Skip to content

Commit bea9613

Browse files
AnnaMHuffAnnaMHuff
authored
Merge pull request #278518 from shellyhaverkamp/smh-metadata
Metadata and markdown updates
2 parents 9fcf379 + acac2b9 commit bea9613

File tree

7 files changed

+81
-86
lines changed

7 files changed

+81
-86
lines changed

‎articles/healthcare-apis/configure-azure-rbac-using-scripts.md

Lines changed: 19 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Grant permissions to users and client applications using CLI and REST API - Azure Health Data Services
3-
description: This article describes how to grant permissions to users and client applications using CLI and REST API.
2+
title: Grant permissions to users and applications by using CLI and REST API in Azure Health Data Services
3+
description: Learn to configure Azure RBAC roles using CLI and REST API for secure access to Azure Health Data Services. See how to make role assignments with detailed scripts and examples.
44
services: healthcare-apis
55
author: chachachachami
66
ms.service: healthcare-apis
@@ -10,19 +10,19 @@ ms.date: 06/06/2022
1010
ms.author: chrupa
1111
---
1212

13-
# Configure Azure RBAC role using Azure CLI and REST API
13+
# Configure Azure RBAC roles by using Azure CLI and REST API
1414

15-
In this article, you'll learn how to grant permissions to client applications (and users) to access Azure Health Data Services using Azure Command-Line Interface (CLI) and REST API. This step is referred to as "role assignment" or Azure
16-
[role-based access control (Azure RBAC role)](./../role-based-access-control/role-assignments-cli.md). To further your understanding about the application roles defined for Azure Health Data Services, see [Configure Azure RBAC role](configure-azure-rbac.md).
15+
In this article, you learn how to grant permissions to client applications and users to access Azure Health Data Services by using the Azure Command-Line Interface (CLI) and REST API. This step is referred to as role assignment or Azure
16+
[role-based access control (RBAC)](./../role-based-access-control/role-assignments-cli.md). For more information, see [Configure Azure RBAC role](configure-azure-rbac.md).
1717

18-
You can view and download the [CLI scripts](https://github.com/microsoft/healthcare-apis-samples/blob/main/src/scripts/role-assignment-using-cli.http) and [REST API scripts](https://github.com/microsoft/healthcare-apis-samples/blob/main/src/scripts/role-assignment-using-rest-api.http) from [Azure Health Data Services samples](https://github.com/microsoft/healthcare-apis-samples).
18+
View and download the [CLI scripts](https://github.com/microsoft/healthcare-apis-samples/blob/main/src/scripts/role-assignment-using-cli.http) and [REST API scripts](https://github.com/microsoft/healthcare-apis-samples/blob/main/src/scripts/role-assignment-using-rest-api.http) from [Azure Health Data Services samples](https://github.com/microsoft/healthcare-apis-samples).
1919

20-
> [!Note]
20+
> [!Note]
2121
> To perform the role assignment operation, the user (or the client application) must be granted with RBAC permissions. Contact your Azure subscription administrators for assistance.
2222
2323
## Role assignments with CLI
2424

25-
You can list application roles using role names or GUID IDs. Include the role name in double quotes when there are spaces in it. For more information, see
25+
You can list application roles by using role names or GUID IDs. Include the role name in double quotes when there are spaces in it. For more information, see
2626
[List Azure role definitions](./../role-based-access-control/role-definitions-list.yml#azure-cli).
2727

2828
```
@@ -34,7 +34,7 @@ az role definition list --name 58a3b984-7adf-4c20-983a-32417c86fbc8
3434

3535
### Azure Health Data Services role assignment
3636

37-
The role assignments for Azure Health Data Services require the following values.
37+
The role assignments for Azure Health Data Services require these values:
3838

3939
- Application role name or GUID ID.
4040
- Service principal ID for the user or client application.
@@ -82,19 +82,20 @@ spid=$(az ad sp show --id $clientid --query objectId --output tsv)
8282
#assign the specified role
8383
az role assignment create --assignee-object-id $spid --assignee-principal-type ServicePrincipal --role "$fhirrole" --scope $fhirrolescope
8484
```
85+
8586
## Role assignments with REST API
8687

8788
Alternatively, you can send a Put request to the role assignment REST API directly. For more information, see [Assign Azure roles using the REST API](./../role-based-access-control/role-assignments-rest.md).
8889

8990
>[!Note]
90-
>The REST API scripts in this article are based on the [REST Client](./fhir/using-rest-client.md) extension. You'll need to revise the variables if you are in a different environment.
91+
>The REST API scripts in this article are based on the [REST Client](./fhir/using-rest-client.md) extension. You need to revise the variables if you are in a different environment.
9192
92-
The API requires the following values:
93+
The API requires these values:
9394

9495
- Assignment ID, which is a GUID value that uniquely identifies the transaction. You can use tools such as Visual Studio or Visual Studio Code extension to get a GUID value. Also, you can use online tools such as [UUID Generator](https://www.uuidgenerator.net/api/guid) to get it.
95-
- API version that is supported by the API.
96+
- API version supported by the API.
9697
- Scope for Azure Health Data Services to which you grant access permissions. It includes subscription ID, resource group name, and the FHIR or DICOM service instance name.
97-
- Role definition ID for roles such as "FHIR Data Contributor" or "DICOM Data Owner". Use `az role definition list --name "<role name>"` to list the role definition IDs.
98+
- Role definition ID for roles such as **FHIR Data Contributor** or **DICOM Data Owner**. Use `az role definition list --name "<role name>"` to list the role definition IDs.
9899
- Service principal ID for the user or the client application.
99100
- Microsoft Entra access token to the `https://management.azure.com/`, not Azure Health Data Services. You can get the access token using an existing tool or using Azure CLI command, `az account get-access-token --resource "https://management.azure.com/"`
100101
- For Azure Health Data Services, the scope includes workspace name and FHIR/DICOM service instance name.
@@ -124,7 +125,7 @@ Accept: application/json
124125
}
125126
```
126127

127-
For Azure API for FHIR, the scope is defined slightly differently as it supports the FHIR service only, and no workspace name is required.
128+
For Azure API for FHIR, the scope is defined differently as it supports the FHIR service only, and no workspace name is required.
128129

129130
```rest
130131
### Create a role assignment - Azure API for FHIR
@@ -153,7 +154,7 @@ Accept: application/json
153154

154155
## List service instances of Azure Health Data Services
155156

156-
Optionally, you can get a list of Azure Health Data Services services, or Azure API for FHIR. Note that the API version is based on Azure Health Data Services, not the version for the role assignment REST API.
157+
Optionally, you can get a list of Azure Health Data Services services, or Azure API for FHIR. The API version is based on Azure Health Data Services, not the version for the role assignment REST API.
157158

158159
For Azure Health Data Services, specify the subscription ID, resource group name, workspace name, FHIR or DICOM services, and the API version.
159160

@@ -185,13 +186,10 @@ Accept: application/json
185186
186187
```
187188

188-
Now that you've granted proper permissions to the client application, you can access Azure Health Data Services in your applications.
189+
After you grant proper permissions to the client application, you can access Azure Health Data Services in your applications.
189190

190191
## Next steps
191192

192-
In this article, you learned how to grant permissions to client applications using Azure CLI and REST API. For information on how to access Azure Health Data Services using the REST Client Extension in Visual Studio Code, see
193-
194-
>[!div class="nextstepaction"]
195-
>[Access using REST Client](./fhir/using-rest-client.md)
193+
[Access using REST Client](./fhir/using-rest-client.md)
196194

197-
FHIR&#174; is a registered trademark of [HL7](https://hl7.org/fhir/) and is used with the permission of HL7.
195+
[!INCLUDE [FHIR and DICOM trademark statement](./includes/healthcare-apis-fhir-dicom-trademark.md)]

‎articles/healthcare-apis/configure-azure-rbac.md

Lines changed: 22 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,61 +1,59 @@
11
---
2-
title: Configure Azure RBAC role for FHIR service - Azure Health Data Services
3-
description: This article describes how to configure Azure RBAC role for FHIR.
2+
title: Configure Azure RBAC role for the FHIR service in Azure Health Data Services
3+
description: Learn how to configure Azure RBAC for the FHIR service in Azure Health Data Services. Assign roles, manage access, and safeguard your data plane.
44
author: chachachachami
55
ms.service: healthcare-apis
66
ms.topic: tutorial
77
ms.date: 06/06/2022
88
ms.author: chrupa
99
---
10+
# Configure Azure RBAC roles for Azure Health Data Services
1011

11-
# Configure Azure RBAC role for Azure Health Data Services
12+
In this article, you learn how to use [Azure role-based access control (RBAC)](../role-based-access-control/index.yml) to assign access to the Azure Health Data Services data plane. Using Azure RBAC roles is the preferred method for assigning data plane access when data plane users are managed in the Microsoft Entra tenant associated with your Azure subscription.
1213

13-
In this article, you'll learn how to use [Azure role-based access control (Azure RBAC role)](../role-based-access-control/index.yml) to assign access to the Azure Health Data Services data plane. Azure RBAC role is the preferred methods for assigning data plane access when data plane users are managed in the Microsoft Entra tenant associated with your Azure subscription.
14-
15-
You can complete role assignments through the Azure portal. Note that the FHIR service and DICOM service have defined different application roles. Add or remove one or more roles to manage user access controls.
14+
You can complete role assignments in the Azure portal. The FHIR&reg; service and DICOM&reg; service define application roles differently. Add or remove one or more roles to manage user access controls.
1615

1716
## Assign roles for the FHIR service
1817

19-
To grant users, service principals, or groups access to the FHIR data plane, select the FHIR service from the Azure portal. Select **Access control (IAM)**, and then select the **Role assignments** tab. Select **+Add**, and then select **Add role assignment**.
20-
21-
If the role assignment option is grayed out, ask your Azure subscription administrator to grant you with the permissions to the subscription or the resource group, for example, “User Access Administrator”. For more information about the Azure built-in roles, see [Azure built-in roles](../role-based-access-control/built-in-roles.md).
18+
To grant users, service principals, or groups access to the FHIR data plane, go to the FHIR service in the Azure portal. Select **Access control (IAM)**, and then select the **Role assignments** tab. Select **+Add**, and then select **Add role assignment**.
19+
20+
If the role assignment option is grayed out, ask your Azure subscription administrator to grant you with the permissions to the subscription or the resource group, for example, **User Access Administrator**. For more information, see [Azure built-in roles](../role-based-access-control/built-in-roles.md).
2221

23-
[ ![Access control role assignment.](fhir/media/rbac/role-assignment.png) ](fhir/media/rbac/role-assignment.png#lightbox)
22+
:::image type="content" source="media/rbac/select-role-assignment.png" alt-text="Screenshot showing role assignment selection." lightbox="media/rbac/select-role-assignment.png":::
2423

25-
In the Role selection, search for one of the built-in roles for the FHIR data plane, for example, “FHIR Data Contributor”. You can choose other roles below.
24+
In the **Role** selection, search for one of the built-in roles for the FHIR data plane. You can choose from these roles:
2625

2726
* **FHIR Data Reader**: Can read (and search) FHIR data.
2827
* **FHIR Data Writer**: Can read, write, and soft delete FHIR data.
2928
* **FHIR Data Exporter**: Can read and export ($export operator) data.
3029
* **FHIR Data Contributor**: Can perform all data plane operations.
3130
* **FHIR Data Converter**: Can use the converter to perform data conversion.
32-
* **FHIR SMART User**: Role allows to read and write FHIR data according to the SMART IG V1.0.0 specifications.
31+
* **FHIR SMART User**: Can read and write FHIR data according to the SMART IG V1.0.0 specifications.
3332

34-
In the **Select** section, type the client application registration name. If the name is found, the application name is listed. Select the application name, and then select **Save**.
33+
In the **Select** section, type the client application registration name. If the name is found, the application name is listed. Select the application name, and then select **Save**.
3534

3635
If the client application isn’t found, check your application registration. This is to ensure that the name is correct. Ensure that the client application is created in the same tenant where the FHIR service in Azure Health Data Services (hereby called the FHIR service) is deployed in.
3736

38-
39-
[ ![Select role assignment.](fhir/media/rbac/select-role-assignment.png) ](fhir/media/rbac/select-role-assignment.png#lightbox)
37+
:::image type="content" source="media/rbac/select-role-assignment.png" alt-text="Screenshot showing selection of role assignment." lightbox="media/rbac/select-role-assignment.png":::
4038

4139
You can verify the role assignment by selecting the **Role assignments** tab from the **Access control (IAM)** menu option.
42-
40+
4341
## Assign roles for the DICOM service
4442

4543
To grant users, service principals, or groups access to the DICOM data plane, select the **Access control (IAM)** blade. Select the**Role assignments** tab, and select **+ Add**.
4644

47-
[ ![dicom access control.](dicom/media/dicom-access-control.png) ](dicom/media/dicom-access-control.png#lightbox)
45+
:::image type="content" source="media/rbac/dicom-access-control.png" alt-text="Screenshot showing DICOM access control." lightbox="media/rbac/dicom-access-control.png":::
4846

4947
In the **Role** selection, search for one of the built-in roles for the DICOM data plane:
5048

51-
[ ![Add RBAC role assignment.](dicom/media/rbac-add-role-assignment.png) ](dicom/media/rbac-add-role-assignment.png#lightbox)
49+
:::image type="content" source="media/rbac/rbac-add-role-assignment.png" alt-text="Screenshot showing how to add an RBAC role assignment." lightbox="media/rbac/rbac-add-role-assignment.png":::
5250

5351
You can choose between:
5452

5553
* DICOM Data Owner: Full access to DICOM data.
5654
* DICOM Data Reader: Read and search DICOM data.
5755

58-
If these roles aren’t sufficient for your need, you can use PowerShell to create custom roles. For information about creating custom roles, see [Create a custom role using Azure PowerShell](../role-based-access-control/custom-roles-powershell.md).
56+
If these roles aren’t sufficient, you can use PowerShell to create custom roles. For information about creating custom roles, see [Create a custom role by using Azure PowerShell](../role-based-access-control/custom-roles-powershell.md).
5957

6058
In the **Select** box, search for a user, service principal, or group that you want to assign the role to.
6159

@@ -64,10 +62,10 @@ In the **Select** box, search for a user, service principal, or group that you w
6462

6563
## Next steps
6664

67-
In this article, you've learned how to assign Azure roles for the FHIR service and DICOM service. To learn how to access the Azure Health Data Services using Postman, see
65+
[Access by using Postman](./fhir/use-postman.md)
66+
67+
[Access by using the REST Client](./fhir/using-rest-client.md)
6868

69-
- [Access using Postman](./fhir/use-postman.md)
70-
- [Access using the REST Client](./fhir/using-rest-client.md)
71-
- [Access using cURL](./fhir/using-curl.md)
69+
[Access by using cURL](./fhir/using-curl.md)
7270

73-
FHIR&#174; is a registered trademark of [HL7](https://hl7.org/fhir/) and is used with the permission of HL7.
71+
[!INCLUDE [FHIR and DICOM trademark statement](./includes/healthcare-apis-fhir-dicom-trademark.md)]

‎articles/healthcare-apis/fhir/get-started-with-fhir.md

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
2-
title: Get started with FHIR service - Azure Health Data Services
3-
description: This document describes how to get started with FHIR service in Azure Health Data Services.
2+
title: Get started with the FHIR service in Azure Health Data Services
3+
description: Learn how to set up the FHIR service in Azure Health Data Services with steps to create workspaces, register apps, and manage data.
44
author: expekesheth
55
ms.service: healthcare-apis
66
ms.subservice: fhir
@@ -10,9 +10,9 @@ ms.author: kesheth
1010
ms.custom: mode-api
1111
---
1212

13-
# Get started with FHIR service
13+
# Get started with the FHIR service
1414

15-
This article outlines the basic steps to get started with the FHIR service in [Azure Health Data Services](../healthcare-apis-overview.md).
15+
This article outlines the basic steps to get started with the FHIR&reg; service in [Azure Health Data Services](../healthcare-apis-overview.md).
1616

1717
As a prerequisite, you need an Azure subscription and permissions to create Azure resource groups and deploy Azure resources. You can follow all the steps, or skip some if you have an existing environment. Also, you can combine all the steps and complete them in PowerShell, Azure CLI, and REST API scripts.
1818

@@ -45,15 +45,15 @@ You can delete a client application. Before you delete a client application, ens
4545

4646
### Grant access permissions
4747

48-
You can grant access permissions or assign roles from the [Azure portal](../configure-azure-rbac.md), or using PowerShell and Azure CLI scripts.
48+
You can grant access permissions or assign roles in the [Azure portal](../configure-azure-rbac.md), or by using PowerShell and Azure CLI scripts.
4949

5050
### Perform create, read, update, and delete (CRUD) transactions
5151

52-
You can perform Create, Read (search), Update, and Delete (CRUD) transactions against the FHIR service in your applications or by using tools such as Postman, REST Client, and cURL. Because the FHIR service is secured by default, you must obtain an access token and include it in your transaction request.
52+
You can perform Create, Read (search), Update, and Delete (CRUD) transactions against the FHIR service in your applications or by using tools such as Postman, REST Client, and cURL. Because the FHIR service is secured by default, you need to obtain an access token and include it in your transaction request.
5353

5454
#### Get an access token
5555

56-
You can obtain a Microsoft Entra access token using PowerShell, Azure CLI, REST CCI, or .NET SDK. For more information, see [Get access token](../get-access-token.md).
56+
You can obtain a Microsoft Entra access token by using PowerShell, Azure CLI, REST CCI, or .NET SDK. For more information, see [Get an access token](../get-access-token.md).
5757

5858
#### Access using existing tools
5959

@@ -63,19 +63,19 @@ You can obtain a Microsoft Entra access token using PowerShell, Azure CLI, REST
6363

6464
#### Load data
6565

66-
You can load data directly using the POST or PUT method against the FHIR service. To bulk load data, you can use $import operation. For information, visit [import operation](import-data.md).
66+
You can load data directly by using the POST or PUT method against the FHIR service. To bulk load data, you can use $import operation. For information, visit [import operation](import-data.md).
6767

6868
### CMS, search, profile validation, and reindex
6969

7070
You can find more details on interoperability and patient access, search, profile validation, and reindex in the [FHIR service](overview.md) documentation.
7171

7272
### Export data
7373

74-
Optionally, you can export ($export) data to [Azure Storage](../data-transformation/export-data.md) and use it in your analytics or machine-learning projects. You can export the data "as-is" or [deid](../data-transformation/de-identified-export.md) in `ndjson` format.
74+
Optionally, you can export ($export) data to [Azure Storage](../data-transformation/export-data.md) and use it in your analytics or machine-learning projects. You can export the data "as-is" or [deID](../data-transformation/de-identified-export.md) in `ndjson` format.
7575

76-
### Converting data
76+
### Convert data
7777

78-
Optionally, you can convert [HL7 v2](convert-data-overview.md) and other format data to FHIR.
78+
Optionally, you can convert [HL7 v2](convert-data-overview.md) data and other formats to FHIR.
7979

8080
### Using FHIR data in Power BI dashboard
8181

@@ -86,6 +86,6 @@ Optionally, you can create Power BI dashboard reports with FHIR data.
8686

8787
## Next steps
8888

89-
[Deploy a FHIR service within Azure Health Data Services](fhir-portal-quickstart.md)
89+
[Deploy a FHIR service in Azure Health Data Services](fhir-portal-quickstart.md)
9090

9191
[!INCLUDE [FHIR trademark statement](../includes/healthcare-apis-fhir-trademark.md)]

0 commit comments

Comments
 (0)