You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/purview/how-to-policies-devops-arc-sql-server.md
+6-62Lines changed: 6 additions & 62 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -63,70 +63,14 @@ Follow this link for the steps to [delete a DevOps policies in Microsoft Purview
63
63
>[!Important]
64
64
> DevOps policies are auto-published and changes can take up to **5 minutes** to be enforced by the data source.
65
65
66
-
## Test the policy
66
+
## Test the DevOps policy
67
+
See how to [test the policy you created](./how-to-policies-devops-authoring-generic.md#test-the-devops-policy)
67
68
68
-
The Azure AD Accounts referenced in the access policies should now be able to connect to any database in the server to which the policies are published.
69
+
## Role definition detail
70
+
See the [mapping of DevOps role to data source actions](./how-to-policies-devops-authoring-generic.md#role-definition-detail)
69
71
70
-
### Force policy download
71
-
It is possible to force an immediate download of the latest published policies to the current SQL database by running the following command. The minimal permission required to run it is membership in ##MS_ServerStateManager##-server role.
72
-
73
-
```sql
74
-
-- Force immediate download of latest published policies
75
-
exec sp_external_policy_refresh reload
76
-
```
77
-
78
-
### Analyze downloaded policy state from SQL
79
-
The following DMVs can be used to analyze which policies have been downloaded and are currently assigned to Azure AD accounts. The minimal permission required to run them is VIEW DATABASE SECURITY STATE - or assigned Action Group *SQL Security Auditor*.
80
-
81
-
```sql
82
-
83
-
-- Lists generally supported actions
84
-
SELECT*FROMsys.dm_server_external_policy_actions
85
-
86
-
-- Lists the roles that are part of a policy published to this server
87
-
SELECT*FROMsys.dm_server_external_policy_roles
88
-
89
-
-- Lists the links between the roles and actions, could be used to join the two
* Blog: [Microsoft Purview DevOps policies enter General Availability](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/microsoft-purview-devops-policies-enter-ga-simplify-access/ba-p/3674057)
127
-
* Blog: [Microsoft Purview DevOps policies enable at scale access provisioning for IT operations](https://techcommunity.microsoft.com/t5/microsoft-purview-blog/microsoft-purview-devops-policies-enable-at-scale-access/ba-p/3604725)
Copy file name to clipboardExpand all lines: articles/purview/how-to-policies-devops-authoring-generic.md
+5-6Lines changed: 5 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -79,10 +79,10 @@ To delete a DevOps policy, ensure first that you have the Microsoft Purview Poli
79
79
1. Check one of the policies and then select **Delete** as shown in the following screenshot:
80
80
81
81
82
-
## Test a DevOps policy
82
+
## Test the DevOps policy
83
83
After creating the policy, any of the Azure AD users in the Subject should now be able to connect to the data sources in the scope of the policy. To test, use SSMS or any SQL client and try to query some DMVs/DMFs. We list here some examples. For more, you can consult the [Microsoft Purview DevOps policies concept guide](/azure/purview/concept-policies-devops.md#mapping-of-popular-dmvsdmfs)
84
84
85
-
### Testing access for SQL Performance Monitor
85
+
### Testing SQL Performance Monitor access
86
86
If you provided the Subject(s) of the policy SQL Performance Monitor role, you can issue the following commands
87
87
```sql
88
88
-- Returns I/O statistics for data and log files
@@ -92,7 +92,7 @@ SELECT wait_type, wait_time_ms FROM sys.dm_os_wait_stats
92
92
```
93
93
94
94
95
-
### Testing access for SQL Security Auditor
95
+
### Testing SQL Security Auditor access
96
96
If you provided the Subject(s) of the policy SQL Security Auditor role, you can issue the following commands from SSMS or any SQL client
97
97
```sql
98
98
-- Returns the current state of the audit
@@ -101,7 +101,7 @@ SELECT * FROM sys.dm_server_audit_status
101
101
SELECT*FROMsys.dm_database_encryption_keys
102
102
```
103
103
104
-
### Ensure there is no access to user data
104
+
### Ensure no access to user data
105
105
Next, try accessing a table in one of the databases. The Azure AD principal you are testing with should be denied, which means the data is protected from insider threat
106
106
107
107
```sql
@@ -112,8 +112,7 @@ SELECT * FROM [databaseName].schemaName.tableName
112
112
113
113
114
114
115
-
## Policy action mapping
116
-
115
+
## Role definition detail
117
116
This section contains a reference of how actions in Microsoft Purview data policies map to specific actions in Azure SQL MI.
118
117
119
118
|**DevOps role definition**|**Data source specific actions**|
Copy file name to clipboardExpand all lines: articles/purview/how-to-policies-devops-azure-sql-db.md
+5-63Lines changed: 5 additions & 63 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,71 +49,13 @@ Follow this link for the steps to [delete a DevOps policies in Microsoft Purview
49
49
>[!Important]
50
50
> DevOps policies are auto-published and changes can take up to **5 minutes** to be enforced by the data source.
51
51
52
-
## Test the policy
53
-
The Azure AD Accounts referenced in the access policies should now be able to connect to any database in the server to which the policies are published.
52
+
## Test the DevOps policy
53
+
See how to [test the policy you created](./how-to-policies-devops-authoring-generic.md#test-the-devops-policy)
54
54
55
-
### Force policy download
56
-
It is possible to force an immediate download of the latest published policies to the current SQL database by running the following command. The minimal permission required to run it is membership in ##MS_ServerStateManager##-server role.
57
-
58
-
```sql
59
-
-- Force immediate download of latest published policies
60
-
exec sp_external_policy_refresh reload
61
-
```
62
-
63
-
### Analyze downloaded policy state from SQL
64
-
The following DMVs can be used to analyze which policies have been downloaded and are currently assigned to Azure AD accounts. The minimal permission required to run them is VIEW DATABASE SECURITY STATE - or assigned Action Group *SQL Security Auditor*.
65
-
66
-
```sql
67
-
68
-
-- Lists generally supported actions
69
-
SELECT*FROMsys.dm_server_external_policy_actions
70
-
71
-
-- Lists the roles that are part of a policy published to this server
72
-
SELECT*FROMsys.dm_server_external_policy_roles
73
-
74
-
-- Lists the links between the roles and actions, could be used to join the two
See the [mapping of DevOps role to data source actions](./how-to-policies-devops-authoring-generic.md#role-definition-detail)
108
57
109
58
## Next steps
110
-
Check the blogs, videos and related docs
111
-
* Blog: [Microsoft Purview DevOps policies enter General Availability](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/microsoft-purview-devops-policies-enter-ga-simplify-access/ba-p/3674057)
112
-
* Blog: [Microsoft Purview DevOps policies enable at scale access provisioning for IT operations](https://techcommunity.microsoft.com/t5/microsoft-purview-blog/microsoft-purview-devops-policies-enable-at-scale-access/ba-p/3604725)
Copy file name to clipboardExpand all lines: articles/purview/how-to-policies-devops-resource-group.md
+5-10Lines changed: 5 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -54,16 +54,11 @@ Follow this link for the steps to [update a DevOps policies in Microsoft Purview
54
54
## Delete a DevOps policy
55
55
Follow this link for the steps to [delete a DevOps policies in Microsoft Purview](how-to-policies-devops-authoring-generic.md#delete-a-devops-policy).
56
56
57
+
## Test the DevOps policy
58
+
See how to [test the policy you created](./how-to-policies-devops-authoring-generic.md#test-the-devops-policy)
57
59
58
-
### Test the policy
59
-
To test the policy see the DevOps policy guides for the underlying data sources listed in the [next steps section](#next-steps) of this document.
60
+
##Role definition detail
61
+
See the [mapping of DevOps role to data source actions](./how-to-policies-devops-authoring-generic.md#role-definition-detail)
60
62
61
63
## Next steps
62
-
Check the blogs, videos and related docs
63
-
* Blog: [Microsoft Purview DevOps policies enter General Availability](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/microsoft-purview-devops-policies-enter-ga-simplify-access/ba-p/3674057)
64
-
* Blog: [Microsoft Purview DevOps policies enable at scale access provisioning for IT operations](https://techcommunity.microsoft.com/t5/microsoft-purview-blog/microsoft-purview-devops-policies-enable-at-scale-access/ba-p/3604725)
title: Troubleshoot Microsoft Purview policies for SQL data sources
3
+
description: Check how to see if SQL data sources are receiving policies from Microsoft Purview.
4
+
author: inward-eye
5
+
ms.author: vlrodrig
6
+
ms.service: purview
7
+
ms.subservice: purview-data-policies
8
+
ms.topic: tutorial
9
+
ms.date: 03/10/2023
10
+
---
11
+
12
+
# Tutorial: Troubleshoot Microsoft Purview policies for SQL data sources
13
+
14
+
In this tutorial, you learn how issue SQL commands to inspect the Microsoft Purview policies that have been communicated to the SQL instance, where they will be enforced. You will also learn how to force a download of the policies to the SQL instance. These commands are only used for troubleshooting and are not required during the normal operation of Microsoft Purview policies. These commands require a higher level of privileges in the SQL instance.
15
+
16
+
For more information about Microsoft Purview policies, see the concept guides listed in the [Next steps](#next-steps) section.
17
+
18
+
## Prerequisites
19
+
20
+
* An Azure subscription. If you don't already have one, [create a free subscription](https://azure.microsoft.com/free/?ref=microsoft.com&utm_source=microsoft.com&utm_medium=docs&utm_campaign=visualstudio).
21
+
* A Microsoft Purview account. If you don't have one, see the [quickstart for creating a Microsoft Purview account](create-catalog-portal.md).
22
+
* Register a data source, enable *Data use management*, and create a policy. To do so, use one of the Microsoft Purview policy guides. To follow along with the examples in this tutorial, you can [create a DevOps policy for Azure SQL Database](how-to-policies-devops-azure-sql-db.md).
23
+
24
+
## Test the policy
25
+
Once you create a policy, the Azure AD principals referenced in the Subject of the policy should be able to connect to any database in the server to which the policies are published.
26
+
27
+
### Force policy download
28
+
It is possible to force an immediate download of the latest published policies to the current SQL database by running the following command. The minimal permission required to run it is membership in ##MS_ServerStateManager##-server role.
29
+
30
+
```sql
31
+
-- Force immediate download of latest published policies
32
+
exec sp_external_policy_refresh reload
33
+
```
34
+
35
+
### Analyze downloaded policy state from SQL
36
+
The following DMVs can be used to analyze which policies have been downloaded and are currently assigned to Azure AD principals. The minimal permission required to run them is VIEW DATABASE SECURITY STATE - or assigned Action Group *SQL Security Auditor*.
37
+
38
+
```sql
39
+
40
+
-- Lists generally supported actions
41
+
SELECT*FROMsys.dm_server_external_policy_actions
42
+
43
+
-- Lists the roles that are part of a policy published to this server
44
+
SELECT*FROMsys.dm_server_external_policy_roles
45
+
46
+
-- Lists the links between the roles and actions, could be used to join the two
0 commit comments