You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Column-level security for dedicated SQL pool
2
+
title: Column-level security for dedicated SQL pool
3
3
description: Column-Level Security allows customers to control access to database table columns based on the user's execution context or group membership, simplifying the design and coding of security in your application, and allowing you to implement restrictions on column access.
4
4
author: WilliamDAssafMSFT
5
+
ms.author: wiassaf
5
6
manager: craigg
7
+
ms.date: 09/19/2023
6
8
ms.service: synapse-analytics
9
+
ms.subservice: sql-dw
7
10
ms.topic: conceptual
8
-
ms.subservice: sql-dw
9
-
ms.date: 04/19/2020
10
-
ms.author: wiassaf
11
-
ms.custom: seo-lt-2019
12
11
tags: azure-synapse
13
12
---
14
13
# Column-level security
15
14
16
15
Column-Level security allows customers to control access to table columns based on the user's execution context or group membership.
Since this video was posted [Row level Security](/sql/relational-databases/security/row-level-security?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) became available for dedicated SQL pool in Azure Synapse.
20
-
21
17
Column-level security simplifies the design and coding of security in your application, allowing you to restrict column access to protect sensitive data. For example, ensuring that specific users can access only certain columns of a table pertinent to their department. The access restriction logic is located in the database tier rather than away from the data in another application tier. The database applies the access restrictions every time data access is attempted from any tier. This restriction makes your security more reliable and robust by reducing the surface area of your overall security system. In addition, column-level security also eliminates the need for introducing views to filter out columns for imposing access restrictions on the users.
22
18
23
-
You can implement column-level security with the [GRANT](/sql/t-sql/statements/grant-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) T-SQL statement. With this mechanism, both SQL and Azure Active Directory (Azure AD) authentication are supported.
19
+
You can implement column-level security with the [GRANT Object Permissions](/sql/t-sql/statements/grant-object-permissions-transact-sql?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) T-SQL syntax. With this mechanism, both SQL authentication and Microsoft Entra ID ([formerly Azure Active Directory](/azure/active-directory/fundamentals/new-name)) authentication are supported.
20
+
21
+
Consider also the ability to enforce [Row level security](/sql/relational-databases/security/row-level-security?toc=/azure/synapse-analytics/sql-data-warehouse/toc.json&bc=/azure/synapse-analytics/sql-data-warehouse/breadcrumb/toc.json&view=azure-sqldw-latest&preserve-view=true) on tables, based on a `WHERE` clause filter.
24
22
25
-
23
+
:::image type="content" source="./media/column-level-security/cls.png" alt-text="Diagram shows a schematic table with the first column headed by a closed padlock and its cells an orange color while the other columns are white cells.":::
26
24
27
25
## Syntax
28
26
27
+
The syntax of the `GRANT` statement for object permissions allows for granting permissions to comma-delimited column lists on a table.
@@ -42,11 +42,11 @@ GRANT <permission> [ ,...n ] ON
42
42
| Database_user_mapped_to_Windows_Group
43
43
```
44
44
45
-
## Example
45
+
## Examples
46
46
47
47
The following example shows how to restrict `TestUser` from accessing the `SSN` column of the `Membership` table:
48
48
49
-
Create `Membership` table with SSN column used to store social security numbers:
49
+
Create `Membership` table with `SSN` column used to store social security numbers:
50
50
51
51
```sql
52
52
CREATETABLEMembership
@@ -58,24 +58,36 @@ CREATE TABLE Membership
58
58
Email varchar(100) NULL);
59
59
```
60
60
61
-
Allow `TestUser` to access all columns except for the SSN column, which has the sensitive data:
61
+
Allow `TestUser` to access all columns *except* for the `SSN` column, which has the sensitive data:
62
62
63
63
```sql
64
64
GRANTSELECTON Membership(MemberID, FirstName, LastName, Phone, Email) TO TestUser;
65
65
```
66
66
67
-
Queries executed as `TestUser`will fail if they include the SSN column:
67
+
Queries executed as `TestUser` fail if they include the `SSN` column:
68
68
69
69
```sql
70
70
SELECT*FROM Membership;
71
+
```
71
72
72
-
-- Msg 230, Level 14, State 1, Line 12
73
-
-- The SELECT permission was denied on the column 'SSN' of the object 'Membership', database 'CLS_TestDW', schema 'dbo'.
73
+
With the resulting error:
74
+
75
+
```output
76
+
Msg 230, Level 14, State 1, Line 12
77
+
The SELECT permission was denied on the column 'SSN' of the object 'Membership', database 'CLS_TestDW', schema 'dbo'.
74
78
```
75
79
76
-
## Use Cases
80
+
## Use cases
77
81
78
82
Some examples of how column-level security is being used today:
79
83
80
84
- A financial services firm allows only account managers to have access to customer social security numbers (SSN), phone numbers, and other personal data.
81
85
- A health care provider allows only doctors and nurses to have access to sensitive medical records while preventing members of the billing department from viewing this data.
0 commit comments