You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Doc: [Microsoft Purview DevOps policies on Azure SQL DB](./how-to-policies-devops-azure-sql-db.md)
62
62
* Doc: [Microsoft Purview DevOps policies on resource groups and subscriptions](./how-to-policies-devops-resource-group.md)
63
63
* Blog: [New granular permissions for SQL Server 2022 and Azure SQL to help PoLP](https://techcommunity.microsoft.com/t5/sql-server-blog/new-granular-permissions-for-sql-server-2022-and-azure-sql-to/ba-p/3607507)
[Data owner policies](concept-policies-data-owner.md) are a type of Microsoft Purview access policies. They allow you to manage access to user data in sources that have been registered for *Data Use Management* in Microsoft Purview. These policies can be authored directly in the Microsoft Purview governance portal, and after publishing, they get enforced by the data source.
17
17
18
-
This guide covers how a data owner can delegate authoring policies in Microsoft Purview to enable access to SQL Server on Azure Arc-enabled servers. The following actions are currently enabled: *Read*. This action is only supported for policies at server level. *Modify* is not supported at this point.
18
+
This guide covers how a data owner can delegate authoring policies in Microsoft Purview to enable access to Azure Arc-enabled SQL Server. The following actions are currently enabled: *Read*. This action is only supported for policies at server level. *Modify* is not supported at this point.
@@ -40,14 +40,14 @@ Register each data source with Microsoft Purview to later define access policies
40
40
41
41
1. Enable Data Use Management. Data Use Management needs certain permissions and can affect the security of your data, as it delegates to certain Microsoft Purview roles to manage access to the data sources. **Go through the secure practices related to Data Use Management in this guide**: [How to enable Data Use Management](./how-to-enable-data-use-management.md)
42
42
43
-
1. Upon enabling Data Use Management, Microsoft Purview will automatically capture the **Application ID** of the App Registration related to this Arc-enabled SQL server if one has been configured. Come back to this screen and hit the refresh button on the side of it to refresh, in case the association between the Arc-enabled SQL server and the App Registration changes in the future.
43
+
1. Upon enabling Data Use Management, Microsoft Purview will automatically capture the **Application ID** of the App Registration related to this Azure Arc-enabled SQL Server if one has been configured. Come back to this screen and hit the refresh button on the side of it to refresh, in case the association between the Azure Arc-enabled SQL Server and the App Registration changes in the future.
44
44
45
45
1. Select **Register** or **Apply** at the bottom
46
46
47
47
Once your data source has the **Data Use Management** toggle *Enabled*, it will look like this picture.
48
48

49
49
50
-
## Enable policies in Arc-enabled SQL Server
50
+
## Enable policies in Azure Arc-enabled SQL Server
51
51
[!INCLUDE [Access policies Arc enabled SQL Server configuration](./includes/access-policies-configuration-arc-sql-server.md)]
52
52
53
53
## Create and publish a Data owner policy
@@ -116,7 +116,7 @@ SELECT * FROM sys.dm_server_external_policy_principal_assigned_actions
116
116
117
117
### Policy action mapping
118
118
119
-
This section contains a reference of how actions in Microsoft Purview data policies map to specific actions in SQL Server on Azure Arc-enabled servers.
119
+
This section contains a reference of how actions in Microsoft Purview data policies map to specific actions in Azure Arc-enabled SQL Server.
120
120
121
121
|**Microsoft Purview policy action**|**Data source specific actions**|
Copy file name to clipboardExpand all lines: articles/purview/how-to-policies-data-owner-azure-sql-db.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -111,4 +111,4 @@ This section contains a reference of how actions in Microsoft Purview data polic
111
111
Check blog, demo and related how-to guides
112
112
*[Concepts for Microsoft Purview data owner policies](./concept-policies-data-owner.md)
113
113
*[Enable Microsoft Purview data owner policies on all data sources in a subscription or a resource group](./how-to-policies-data-owner-resource-group.md)
114
-
*[Enable Microsoft Purview data owner policies on an Arc-enabled SQL Server](./how-to-policies-data-owner-arc-sql-server.md)
114
+
*[Enable Microsoft Purview data owner policies on an Azure Arc-enabled SQL Server](./how-to-policies-data-owner-arc-sql-server.md)
Copy file name to clipboardExpand all lines: articles/purview/how-to-policies-data-owner-resource-group.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ In this guide we cover how to register an entire resource group or subscription
23
23
**Only these data sources are enabled for access policies on resource group or subscription**. Follow the **Prerequisites** section that is specific to the data source(s) in these guides:
24
24
*[Data owner policies on an Azure Storage account](./how-to-policies-data-owner-storage.md#prerequisites)
25
25
*[Data owner policies on an Azure SQL Database](./how-to-policies-data-owner-azure-sql-db.md#prerequisites)(*)
26
-
*[Data owner policies on an Arc-enabled SQL Server](./how-to-policies-data-owner-arc-sql-server.md#prerequisites)(*)
26
+
*[Data owner policies on an Azure Arc-enabled SQL Server](./how-to-policies-data-owner-arc-sql-server.md#prerequisites)(*)
27
27
28
28
(*) The *Modify* action is not currently supported for SQL-type data sources.
29
29
@@ -42,7 +42,7 @@ In the end, your resource will have the **Data Use Management** toggle **Enable
42
42

43
43
44
44
>[!Important]
45
-
> - If you create a policy on a resource group or subscription and want to have it enforced in Arc-enabled SQL servers, you will need to also register those servers independently and enable *Data use management* which captures their App ID: [See this document](./how-to-policies-devops-arc-sql-server.md#register-data-sources-in-microsoft-purview).
45
+
> - If you create a policy on a resource group or subscription and want to have it enforced in Azure Arc-enabled SQL Servers, you will need to also register those servers independently and enable *Data use management* which captures their App ID: [See this document](./how-to-policies-devops-arc-sql-server.md#register-data-sources-in-microsoft-purview).
Copy file name to clipboardExpand all lines: articles/purview/how-to-policies-devops-arc-sql-server.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Provision access to Arc-enabled SQL Server for DevOps actions
3
-
description: Step-by-step guide on provisioning access to Arc-enabled SQL Server through Microsoft Purview DevOps policies
2
+
title: Provision access to Azure Arc-enabled SQL Server for DevOps actions
3
+
description: Step-by-step guide on provisioning access to Azure Arc-enabled SQL Server through Microsoft Purview DevOps policies
4
4
author: inward-eye
5
5
ms.author: vlrodrig
6
6
ms.service: purview
@@ -9,11 +9,11 @@ ms.topic: how-to
9
9
ms.date: 11/16/2022
10
10
ms.custom:
11
11
---
12
-
# Provision access to system metadata in Arc-enabled SQL Server
12
+
# Provision access to system metadata in Azure Arc-enabled SQL Server
13
13
14
14
[DevOps policies](concept-policies-devops.md) are a type of Microsoft Purview access policies. They allow you to manage access to system metadata on data sources that have been registered for *Data use management* in Microsoft Purview. These policies are configured directly in the Microsoft Purview governance portal, and after being saved they get automatically published and then get enforced by the data source.
15
15
16
-
This how-to guide covers how to provision access from Microsoft Purview to Arc-enabled SQL Server system metadata (DMVs and DMFs) *SQL Performance Monitoring* or *SQL Security Auditing* actions. Microsoft Purview access policies apply to Azure AD Accounts only.
16
+
This how-to guide covers how to provision access from Microsoft Purview to Azure Arc-enabled SQL Server system metadata (DMVs and DMFs) *SQL Performance Monitoring* or *SQL Security Auditing* actions. Microsoft Purview access policies apply to Azure AD Accounts only.
The Arc-enabled SQL Server data source needs to be registered first with Microsoft Purview, before policies can be created.
26
+
The Azure Arc-enabled SQL Server data source needs to be registered first with Microsoft Purview, before policies can be created.
27
27
28
28
1. Sign in to Microsoft Purview Studio.
29
29
@@ -38,14 +38,14 @@ The Arc-enabled SQL Server data source needs to be registered first with Microso
38
38
39
39
1. Enable Data Use Management. Data Use Management needs certain permissions and can affect the security of your data, as it delegates to certain Microsoft Purview roles to manage access to the data sources. **Go through the secure practices related to Data Use Management in this guide**: [How to enable Data Use Management](./how-to-enable-data-use-management.md)
40
40
41
-
1. Upon enabling Data Use Management, Microsoft Purview will automatically capture the **Application ID** of the App Registration related to this Arc-enabled SQL server if one has been configured. Come back to this screen and hit the refresh button on the side of it to refresh, in case the association between the Arc-enabled SQL server and the App Registration changes in the future.
41
+
1. Upon enabling Data Use Management, Microsoft Purview will automatically capture the **Application ID** of the App Registration related to this Azure Arc-enabled SQL Server if one has been configured. Come back to this screen and hit the refresh button on the side of it to refresh, in case the association between the Azure Arc-enabled SQL Server and the App Registration changes in the future.
42
42
43
43
1. Select **Register** or **Apply** at the bottom
44
44
45
45
Once your data source has the **Data Use Management** toggle *Enabled*, it will look like this picture.
46
46

47
47
48
-
## Enable policies in Arc-enabled SQL Server
48
+
## Enable policies in Azure Arc-enabled SQL Server
49
49
[!INCLUDE [Access policies Arc enabled SQL Server configuration](./includes/access-policies-configuration-arc-sql-server.md)]
50
50
51
51
## Create a new DevOps policy
@@ -103,7 +103,7 @@ SELECT * FROM sys.dm_server_external_policy_principal_assigned_actions
103
103
104
104
### Policy action mapping
105
105
106
-
This section contains a reference of how actions in Microsoft Purview data policies map to specific actions in SQL Server on Azure Arc-enabled servers.
106
+
This section contains a reference of how actions in Microsoft Purview data policies map to specific actions in Azure Arc-enabled SQL Server.
107
107
108
108
|**Microsoft Purview policy action**|**Data source specific actions**|
Copy file name to clipboardExpand all lines: articles/purview/how-to-policies-devops-resource-group.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ In this guide we cover how to register an entire resource group or subscription
20
20
21
21
**Only these data sources are enabled for access policies on resource group or subscription**. Follow the **Prerequisites** section that is specific to the data source(s) in these guides:
22
22
*[DevOps policies on an Azure SQL Database](./how-to-policies-devops-azure-sql-db.md#prerequisites)
23
-
*[DevOps policies on an Arc-enabled SQL Server](./how-to-policies-devops-arc-sql-server.md#prerequisites)
23
+
*[DevOps policies on an Azure Arc-enabled SQL Server](./how-to-policies-devops-arc-sql-server.md#prerequisites)
@@ -37,7 +37,7 @@ In the end, your resource will have the **Data Use Management** toggle **Enable
37
37

38
38
39
39
>[!Important]
40
-
> - If you create a policy on a resource group or subscription and want to have it enforced in Arc-enabled SQL servers, you will need to also register those servers independently and enable *Data use management* which captures their App ID: [See this document](./how-to-policies-devops-arc-sql-server.md#register-data-sources-in-microsoft-purview).
40
+
> - If you create a policy on a resource group or subscription and want to have it enforced in Azure Arc-enabled SQL Servers, you will need to also register those servers independently and enable *Data use management* which captures their App ID: [See this document](./how-to-policies-devops-arc-sql-server.md#register-data-sources-in-microsoft-purview).
41
41
42
42
43
43
## Create a new DevOps policy
@@ -60,5 +60,5 @@ To test the policy see the DevOps policy guides for the underlying data sources
60
60
Check the blog and related docs
61
61
* Blog: [Microsoft Purview DevOps policies enable at scale access provisioning for IT operations](https://techcommunity.microsoft.com/t5/microsoft-purview-blog/microsoft-purview-devops-policies-enable-at-scale-access/ba-p/3604725)
62
62
* Video: [Reduce the effort with Microsoft Purview DevOps policies on resource groups](https://youtu.be/yMMXCeIFCZ8)
63
-
* Doc: [Microsoft Purview DevOps policies on Arc-enabled SQL Server](./how-to-policies-devops-arc-sql-server.md)
Copy file name to clipboardExpand all lines: articles/purview/includes/access-policies-prerequisites-arc-sql-server.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -36,7 +36,7 @@ Policy enforcement is available in only the following regions for Microsoft Purv
36
36
- Japan East
37
37
- Australia East
38
38
39
-
#### Security considerations for SQL Server on Azure Arc-enabled servers
39
+
#### Security considerations for Azure Arc-enabled SQL Server
40
40
41
41
- The server admin can turn off the Microsoft Purview policy enforcement.
42
42
- Azure Arc admin and server admin permissions provide the ability to change the Azure Resource Manager path of the server. Because mappings in Microsoft Purview use Resource Manager paths, this can lead to wrong policy enforcements.
Copy file name to clipboardExpand all lines: articles/purview/register-scan-azure-arc-enabled-sql-server.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -121,7 +121,7 @@ The account must have access to the master database, because `sys.databases` is
121
121
122
122
1. Select **Register**.
123
123
124
-
1. Select **SQL Server on Azure Arc-enabled servers**, and then select **Continue**.
124
+
1. Select **Azure Arc-enabled SQL Server**, and then select **Continue**.
125
125
126
126
:::image type="content" source="media/register-scan-azure-arc-enabled-sql-server/set-up-azure-arc-enabled-sql-data-source.png" alt-text="Screenshot that shows selecting a SQL data source.":::
127
127
@@ -196,13 +196,13 @@ Before you can create policies, you must register the Azure Arc-enabled SQL Serv
196
196
197
197
1. Enable **Data use management**. **Data use management** needs certain permissions and can affect the security of your data, because it delegates to certain Microsoft Purview roles to manage access to the data sources. Go through the secure practices related to **Data use management** in this guide: [Enable Data use management on your Microsoft Purview sources](./how-to-enable-data-use-management.md).
198
198
199
-
1. Upon enabling Data Use Management, Microsoft Purview will automatically capture the **Application ID** of the App Registration related to this Arc-enabled SQL server if one has been configured. Come back to this screen and hit the refresh button on the side of it to refresh, in case the association between the Arc-enabled SQL server and the App Registration changes in the future.
199
+
1. Upon enabling Data Use Management, Microsoft Purview will automatically capture the **Application ID** of the App Registration related to this Azure Arc-enabled SQL Server if one has been configured. Come back to this screen and hit the refresh button on the side of it to refresh, in case the association between the Azure Arc-enabled SQL Server and the App Registration changes in the future.
200
200
201
201
1. Select **Register** or **Apply**.
202
202
203
203

204
204
205
-
### Enable policies in Arc-enabled SQL Server
205
+
### Enable policies in Azure Arc-enabled SQL Server
206
206
[!INCLUDE [Access policies Arc enabled SQL Server configuration](./includes/access-policies-configuration-arc-sql-server.md)]
0 commit comments