central<br>`koreacentral`|`https://koreacentral.api.cognitive.microsoft.com/luis/v2.0/apps/YOUR-APP-ID?subscription-key=YOUR-SUBSCRIPTION-KEY`|
79
80
| Asia |`westus`<br>[www.luis.ai][www.luis.ai]| Southeast Asia<br>`southeastasia`|`https://southeastasia.api.cognitive.microsoft.com/luis/v2.0/apps/YOUR-APP-ID?subscription-key=YOUR-SUBSCRIPTION-KEY`|
80
81
| Asia |`westus`<br>[www.luis.ai][www.luis.ai]| North UAE<br>`northuae`|`https://northuae.api.cognitive.microsoft.com/luis/v2.0/apps/YOUR-APP-ID?subscription-key=YOUR-SUBSCRIPTION-KEY`|
Copy file name to clipboardExpand all lines: articles/event-hubs/apache-kafka-frequently-asked-questions.yml
+7Lines changed: 7 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -38,6 +38,13 @@ sections:
38
38
- They fully distinct from Event Hubs consumer groups. You **don't** need to use '$Default', nor do you need to worry about Kafka clients interfering with AMQP workloads.
39
39
- They aren't viewable in the Azure portal. Consumer group info is accessible via Kafka APIs.
40
40
41
+
- question: |
42
+
Does Azure Event Hubs for Apache Kafka support shared access signature token authentication?
43
+
answer: |
44
+
Authenticating by using [OAuth 2.0 and shared access signature](event-hubs-for-kafka-ecosystem-overview.md#security-and-authentication) is supported.
45
+
46
+
Shared access signature tokens are [generated](authenticate-shared-access-signature.md#generate-a-shared-access-signature-token) by using an authorization rule and one of its signing keys. This is not supported when using the Event Hubs for Apache Kafka endpoint.
> When using SAS authentication with Kafka clients, established connections aren't disconnected when the SAS key is regenerated.
81
81
82
+
> [!NOTE]
83
+
> [Generated shared access signature tokens](authenticate-shared-access-signature.md#generate-a-shared-access-signature-token) are not supported when using the Event Hubs for Apache Kafka endpoint.
82
84
83
85
#### Samples
84
86
For a **tutorial** with step-by-step instructions to create an event hub and access it using SAS or OAuth, see [Quickstart: Data streaming with Event Hubs using the Kafka protocol](event-hubs-quickstart-kafka-enabled-event-hubs.md).
Copy file name to clipboardExpand all lines: articles/iot-hub/iot-hub-message-enrichments-overview.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -35,7 +35,7 @@ The **value** can be any of the following examples:
35
35
* Information from the device twin, such as its path. Examples would be *$twin.tags.field* and *$twin.tags.latitude*.
36
36
37
37
> [!NOTE]
38
-
> At this time, only $iothubname, $twin.tags, $twin.properties.desired, and $twin.properties.reported are supported variables for message enrichment.
38
+
> At this time, only $iothubname, $twin.tags, $twin.properties.desired, and $twin.properties.reported are supported variables for message enrichment. Additionally, only primitive types are supported for enrichments. Messages cannot be enriched with object types.
39
39
40
40
Message Enrichments are added as application properties to messages sent to chosen endpoint(s).
Copy file name to clipboardExpand all lines: articles/purview/register-scan-synapse-workspace.md
+11-4Lines changed: 11 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,7 +39,7 @@ This section describes how to register Azure Synapse Analytics workspaces in Azu
39
39
40
40
### Authentication for registration
41
41
42
-
Only users with at least a *Reader* role on the Azure Synapse workspace who is also *data source administrators* in Azure Purview can register an Azure Synapse workspace.
42
+
Only a user with at least a *Reader* role on the Azure Synapse workspace and who is also *data source administrators* in Azure Purview can register an Azure Synapse workspace.
43
43
44
44
### Steps to register
45
45
@@ -87,7 +87,9 @@ Then, you will need to [apply permissions to scan the contents of the workspace]
87
87
88
88
### Authentication for enumerating serverless SQL database resources
89
89
90
-
There are three places you will need to set authentication to allow Azure Purview to enumerate your serverless SQL database resources: the Synapse workspace, the associated storage, and on the Serverless databases. The steps below will set permissions for all three.
90
+
There are three places you will need to set authentication to allow Azure Purview to enumerate your serverless SQL database resources: The Azure Synapse workspace, the associated storage, and the Azure Synapse serverless databases. The steps below will set permissions for all three.
91
+
92
+
#### Azure Synapse workspace
91
93
92
94
1. In the Azure portal, go to the Azure Synapse workspace resource.
93
95
1. On the left pane, select **Access Control (IAM)**.
@@ -98,15 +100,20 @@ There are three places you will need to set authentication to allow Azure Purvie
98
100
1. Select the **Add** button.
99
101
1. Set the **Reader** role and enter your Azure Purview account name, which represents its managed service identity (MSI).
100
102
1. Select **Save** to finish assigning the role.
101
-
1. In the Azure portal, go to the **Resource group** or **Subscription** that the Azure Synapse workspace is in.
103
+
104
+
#### Storage account
105
+
106
+
1. In the Azure portal, go to the **Resource group** or **Subscription** that the storage account associated with the Azure Synapse workspace is in.
102
107
1. On the left pane, select **Access Control (IAM)**.
103
108
104
109
> [!NOTE]
105
110
> You must be an *owner* or *user access administrator* to add a role in the **Resource group** or **Subscription** fields.
106
-
107
111
1. Select the **Add** button.
108
112
1. Set the **Storage blob data reader** role and enter your Azure Purview account name (which represents its MSI) in the **Select** box.
109
113
1. Select **Save** to finish assigning the role.
114
+
115
+
#### Azure Synapse serverless database
116
+
110
117
1. Go to your Azure Synapse workspace and open the Synapse Studio.
111
118
1. Select the **Data** tab on the left menu.
112
119
1. Select the ellipsis (**...**) next to one of your databases, and then start a new SQL script.
0 commit comments