Skip to content

Commit a1468a2

Browse files
cdparkcdpark
committed
Refresh articles
1 parent 2164163 commit a1468a2

File tree

2 files changed

+145
-152
lines changed

2 files changed

+145
-152
lines changed

‎articles/synapse-analytics/security/synapse-workspace-understand-what-role-you-need.md

Lines changed: 83 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -5,29 +5,29 @@ author: meenalsri
55
ms.service: azure-synapse-analytics
66
ms.topic: conceptual
77
ms.subservice: security
8-
ms.date: 04/22/2022
8+
ms.date: 01/31/2025
99
ms.author: mesrivas
1010
ms.reviewer: whhender, wiassaf
1111
---
1212
# Understand the roles required to perform common tasks in Azure Synapse
1313

14-
This article will help you understand which Synapse RBAC (role-based access control) roles or Azure RBAC roles you need to get work done in Synapse Studio. To manage role membership, see [Manage Synapse RBAC role assignments](./how-to-manage-synapse-rbac-role-assignments.md).
14+
This article explains which Synapse RBAC (role-based access control) or Azure RBAC roles you need to get work done in Synapse Studio. To manage role membership, see [How to manage Synapse RBAC role assignments](how-to-manage-synapse-rbac-role-assignments.md).
1515

1616
## Synapse Studio access control and workflow summary
1717

1818
### Access Synapse Studio
1919

20-
You can open Synapse Studio and view details of the workspace and list any of its Azure resources such as SQL pools, Spark pools, or Integration runtimes. You will see if you've been assigned any Synapse RBAC role or have the Azure Owner, Contributor, or Reader role on the workspace.
20+
You can open Synapse Studio and view details of the workspace and list any of its Azure resources such as SQL pools, Spark pools, or Integration runtimes. You can see if you've been assigned any Synapse RBAC role or have the Azure Owner, Contributor, or Reader role on the workspace.
2121

2222
### Resource management
2323

24-
You can create SQL pools, Data Explorer pools, and Apache Spark pools if you are an Azure Owner or Contributor on the resource group. You can create an Integration Runtime if you are an Azure Owner or Contributor on the workspace. When using ARM templates for automated deployment, you need to be an Azure Contributor on the resource group.
24+
You can create SQL pools, Data Explorer pools, and Apache Spark pools if you're an Azure Owner or Contributor on the resource group. You can create an Integration Runtime if you're an Azure Owner or Contributor on the workspace. When using ARM templates for automated deployment, you need to be an Azure Contributor on the resource group.
2525

2626
You can pause or scale a dedicated SQL pool, configure a Spark pool, or an integration runtime if you're an Azure Owner or Contributor on the workspace or that resource.
2727

2828
### View and edit code artifacts
2929

30-
With access to Synapse Studio, you can create new code artifacts, such as SQL scripts, KQL scripts, notebooks, spark jobs, linked services, pipelines, dataflows, triggers, and credentials. These artifacts can be published or saved with additional permissions.
30+
With access to Synapse Studio, you can create new code artifacts, such as SQL scripts, KQL scripts, notebooks, Spark jobs, linked services, pipelines, dataflows, triggers, and credentials. These artifacts can be published or saved with additional permissions.
3131

3232
If you're a Synapse Artifact User, Synapse Artifact Publisher, Synapse Contributor, or Synapse Administrator you can list, open, and edit already published code artifacts, including scheduled pipelines.
3333

@@ -37,105 +37,99 @@ You can execute SQL scripts on SQL pools if you have the necessary SQL permissio
3737

3838
You can run notebooks and Spark jobs if you have Synapse Compute Operator permissions on the workspace or specific Apache Spark pools.
3939

40-
With Compute Operator permissions on the workspace or specific integration runtimes, and appropriate credential permissions you can execute pipelines.
40+
With Compute Operator permissions on the workspace or specific integration runtimes, and appropriate credential permissions, you can execute pipelines.
4141

4242
### Monitor and manage execution
4343

4444
You can review the status of running notebooks and jobs in Apache Spark pools if you're a Synapse User.
4545

46-
You can review logs and cancel running jobs and pipelines if you're a Synapse Compute Operator at the workspace or for a specific Spark pool or pipeline.
46+
You can review logs and cancel running jobs and pipelines if you're a Synapse Compute Operator on the workspace or for a specific Spark pool or pipeline.
4747

4848
### Debug pipelines
4949

50-
You can review and make changes in pipelines as a Synapse User, but if you want to be able to debug it you also need to have Synapse Credential User.
50+
You can review and make changes in pipelines as a Synapse User. If you want to be able to debug pipelines, you also need to have Synapse Credential User.
5151

5252
### Publish and save your code
5353

5454
You can publish new or updated code artifacts to the service if you're a Synapse Artifact Publisher, Synapse Contributor, or Synapse Administrator.
5555

5656
You can commit code artifacts to a working branch of a Git repository if the workspace is Git-enabled and you have Git permissions. With Git enabled, publishing is only allowed from the collaboration branch.
5757

58-
If you close Synapse Studio without publishing or committing changes to code artifacts, then those changes will be lost.
58+
If you close Synapse Studio without publishing or committing changes to code artifacts, then those changes are lost.
5959

6060
## Tasks and required roles
6161

62-
The table below lists common tasks and for each task, the Synapse RBAC, or Azure RBAC roles required.
63-
64-
>[!Note]
65-
> Synapse Administrator is not listed for each task unless it is the only role that provides the necessary permission. A Synapse Administrator can perform all tasks enabled by other Synapse RBAC roles.</br>
66-
67-
> [!Note]
68-
> Guest users from another tenant are also able to review, add, or change role assignments once they have been assigned as Synapse Administrator.
69-
70-
The minimum Synapse RBAC role required is shown.
71-
72-
All Synapse RBAC roles at any scope provide you Synapse User permissions at the workspace.
73-
74-
All Synapse RBAC permissions/actions shown in the table are prefixed `Microsoft/Synapse/workspaces/...`.
75-
76-
77-
Task (I want to...) |Role (I need to be...)|Synapse RBAC permission/action
78-
--|--|--
79-
|Open Synapse Studio on a workspace|Synapse User or |read
80-
| |Azure Owner or Contributor, or Reader on the workspace|none
81-
|List SQL pools or Data Explorer pools or Apache Spark pools, or Integration runtimes and access their configuration details|Synapse User or|read|
82-
||Azure Owner or Contributor, or Reader on the workspace|none
83-
|List linked services or credentials or managed private endpoints|Synapse User|read
84-
SQL POOLS|
85-
Create a dedicated SQL pool or a serverless SQL pool|Azure Owner or Contributor on the resource group|none
86-
Manage (pause or scale, or delete) a dedicated SQL pool|Azure Owner or Contributor on the SQL pool or workspace|none
87-
Create a SQL script</br>|Synapse User or </br>Azure Owner or Contributor on the workspace. </br></br>*Additional SQL permissions are required to run a SQL script, publish, or commit changes*.|
88-
List and open any published SQL script| Synapse Artifact User or Artifact Publisher, or Synapse Contributor|artifacts/read
89-
Run a SQL script on a serverless SQL pool|SQL permissions on the pool (granted automatically to a Synapse Administrator)|none
90-
Run a SQL script on a dedicated SQL pool|SQL permissions on the pool (granted automatically to a Synapse Administrator)|none
91-
Publish a new or updated, or deleted SQL script|Synapse Artifact Publisher or Synapse Contributor|sqlScripts/write, delete
92-
Commit changes to a SQL script to the Git repo|Requires Git permissions on the repo|
93-
Assign Active Directory Admin on the workspace (via workspace properties in the Azure Portal)|Azure Owner or Contributor on the workspace |
94-
DATA EXPLORER POOLS|
95-
Create a Data Explorer pool |Azure Owner or Contributor on the resource group|none
96-
Manage (pause or scale, or delete) a Data Explorer pool|Azure Owner or Contributor on the Data Explorer pool or workspace|none
97-
Create a KQL script</br>|Synapse User. </br></br>*Additional Data Explorer permissions are required to run a script, publish, or commit changes*.|
98-
List and open any published KQL script| Synapse Artifact User or Artifact Publisher, or Synapse Contributor|artifacts/read
99-
Run a KQL script on a Data Explorer pool| Data Explorer permissions on the pool (granted automatically to a Synapse Administrator)|none
100-
Publish new, update, or delete KQL script|Synapse Artifact Publisher or Synapse Contributor|kqlScripts/write, delete
101-
Commit changes to a KQL script to the Git repo|Requires Git permissions on the repo|
102-
APACHE SPARK POOLS|
103-
Create an Apache Spark pool|Azure Owner or Contributor on the resource group|
104-
Monitor Apache Spark applications| Synapse User|read
105-
View the logs for completed notebook and job execution |Synapse Monitoring Operator|
106-
Cancel any notebook or Spark job running on an Apache Spark pool|Synapse Compute Operator on the Apache Spark pool.|bigDataPools/useCompute
107-
Create a notebook or job definition|Synapse User or </br>Azure Owner or Contributor, or Reader on the workspace</br></br> *Additional permissions are required to run, publish, or commit changes*|read</br></br></br></br></br>
108-
List and open a published notebook or job definition, including reviewing saved outputs|Synapse Artifact User or Synapse Monitoring Operator on the workspace|artifacts/read
109-
Run a notebook and review its output, or submit a Spark job|Synapse Apache Spark Administrator or Synapse Compute Operator on the selected Apache Spark pool|bigDataPools/useCompute
110-
Publish or delete a notebook or job definition (including output) to the service|Artifact Publisher on the workspace or Synapse Apache Spark Administrator|notebooks/write, delete
111-
Commit changes to a notebook or job definition to the Git repo|Git permissions|none
112-
PIPELINES, INTEGRATION RUNTIMES, DATAFLOWS, DATASETS & TRIGGERS|
113-
Create, update, or delete an Integration runtime|Azure Owner or Contributor on the workspace|
114-
Monitor Integration runtime status|Synapse Monitoring Operator|read, integrationRuntimes/viewLogs
115-
Review pipeline runs|Synapse Monitoring Operator|read, pipelines/viewOutputs
116-
Create a pipeline |Synapse User</br></br>*Additional Synapse permissions are required to debug, add triggers, publish, or commit changes*|read
117-
Create a dataflow or dataset |Synapse User</br></br>*Additional Synapse permissions are required to publish, or commit changes*|read
118-
List and open a published pipeline |Synapse Artifact User or Synapse Monitoring Operator | artifacts/read
119-
Preview dataset data|Synapse User and Synapse Credential User on the WorkspaceSystemIdentity|
120-
Debug a pipeline using the default Integration runtime|Synapse User and Synapse Credential User on the WorkspaceSystemIdentity credential|read, </br>credentials/useSecret
121-
Create a trigger, including trigger now (requires permission to execute the pipeline)|Synapse User and Synapse Credential User on the WorkspaceSystemIdentity|read, credentials/useSecret/action
122-
Execute/run a pipeline|Synapse User and Synapse Credential User on the WorkspaceSystemIdentity|read, credentials/useSecret/action
123-
Copy data using the Copy Data tool|Synapse User and Synapse Credential User on the Workspace System Identity|read, credentials/useSecret/action
124-
Ingest data (using a schedule)|Synapse Author and Synapse Credential User on the Workspace System Identity|read, credentials/useSecret/action
125-
Publish a new, updated, or deleted pipeline, dataflow, or trigger to the service|Synapse Artifact Publisher on the workspace|pipelines/write, delete</br>dataflows/write, delete</br>triggers/write, delete
126-
Commit changes to pipelines, dataflows, datasets, or triggers to the Git repo |Git permissions|none
127-
LINKED SERVICES|
128-
Create a linked service (includes assigning a credential)|Synapse User</br></br>*Additional permissions are required to use a linked service with credentials, or to publish, or commit changes*|read
129-
List and open a published linked service|Synapse Artifact User|linkedServices/write, delete
130-
Test connection on a linked service secured by a credential|Synapse User and Synapse Credential User|credentials/useSecret/action|
131-
Publish a linked service|Synapse Artifact Publisher or Synapse Linked Data Manager|linkedServices/write, delete
132-
Commit linked service definitions to the Git repo|Git permissions|none
133-
ACCESS MANAGEMENT|
134-
Review Synapse RBAC role assignments at any scope|Synapse User|read
135-
Assign and remove Synapse RBAC role assignments for users, groups, and service principals| Synapse Administrator at the workspace or at a specific workspace item scope|roleAssignments/write, delete
136-
137-
138-
## Next steps
139-
140-
- [Review Synapse RBAC role assignments](./how-to-review-synapse-rbac-role-assignments.md)
141-
- [Manage Synapse RBAC role assignments](./how-to-manage-synapse-rbac-role-assignments.md)
62+
The following table lists common tasks and the Synapse RBAC or Azure RBAC roles required for each task.
63+
64+
> [!NOTE]
65+
> Synapse Administrator isn't listed for each task unless it's the only role that provides the necessary permission. A Synapse Administrator can perform all tasks enabled by other Synapse RBAC roles.
66+
67+
> [!NOTE]
68+
> Guest users from another tenant are also able to review, add, or change role assignments once they have been assigned as Synapse Administrator.
69+
70+
The minimum Synapse RBAC role required is shown. All Synapse RBAC roles at any scope provide you with Synapse User permissions on the workspace.
71+
72+
All Synapse RBAC permissions/actions shown in the table are prefixed with `Microsoft/Synapse/workspaces/...`.
73+
74+
|Task (I want to...) |Role (I need to be...)|Synapse RBAC permission/action|
75+
|--|--|--|
76+
|Open Synapse Studio on a workspace|Synapse User or </br></br> Azure Owner or Contributor, or Reader on the workspace |read</br></br>none|
77+
|List SQL pools or Data Explorer pools or Apache Spark pools, or Integration runtimes and access their configuration details|Synapse User or</br></br>Azure Owner or Contributor, or Reader on the workspace|read</br></br>none|
78+
|List linked services or credentials or managed private endpoints|Synapse User|read|
79+
|SQL POOLS|
80+
|Create a dedicated SQL pool or a serverless SQL pool|Azure Owner or Contributor on the resource group|none|
81+
|Manage (pause or scale, or delete) a dedicated SQL pool|Azure Owner or Contributor on the SQL pool or workspace|none|
82+
|Create a SQL script</br>|Synapse User or </br>Azure Owner or Contributor on the workspace </br></br>*Additional SQL permissions are required to run a SQL script, publish, or commit changes*| |
83+
|List and open any published SQL script| Synapse Artifact User or Artifact Publisher, or Synapse Contributor|artifacts/read|
84+
|Run a SQL script on a serverless SQL pool|SQL permissions on the pool (granted automatically to a Synapse Administrator)|none|
85+
|Run a SQL script on a dedicated SQL pool|SQL permissions on the pool (granted automatically to a Synapse Administrator)|none|
86+
|Publish a new or updated, or deleted SQL script|Synapse Artifact Publisher or Synapse Contributor|sqlScripts/write, delete|
87+
|Commit changes to a SQL script to the Git repo|Requires Git permissions on the repo| |
88+
|Assign Active Directory Admin on the workspace (via workspace properties in the Azure Portal)|Azure Owner or Contributor on the workspace| |
89+
|DATA EXPLORER POOLS|
90+
|Create a Data Explorer pool |Azure Owner or Contributor on the resource group|none|
91+
|Manage (pause or scale, or delete) a Data Explorer pool|Azure Owner or Contributor on the Data Explorer pool or workspace|none|
92+
|Create a KQL script|Synapse User. </br></br>*Additional Data Explorer permissions are required to run a script, publish, or commit changes*| |
93+
|List and open any published KQL script| Synapse Artifact User or Artifact Publisher, or Synapse Contributor|artifacts/read|
94+
|Run a KQL script on a Data Explorer pool| Data Explorer permissions on the pool (granted automatically to a Synapse Administrator)|none|
95+
|Publish new, update, or delete KQL script|Synapse Artifact Publisher or Synapse Contributor|kqlScripts/write, delete|
96+
|Commit changes to a KQL script to the Git repo|Requires Git permissions on the repo| |
97+
|APACHE SPARK POOLS|
98+
|Create an Apache Spark pool|Azure Owner or Contributor on the resource group| |
99+
|Monitor Apache Spark applications| Synapse User|Read|
100+
|View the logs for completed notebook and job execution |Synapse Monitoring Operator| |
101+
|Cancel any notebook or Spark job running on an Apache Spark pool|Synapse Compute Operator on the Apache Spark pool|bigDataPools/useCompute|
102+
|Create a notebook or job definition|Synapse User or </br>Azure Owner or Contributor, or Reader on the workspace</br></br> *Additional permissions are required to run, publish, or commit changes*|read|
103+
|List and open a published notebook or job definition, including reviewing saved outputs|Synapse Artifact User or Synapse Monitoring Operator on the workspace|artifacts/read|
104+
|Run a notebook and review its output, or submit a Spark job|Synapse Apache Spark Administrator or Synapse Compute Operator on the selected Apache Spark pool|bigDataPools/useCompute|
105+
|Publish or delete a notebook or job definition (including output) to the service|Artifact Publisher on the workspace or Synapse Apache Spark Administrator|notebooks/write, delete|
106+
|Commit changes to a notebook or job definition to the Git repo|Git permissions|none|
107+
|PIPELINES, INTEGRATION RUNTIMES, DATAFLOWS, DATASETS & TRIGGERS|
108+
|Create, update, or delete an Integration runtime|Azure Owner or Contributor on the workspace| |
109+
|Monitor Integration runtime status|Synapse Monitoring Operator|read, integrationRuntimes/viewLogs|
110+
|Review pipeline runs|Synapse Monitoring Operator|read, pipelines/viewOutputs|
111+
|Create a pipeline |Synapse User</br></br>*Additional Synapse permissions are required to debug, add triggers, publish, or commit changes*|read|
112+
|Create a dataflow or dataset |Synapse User</br></br>*Additional Synapse permissions are required to publish, or commit changes*|read|
113+
|List and open a published pipeline |Synapse Artifact User or Synapse Monitoring Operator |artifacts/read|
114+
|Preview dataset data|Synapse User and Synapse Credential User on the WorkspaceSystemIdentity| |
115+
|Debug a pipeline using the default Integration runtime|Synapse User and Synapse Credential User on the WorkspaceSystemIdentity credential|read, credentials/useSecret|
116+
|Create a trigger, including trigger now (requires permission to execute the pipeline)|Synapse User and Synapse Credential User on the WorkspaceSystemIdentity|read, credentials/useSecret/action|
117+
|Execute/run a pipeline|Synapse User and Synapse Credential User on the WorkspaceSystemIdentity|read, credentials/useSecret/action|
118+
|Copy data using the Copy Data tool|Synapse User and Synapse Credential User on the Workspace System Identity|read, credentials/useSecret/action|
119+
|Ingest data (using a schedule)|Synapse Author and Synapse Credential User on the Workspace System Identity|read, credentials/useSecret/action|
120+
|Publish a new, updated, or deleted pipeline, dataflow, or trigger to the service|Synapse Artifact Publisher on the workspace|pipelines/write, delete</br>dataflows/write, delete</br>triggers/write, delete|
121+
|Commit changes to pipelines, dataflows, datasets, or triggers to the Git repo |Git permissions|none|
122+
|LINKED SERVICES|
123+
|Create a linked service (includes assigning a credential)|Synapse User</br></br>*Additional permissions are required to use a linked service with credentials, or to publish, or commit changes*|read|
124+
|List and open a published linked service|Synapse Artifact User|linkedServices/write, delete|
125+
|Test connection on a linked service secured by a credential|Synapse User and Synapse Credential User|credentials/useSecret/action|
126+
|Publish a linked service|Synapse Artifact Publisher or Synapse Linked Data Manager|linkedServices/write, delete|
127+
|Commit linked service definitions to the Git repo|Git permissions|none|
128+
|ACCESS MANAGEMENT|
129+
|Review Synapse RBAC role assignments at any scope|Synapse User|read|
130+
|Assign and remove Synapse RBAC role assignments for users, groups, and service principals| Synapse Administrator at the workspace or at a specific workspace item scope|roleAssignments/write, delete|
131+
132+
## Related content
133+
134+
- [Review Synapse RBAC role assignments](./how-to-review-synapse-rbac-role-assignments.md)
135+
- [Manage Synapse RBAC role assignments](./how-to-manage-synapse-rbac-role-assignments.md)

0 commit comments

Comments
 (0)