|
| 1 | +--- |
| 2 | +title: Learn how to configure Azure Storage to de-identify documents with the de-identification service |
| 3 | +description: "Learn how to configure Azure Storage to de-identify documents with the de-identification service." |
| 4 | +author: jovinson-ms |
| 5 | +ms.author: jovinson |
| 6 | +ms.service: azure-health-data-services |
| 7 | +ms.subservice: deidentification-service |
| 8 | +ms.topic: tutorial |
| 9 | +ms.date: 11/01/2024 |
| 10 | + |
| 11 | +#customer intent: As an IT admin, I want to know how to configure an Azure Storage account to allow access to the de-identification service to de-identify documents. |
| 12 | + |
| 13 | +--- |
| 14 | + |
| 15 | +# Tutorial: Configure Azure Storage to de-identify documents |
| 16 | + |
| 17 | +The Azure Health Data Services de-identification service (preview) can de-identify documents in Azure Storage via an asynchronous job. If you have many documents that you would like |
| 18 | +to de-identify, using a job is a good option. Jobs also provide consistent surrogation, meaning that surrogate values in the de-identified output will match across |
| 19 | +all documents. For more information about de-identification, including consistent surrogation, see [What is the de-identification service (preview)?](overview.md) |
| 20 | + |
| 21 | +When you choose to store documents in Azure Blob Storage, you're charged based on Azure Storage pricing. This cost isn't included in the |
| 22 | + de-identification service pricing. [Explore Azure Blob Storage pricing](https://azure.microsoft.com/pricing/details/storage/blobs). |
| 23 | + |
| 24 | +In this tutorial, you: |
| 25 | + |
| 26 | +> [!div class="checklist"] |
| 27 | +> * Create a storage account and container |
| 28 | +> * Upload a sample document |
| 29 | +> * Grant the de-identification service access |
| 30 | +> * Configure network isolation |
| 31 | +
|
| 32 | +## Prerequisites |
| 33 | + |
| 34 | +* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F). |
| 35 | +* A de-identification service with system-assigned managed identity. [Deploy the de-identification service (preview)](quickstart.md). |
| 36 | + |
| 37 | +## Open Azure CLI |
| 38 | + |
| 39 | +Install [Azure CLI](/cli/azure/install-azure-cli) and open your terminal of choice. In this tutorial, we're using PowerShell. |
| 40 | + |
| 41 | +## Create a storage account and container |
| 42 | +1. Set your context, substituting the subscription name containing your de-identification service for the `<subscription_name>` placeholder: |
| 43 | + ```powershell |
| 44 | + az account set --subscription "<subscription_name>" |
| 45 | + ``` |
| 46 | +1. Save a variable for the resource group, substituting the resource group containing your de-identification service for the `<resource_group>` placeholder: |
| 47 | + ```powershell |
| 48 | + $ResourceGroup = "<resource_group>" |
| 49 | + ``` |
| 50 | +1. Create a storage account, providing a value for the `<storage_account_name>` placeholder: |
| 51 | + ```powershell |
| 52 | + $StorageAccountName = "<storage_account_name>" |
| 53 | + $StorageAccountId = $(az storage account create --name $StorageAccountName --resource-group $ResourceGroup --sku Standard_LRS --kind StorageV2 --min-tls-version TLS1_2 --allow-blob-public-access false --query id --output tsv) |
| 54 | + ``` |
| 55 | +1. Assign yourself a role to perform data operations on the storage account: |
| 56 | + ```powershell |
| 57 | + $UserId = $(az ad signed-in-user show --query id -o tsv) |
| 58 | + az role assignment create --role "Storage Blob Data Contributor" --assignee $UserId --scope $StorageAccountId |
| 59 | + ``` |
| 60 | +1. Create a container to hold your sample document: |
| 61 | + ```powershell |
| 62 | + az storage container create --account-name $StorageAccountName --name deidtest --auth-mode login |
| 63 | + ``` |
| 64 | +## Upload a sample document |
| 65 | +Next, you upload a document that contains synthetic PHI: |
| 66 | +```powershell |
| 67 | +$DocumentContent = "The patient came in for a visit on 10/12/2023 and was seen again November 4th at Contoso Hospital." |
| 68 | +az storage blob upload --data $DocumentContent --account-name $StorageAccountName --container-name deidtest --name deidsample.txt --auth-mode login |
| 69 | +``` |
| 70 | + |
| 71 | +## Grant the de-identification service access to the storage account |
| 72 | + |
| 73 | +In this step, you grant the de-identification service's system-assigned managed identity role-based access to the container. You grant the **Storage Blob |
| 74 | +Data Contributor** role because the de-identification service will both read the original document and write de-identified output documents. Substitute the name of |
| 75 | +your de-identification service for the `<deid_service_name>` placeholder: |
| 76 | +```powershell |
| 77 | +$DeidServicePrincipalId=$(az resource show -n <deid_service_name> -g $ResourceGroup --resource-type microsoft.healthdataaiservices/deidservices --query identity.principalId --output tsv) |
| 78 | +az role assignment create --assignee $DeidServicePrincipalId --role "Storage Blob Data Contributor" --scope $StorageAccountId |
| 79 | +``` |
| 80 | + |
| 81 | +## Configure network isolation on the storage account |
| 82 | +Next, you update the storage account to disable public network access and only allow access from trusted Azure services such as the de-identification service. |
| 83 | +After running this command, you won't be able to view the storage container contents without setting a network exception. |
| 84 | +Learn more at [Configure Azure Storage firewalls and virtual networks](/azure/storage/common/storage-network-security). |
| 85 | + |
| 86 | +```powershell |
| 87 | +az storage account update --name $StorageAccountName --public-network-access Disabled --bypass AzureServices |
| 88 | +``` |
| 89 | + |
| 90 | +## Clean up resources |
| 91 | +Once you're done with the storage account, you can delete the storage account and role assignments: |
| 92 | +```powershell |
| 93 | +az role assignment delete --assignee $DeidServicePrincipalId --role "Storage Blob Data Contributor" --scope $StorageAccountId |
| 94 | +az role assignment delete --assignee $UserId --role "Storage Blob Data Contributor" --scope $StorageAccountId |
| 95 | +az storage account delete --ids $StorageAccountId --yes |
| 96 | +``` |
| 97 | + |
| 98 | +## Next step |
| 99 | + |
| 100 | +> [!div class="nextstepaction"] |
| 101 | +> [Quickstart: Azure Health De-identification client library for .NET](quickstart-sdk-net.md) |
0 commit comments