You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In this article, you'll learn how to use [Azure role-based access control (Azure RBAC)](../../role-based-access-control/index.yml) to assign access to the Azure API for FHIR data plane. Azure RBAC is the preferred methods for assigning data plane access when data plane users are managed in the Microsoft Entra tenant associated with your Azure subscription. If you're using an external Microsoft Entra tenant, refer to the [local RBAC assignment reference](configure-local-rbac.md).
16
+
In this article, you learn how to use [Azure role-based access control (Azure RBAC)](../../role-based-access-control/index.yml) to assign access to the Azure API for FHIR® data plane. Azure RBAC is the preferred methods for assigning data plane access when data plane users are managed in the Microsoft Entra tenant associated with your Azure subscription. If you're using an external Microsoft Entra tenant, refer to the [local RBAC assignment reference](configure-local-rbac.md).
17
17
18
18
## Confirm Azure RBAC mode
19
19
20
-
To use Azure RBAC, your Azure API for FHIR must be configured to use your Azure subscription tenant for data plane and there should be no assigned identity object IDs. You can verify your settings by inspecting the **Authentication** blade of your Azure API for FHIR:
20
+
To use Azure RBAC, your Azure API for FHIR must be configured to use your Azure subscription tenant for data plane, and there should be no assigned identity object IDs. You can verify your settings by inspecting the **Authentication** of your Azure API for FHIR:
The **Authority** should be set to the Microsoft Entra tenant associated with your subscription and there should be no GUIDs in the box labeled **Allowed object IDs**. You'll also notice that the box is disabled and a label indicates that Azure RBAC should be used to assign data plane roles.
24
+
The **Authority** should be set to the Microsoft Entra tenant associated with your subscription and there should be no GUIDs in the box labeled **Allowed object IDs**. Notice the box is disabled and a label indicates that Azure RBAC should be used to assign data plane roles.
25
25
26
26
## Assign roles
27
27
28
-
To grant users, service principals or groups access to the FHIR data plane, select **Access control (IAM)**, then select **Role assignments** and select **+ Add**:
28
+
To grant users, service principals, or groups access to the FHIR data plane, select **Access control (IAM)**, then select **Role assignments** and select **+ Add**.
29
29
30
30
:::image type="content" source="media/rbac/add-azure-rbac-role-assignment.png" alt-text="Add Azure role assignment":::
31
31
32
-
In the **Role** selection, search for one of the built-in roles for the FHIR data plane:
32
+
In the **Role** selection, search for one of the built-in roles for the FHIR data plane.
33
33
34
34
:::image type="content" source="media/rbac/built-in-fhir-data-roles.png" alt-text="Built-in FHIR data roles":::
35
35
36
-
You can choose between:
36
+
You can choose from among the following.
37
37
38
-
* FHIR Data Reader: Can read (and search) FHIR data.
39
-
* FHIR Data Writer: Can read, write, and soft delete FHIR data.
40
-
* FHIR Data Exporter: Can read and export (`$export` operator) data.
41
-
* FHIR Data Contributor: Can perform all data plane operations.
38
+
* FHIR Data Reader: Can read (and search) FHIR data
39
+
* FHIR Data Writer: Can read, write, and soft delete FHIR data
40
+
* FHIR Data Exporter: Can read and export (`$export` operator) data
41
+
* FHIR Data Contributor: Can perform all data plane operations
42
42
43
43
In the **Select** box, search for a user, service principal, or group that you wish to assign the role to.
44
44
@@ -48,7 +48,7 @@ In the **Select** box, search for a user, service principal, or group that you w
48
48
49
49
## Caching behavior
50
50
51
-
The Azure API for FHIR will cache decisions for up to 5 minutes. If you grant a user access to the FHIR server by adding them to the list of allowed object IDs, or you remove them from the list, you should expect it to take up to five minutes for changes in permissions to propagate.
51
+
The Azure API for FHIR caches decisions for up to 5 minutes. If you grant a user access to the FHIR server by adding them to the list of allowed object IDs, or you remove them from the list, you should expect it to take up to five minutes for changes in permissions to propagate.
52
52
53
53
## Next steps
54
54
@@ -72,4 +72,4 @@ In this article, you learned how to assign Azure roles for the FHIR data plane.
Azure API for FHIR supports [cross-origin resource sharing (CORS)](https://wikipedia.org/wiki/Cross-Origin_Resource_Sharing). CORS allows you to configure settings so that applications from one domain (origin) can access resources from a different domain, known as a cross-domain request.
15
+
Azure API for FHIR® supports [cross-origin resource sharing (CORS)](https://wikipedia.org/wiki/Cross-Origin_Resource_Sharing). CORS allows you to configure settings so that applications from one domain (origin) can access resources from a different domain, known as a cross-domain request.
16
16
17
17
CORS is often used in a single-page app that must call a RESTful API to a different domain.
18
18
19
19
## Configure CORS settings
20
20
21
-
To configure a CORS setting in the Azure API for FHIR, specify the following settings:
21
+
To configure a CORS setting in the Azure API for FHIR, specify the following settings.
22
22
23
23
-**Origins (Access-Control-Allow-Origin)**. A list of domains allowed to make cross-origin requests to the Azure API for FHIR. Each domain (origin) must be entered in a separate line. You can enter an asterisk (*) to allow calls from any domain, but we don't recommend it because it's a security risk.
24
24
@@ -42,4 +42,4 @@ In this article, you learned how to configure cross-origin resource sharing in A
42
42
>[!div class="nextstepaction"]
43
43
>[Deploy Azure API for FHIR](fhir-paas-portal-quickstart.md)
44
44
45
-
FHIR® is a registered trademark of [HL7](https://hl7.org/fhir/) and is used with the permission of HL7.
Azure API for FHIR uses database to store its data. Performance of the underlying database depends on the number of Request Units (RU) selected during service provisioning or in database settings after the service has been provisioned.
Azure API for FHIR borrows the concept of [Request Units (RUs) in Azure Cosmos DB](/azure/cosmos-db/request-units)) when setting the performance of underlying database.
16
+
Azure API for FHIR® uses a database to store its data. Performance of the underlying database depends on the number of Request Units (RU) selected during service provisioning or in database settings after the service has been provisioned.
18
17
19
-
Throughput must be provisioned to ensure that sufficient system resources are available for your database at all times. How many RUs you need for your application depends on operations you perform. Operations can range from simple read and writes to more complex queries.
18
+
Azure API for FHIR borrows the concept of [Request Units (RUs) in Azure Cosmos DB](/azure/cosmos-db/request-units) when setting the performance of underlying database.
19
+
20
+
Throughput must be provisioned to ensure that sufficient system resources are always available for your database. How many RUs you need for your application depends on operations you perform. Operations can range from simple read and writes to more complex queries.
20
21
21
22
> [!NOTE]
22
-
> As different operations consume different number of RU, we return the actual number of RUs consumed in every API call in response header. This way you can profile the number of RUs consumed by your application.
23
+
> As different operations consume a different number of RUs, we return the actual number of RUs consumed in every API call in the response header. This way you can profile the number of RUs consumed by your application.
23
24
24
25
## Update throughput
25
26
@@ -28,7 +29,7 @@ To change this setting in the Azure portal, navigate to your Azure API for FHIR
28
29
If the database throughput is greater than 10,000 RU/s or if the data stored in the database is more than 50 GB, your client application must be capable of handling continuation tokens. A new partition is created in the database for every throughput increase of 10,000 RU/s or if the amount of data stored is more than 50 GB. Multiple partitions create a multi-page response in which pagination is implemented by using continuation tokens.
29
30
30
31
> [!NOTE]
31
-
> Higher value means higher Azure API for FHIR throughput and higher cost of the service.
32
+
> A higher RU value means higher Azure API for FHIR throughput and higher cost of the service.
Azure API for FHIR supports the $export command, which allows you to export the data out of an Azure API for FHIR instance to a storage account.
16
+
Azure API for FHIR® supports the `$export` command, which allows you to export the data out of an Azure API for FHIR instance to a storage account.
17
17
18
18
The steps are:
19
19
@@ -43,21 +43,21 @@ It's here that you add the role [Storage Blob Data Contributor](../../role-based
Next, select the storage account in Azure API for FHIR as a default storage account for $export.
46
+
Next, select the storage account in Azure API for FHIR as a default storage account for `$export`.
47
47
48
48
## Select the storage account for $export
49
49
50
50
The final step is to assign the Azure storage account to export the data to. Go to **Export** in Azure API for FHIR and then select the storage account.
51
51
52
52
:::image type="content" source="media/export-data/fhir-export-storage.png" alt-text="Screenshot showing selection of the storage account for export." lightbox="media/export-data/fhir-export-storage.png":::
53
53
54
-
After you complete this final step, you’re ready to export the data by using the $export command.
54
+
After you complete this final step, you’re ready to export the data by using the `$export` command.
55
55
56
56
> [!Note]
57
-
> Only storage accounts in the same subscription as Azure API for FHIR can be registered as the destination for $export operations.
57
+
> Only storage accounts in the same subscription as Azure API for FHIR can be registered as the destination for `$export` operations.
This article explains how to configure the Azure API for FHIR to use a secondary Microsoft Entra tenant for data access. Use this mode only if it isn't possible for you to use the Microsoft Entra tenant associated with your subscription.
17
+
This article explains how to configure the Azure API for FHIR® to use a secondary Microsoft Entra tenant for data access. Use this mode only if it isn't possible for you to use the Microsoft Entra tenant associated with your subscription.
18
18
19
19
> [!NOTE]
20
20
> If your FHIR service is configured to use your primary Microsoft Entra tenant associated with your subscription, [use Azure RBAC to assign data plane roles](configure-azure-rbac.md).
21
21
22
22
## Add a new service principal or use an existing one
23
23
24
-
Local RBAC allows you to use a service principal in the secondary Microsoft Entra tenant with your FHIR server. You can create a new service principal through the Azure portal, PowerShell or CLI commands, or use an existing service principal. The process is also known as [application registration](../register-application.md). You can review and modify the service principals through Microsoft Entra ID from the portal or using scripts.
24
+
Local role-based access control (RBAC) allows you to use a service principal in the secondary Microsoft Entra tenant with your FHIR server. You can create a new service principal through the Azure portal, PowerShell or CLI commands, or use an existing service principal. The process is also known as [application registration](../register-application.md). You can review and modify the service principals through Microsoft Entra ID from the portal or using scripts.
25
25
26
-
The PowerShell and CLI scripts below, which are tested and validated in Visual Studio Code, create a new service principal (or client application), and add a client secret. The service principal ID is used for local RBAC and the application ID and client secret will be used to access the FHIR service later.
26
+
The following PowerShell and CLI scripts, which are tested and validated in Visual Studio Code, create a new service principal (or client application), and add a client secret. The service principal ID is used for local RBAC and the application ID and client secret is used to access the FHIR service later.
In the authority box, enter a valid secondary Microsoft Entra tenant. Once the tenant has been validated, the **Allowed object IDs** box should be activated and you can enter one or a list of Microsoft Entra service principal object IDs. These IDs can be the identity object IDs of:
57
+
In the authority box, enter a valid secondary Microsoft Entra tenant. Once the tenant is validated, the **Allowed object IDs** box should be activated and you can enter one or a list of Microsoft Entra service principal object IDs. These IDs can be the identity object IDs of:
58
58
59
59
* A Microsoft Entra user.
60
60
* A Microsoft Entra service principal.
@@ -71,16 +71,16 @@ The local RBAC setting is only visible from the authentication blade; it isn't v
71
71
72
72
## Caching behavior
73
73
74
-
The Azure API for FHIR will cache decisions for up to 5 minutes. If you grant a user access to the FHIR server by adding them to the list of allowed object IDs, or you remove them from the list, you should expect it to take up to five minutes for changes in permissions to propagate.
74
+
The Azure API for FHIR caches decisions for up to 5 minutes. If you grant a user access to the FHIR server by adding them to the list of allowed object IDs, or you remove them from the list, you should expect it to take up to five minutes for changes in permissions to propagate.
75
75
76
76
## Next steps
77
77
78
-
In this article, you learned how to assign FHIR data plane access using an external (secondary) Microsoft Entra tenant. Next learn about additional settings for the Azure API for FHIR:
78
+
In this article, you learned how to assign FHIR data plane access using an external (secondary) Microsoft Entra tenant. Next learn about additional settings for the Azure API for FHIR.
0 commit comments