Skip to content

Commit 7796d29

Browse files
PRMerger6PRMerger6
authored
Merge pull request #207500 from Clare-Zheng82/Update_SQL_docs_auth_section
Update SQL docs linked service section
2 parents 38519d1 + 13436c9 commit 7796d29

File tree

3 files changed

+66
-30
lines changed

3 files changed

+66
-30
lines changed

‎articles/data-factory/connector-azure-sql-data-warehouse.md

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: data-factory
88
ms.subservice: data-movement
99
ms.custom: synapse
1010
ms.topic: conceptual
11-
ms.date: 07/04/2022
11+
ms.date: 08/11/2022
1212
---
1313

1414
# Copy and transform data in Azure Synapse Analytics by using Azure Data Factory or Synapse pipelines
@@ -81,20 +81,16 @@ The following sections provide details about properties that define Data Factory
8181

8282
## Linked service properties
8383

84-
The following properties are supported for an Azure Synapse Analytics linked service:
84+
These generic properties are supported for an Azure Synapse Analytics linked service:
8585

8686
| Property | Description | Required |
8787
| :------------------ | :----------------------------------------------------------- | :----------------------------------------------------------- |
8888
| type | The type property must be set to **AzureSqlDW**. | Yes |
8989
| connectionString | Specify the information needed to connect to the Azure Synapse Analytics instance for the **connectionString** property. <br/>Mark this field as a SecureString to store it securely. You can also put password/service principal key in Azure Key Vault，and if it's SQL authentication pull the `password` configuration out of the connection string. See the JSON example below the table and [Store credentials in Azure Key Vault](store-credentials-in-key-vault.md) article with more details. | Yes |
90-
| servicePrincipalId | Specify the application's client ID. | Yes, when you use Azure AD authentication with a service principal. |
91-
| servicePrincipalKey | Specify the application's key. Mark this field as a SecureString to store it securely, or [reference a secret stored in Azure Key Vault](store-credentials-in-key-vault.md). | Yes, when you use Azure AD authentication with a service principal. |
92-
| tenant | Specify the tenant information (domain name or tenant ID) under which your application resides. You can retrieve it by hovering the mouse in the top-right corner of the Azure portal. | Yes, when you use Azure AD authentication with a service principal. |
9390
| azureCloudType | For service principal authentication, specify the type of Azure cloud environment to which your Azure AD application is registered. <br/> Allowed values are `AzurePublic`, `AzureChina`, `AzureUsGovernment`, and `AzureGermany`. By default, the data factory or Synapse pipeline's cloud environment is used. | No |
94-
| credentials | Specify the user-assigned managed identity as the credential object. | Yes, when you use user-assigned managed identity authentication. |
9591
| connectVia | The [integration runtime](concepts-integration-runtime.md) to be used to connect to the data store. You can use Azure Integration Runtime or a self-hosted integration runtime (if your data store is located in a private network). If not specified, it uses the default Azure Integration Runtime. | No |
9692

97-
For different authentication types, refer to the following sections on prerequisites and JSON samples, respectively:
93+
For different authentication types, refer to the following sections on specific properties, prerequisites and JSON samples, respectively:
9894

9995
- [SQL authentication](#sql-authentication)
10096
- [Service principal authentication](#service-principal-authentication)
@@ -109,6 +105,8 @@ For different authentication types, refer to the following sections on prerequis
109105
110106
### SQL authentication
111107

108+
To use SQL authentication authentication type, specify the generic properties that are described in the preceding section.
109+
112110
#### Linked service example that uses SQL authentication
113111

114112
```json
@@ -155,7 +153,15 @@ For different authentication types, refer to the following sections on prerequis
155153

156154
### Service principal authentication
157155

158-
To use service principal-based Azure AD application token authentication, follow these steps:
156+
To use service principal authentication, in addition to the generic properties that are described in the preceding section, specify the following properties:
157+
158+
| Property | Description | Required |
159+
| :------------------ | :----------------------------------------------------------- | :----------------------------------------------------------- |
160+
| servicePrincipalId | Specify the application's client ID. | Yes |
161+
| servicePrincipalKey | Specify the application's key. Mark this field as a SecureString to store it securely, or [reference a secret stored in Azure Key Vault](store-credentials-in-key-vault.md). | Yes |
162+
| tenant | Specify the tenant information (domain name or tenant ID) under which your application resides. You can retrieve it by hovering the mouse in the top-right corner of the Azure portal. | Yes |
163+
164+
You also need to follow the steps below:
159165

160166
1. **[Create an Azure Active Directory application](../active-directory/develop/howto-create-service-principal-portal.md#register-an-application-with-azure-ad-and-create-a-service-principal)** from the Azure portal. Make note of the application name and the following values that define the linked service:
161167

@@ -207,7 +213,7 @@ To use service principal-based Azure AD application token authentication, follow
207213

208214
A data factory or Synapse workspace can be associated with a [system-assigned managed identity for Azure resources](data-factory-service-identity.md#system-assigned-managed-identity) that represents the resource. You can use this managed identity for Azure Synapse Analytics authentication. The designated resource can access and copy data from or to your data warehouse by using this identity.
209215

210-
To use system-assigned managed identity authentication, follow these steps:
216+
To use system-assigned managed identity authentication, specify the generic properties that are described in the preceding section, and follow these steps.
211217

212218
1. **[Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database)** for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or Azure AD group. If you grant the group with system-assigned managed identity an admin role, skip steps 3 and 4. The administrator will have full access to the database.
213219

@@ -246,7 +252,13 @@ To use system-assigned managed identity authentication, follow these steps:
246252

247253
A data factory or Synapse workspace can be associated with a [user-assigned managed identities](data-factory-service-identity.md#user-assigned-managed-identity) that represents the resource. You can use this managed identity for Azure Synapse Analytics authentication. The designated resource can access and copy data from or to your data warehouse by using this identity.
248254

249-
To use user-assigned managed identity authentication, follow these steps:
255+
To use user-assigned managed identity authentication, in addition to the generic properties that are described in the preceding section, specify the following properties:
256+
257+
| Property | Description | Required |
258+
| :------------------ | :----------------------------------------------------------- | :--------------- |
259+
| credentials | Specify the user-assigned managed identity as the credential object. | Yes |
260+
261+
You also need to follow the steps below:
250262

251263
1. **[Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database)** for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or Azure AD group. If you grant the group with user-assigned managed identity an admin role, skip steps 3. The administrator will have full access to the database.
252264

‎articles/data-factory/connector-azure-sql-database.md

Lines changed: 22 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ ms.service: data-factory
88
ms.subservice: data-movement
99
ms.topic: conceptual
1010
ms.custom: synapse
11-
ms.date: 07/04/2022
11+
ms.date: 08/10/2022
1212
---
1313

1414
# Copy and transform data in Azure SQL Database by using Azure Data Factory or Azure Synapse Analytics
@@ -84,21 +84,17 @@ The following sections provide details about properties that are used to define
8484

8585
## Linked service properties
8686

87-
These properties are supported for an Azure SQL Database linked service:
87+
These generic properties are supported for an Azure SQL Database linked service:
8888

8989
| Property | Description | Required |
9090
|:--- |:--- |:--- |
9191
| type | The **type** property must be set to **AzureSqlDatabase**. | Yes |
9292
| connectionString | Specify information needed to connect to the Azure SQL Database instance for the **connectionString** property. <br/>You also can put a password or service principal key in Azure Key Vault. If it's SQL authentication, pull the `password` configuration out of the connection string. For more information, see the JSON example following the table and [Store credentials in Azure Key Vault](store-credentials-in-key-vault.md). | Yes |
93-
| servicePrincipalId | Specify the application's client ID. | Yes, when you use Azure AD authentication with a service principal |
94-
| servicePrincipalKey | Specify the application's key. Mark this field as **SecureString** to store it securely or [reference a secret stored in Azure Key Vault](store-credentials-in-key-vault.md). | Yes, when you use Azure AD authentication with a service principal |
95-
| tenant | Specify the tenant information, like the domain name or tenant ID, under which your application resides. Retrieve it by hovering the mouse in the upper-right corner of the Azure portal. | Yes, when you use Azure AD authentication with a service principal |
9693
| azureCloudType | For service principal authentication, specify the type of Azure cloud environment to which your Azure AD application is registered. <br/> Allowed values are **AzurePublic**, **AzureChina**, **AzureUsGovernment**, and **AzureGermany**. By default, the data factory or Synapse pipeline's cloud environment is used. | No |
9794
| alwaysEncryptedSettings | Specify **alwaysencryptedsettings** information that's needed to enable Always Encrypted to protect sensitive data stored in SQL server by using either managed identity or service principal. For more information, see the JSON example following the table and [Using Always Encrypted](#using-always-encrypted) section. If not specified, the default always encrypted setting is disabled. |No |
98-
| credentials | Specify the user-assigned managed identity as the credential object. | Yes, when you use user-assigned managed identity authentication |
9995
| connectVia | This [integration runtime](concepts-integration-runtime.md) is used to connect to the data store. You can use the Azure integration runtime or a self-hosted integration runtime if your data store is located in a private network. If not specified, the default Azure integration runtime is used. | No |
10096

101-
For different authentication types, refer to the following sections on prerequisites and JSON samples, respectively:
97+
For different authentication types, refer to the following sections on specific properties, prerequisites and JSON samples, respectively:
10298

10399
- [SQL authentication](#sql-authentication)
104100
- [Service principal authentication](#service-principal-authentication)
@@ -110,6 +106,8 @@ For different authentication types, refer to the following sections on prerequis
110106
111107
### SQL authentication
112108

109+
To use SQL authentication authentication type, specify the generic properties that are described in the preceding section.
110+
113111
**Example: using SQL authentication**
114112

115113
```json
@@ -182,7 +180,15 @@ For different authentication types, refer to the following sections on prerequis
182180

183181
### Service principal authentication
184182

185-
To use a service principal-based Azure AD application token authentication, follow these steps:
183+
To use service principal authentication, in addition to the generic properties that are described in the preceding section, specify the following properties:
184+
185+
| Property | Description | Required |
186+
|:--- |:--- |:--- |
187+
| servicePrincipalId | Specify the application's client ID. | Yes |
188+
| servicePrincipalKey | Specify the application's key. Mark this field as **SecureString** to store it securely or [reference a secret stored in Azure Key Vault](store-credentials-in-key-vault.md). | Yes |
189+
| tenant | Specify the tenant information, like the domain name or tenant ID, under which your application resides. Retrieve it by hovering the mouse in the upper-right corner of the Azure portal.| Yes |
190+
191+
You also need to follow the steps below:
186192

187193
1. [Create an Azure Active Directory application](../active-directory/develop/howto-create-service-principal-portal.md#register-an-application-with-azure-ad-and-create-a-service-principal) from the Azure portal. Make note of the application name and the following values that define the linked service:
188194

@@ -234,7 +240,7 @@ To use a service principal-based Azure AD application token authentication, foll
234240

235241
A data factory or Synapse workspace can be associated with a [system-assigned managed identity for Azure resources](data-factory-service-identity.md#system-assigned-managed-identity) that represents the service when authenticating to other resources in Azure. You can use this managed identity for Azure SQL Database authentication. The designated factory or Synapse workspace can access and copy data from or to your database by using this identity.
236242

237-
To use system-assigned managed identity authentication, follow these steps.
243+
To use system-assigned managed identity authentication, specify the generic properties that are described in the preceding section, and follow these steps.
238244

239245
1. [Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database) for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or an Azure AD group. If you grant the group with managed identity an admin role, skip steps 3 and 4. The administrator has full access to the database.
240246

@@ -274,7 +280,13 @@ To use system-assigned managed identity authentication, follow these steps.
274280

275281
A data factory or Synapse workspace can be associated with a [user-assigned managed identities](data-factory-service-identity.md#user-assigned-managed-identity) that represents the service when authenticating to other resources in Azure. You can use this managed identity for Azure SQL Database authentication. The designated factory or Synapse workspace can access and copy data from or to your database by using this identity.
276282

277-
To use user-assigned managed identity authentication, follow these steps.
283+
To use user-assigned managed identity authentication, in addition to the generic properties that are described in the preceding section, specify the following properties:
284+
285+
| Property | Description | Required |
286+
|:--- |:--- |:--- |
287+
| credentials | Specify the user-assigned managed identity as the credential object. | Yes |
288+
289+
You also need to follow the steps below:
278290

279291
1. [Provision an Azure Active Directory administrator](/azure/azure-sql/database/authentication-aad-configure#provision-azure-ad-admin-sql-database) for your server on the Azure portal if you haven't already done so. The Azure AD administrator can be an Azure AD user or an Azure AD group. If you grant the group with user-assigned managed identity an admin role, skip steps 3. The administrator has full access to the database.
280292

0 commit comments

Comments
 (0)