Merge branch 'main' of https://github.com/MicrosoftDocs/azure-docs-pr into azuread-elm-configurationmyaccess

Author: ajburnle

articles/purview/how-to-enable-data-use-governance.md

@@ -6,7 +6,7 @@ ms.author: vlrodrig
 ms.service: purview
 ms.subservice: purview-data-policies
 ms.topic: how-to
-ms.date: 3/07/2022
+ms.date: 3/24/2022
 ms.custom:
 ---
 
@@ -56,8 +56,12 @@ To disable data use governance for a source, resource group, or subscription, a
 
 1. Set the **Data use governance** toggle to **Disabled**.
 
+## Delegation of access control responsibility to Azure Purview
+Note: 
+1.	Once a resource has been enabled for *Data use Governance*, **any** Azure Purview *policy author* will be able to create access policies against it, and **any** Azure Purview *Data source admin* will be able to publish those policies at **any point afterwards**.
+1.	**Any** Azure Purview *root collection admin* can create **new** *Data Source Admin* and *Policy author* roles.
 
-### Important considerations related to Data use governance
+## Additional considerations related to Data use governance
 - Make sure you write down the **Name** you use when registering in Azure Purview. You will need it when you publish a policy. The recommended practice is to make the registered name exactly the same as the endpoint name.
 - To disable a source for *Data use governance*, remove it first from being bound (i.e. published) in any policy.
 - While user needs to have both data source *Owner* and Azure Purview *Data source admin* to enable a source for *Data use governance*, either of those roles can independently disable it.
@@ -68,7 +72,7 @@ To disable data use governance for a source, resource group, or subscription, a
 > - Moving data sources to a different resource group or subscription is not yet supported. If want to do that, de-register the data source in Azure Purview before moving it and then register it again after that happens.
 > - Once a subscription gets disabled for *Data use governance* any underlying assets that are enabled for *Data use governance* will be disabled, which is the right behavior. However, policy statements based on those assets will still be allowed after that.
 
-### Data use governance best practices
+## Data use governance best practices
 - We highly encourage registering data sources for *Data use governance* and managing all associated access policies in a single Azure Purview account.
 - Should you have multiple Azure Purview accounts, be aware that **all** data sources belonging to a subscription must be registered for *Data use governance* in a single Azure Purview account. That Azure Purview account can be in any subscription in the tenant. The *Data use governance* toggle will become greyed out when there are invalid configurations. Some examples of valid and invalid configurations follow in the diagram below:
     - **Case 1** shows a valid configuration where a Storage account is registered in an Azure Purview account in the same subscription.
@@ -78,7 +82,6 @@ To disable data use governance for a source, resource group, or subscription, a
 
 ![Diagram shows valid and invalid configurations when using multiple Azure Purview accounts to manage policies.](./media/access-policies-common/valid-and-invalid-configurations.png)
 
-
 ## Next steps
 
 - [Create data owner policies for your resources](how-to-data-owner-policy-authoring-generic.md)

articles/purview/includes/access-policies-configuration-generic.md

@@ -41,3 +41,4 @@ Check the section on managing Azure Purview role assignments in this [guide](../
 > **Known issues** related to permissions
 > - In addition to Azure Purview *Policy authors* role, user requires *Directory Reader* permission in Azure Active Directory to create data owner policy. Learn more about permissions for [Azure AD Directory Reader](../../active-directory/roles/permissions-reference.md#directory-readers)
 > - Azure Purview *Policy author* role is not sufficient to create policies. It also requires Azure Purview *Data source admin* role as well.
+> - An issues has been reported when IAM Owner, which is required to enable Data use governance, is not directly applied to the data resource but instead inherited from a management group or a subscription. This issue is currently under investigation.