You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/managed-identities-azure-resources/tutorial-vm-windows-access-storage.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ ms.subservice: msi
13
13
ms.topic: tutorial
14
14
ms.tgt_pltfrm: na
15
15
ms.workload: identity
16
-
ms.date: 01/11/2022
16
+
ms.date: 02/18/2022
17
17
ms.author: barclayn
18
18
ms.collection: M365-identity-device-management
19
19
---
@@ -51,12 +51,12 @@ This tutorial shows you how to use a system-assigned managed identity for a Wind
51
51
52
52
In this section, you create a storage account.
53
53
54
-
1.Click the **+ Create a resource** button found on the upper left-hand corner of the Azure portal.
55
-
2.Click**Storage**, then **Storage account - blob, file, table, queue**.
54
+
1.Select the **+ Create a resource** button found on the upper left-hand corner of the Azure portal.
55
+
2.Select**Storage**, then **Storage account - blob, file, table, queue**.
56
56
3. Under **Name**, enter a name for the storage account.
57
57
4.**Deployment model** and **Account kind** should be set to **Resource manager** and **Storage (general purpose v1)**.
58
58
5. Ensure the **Subscription** and **Resource Group** match the ones you specified when you created your VM in the previous step.
59
-
6.Click**Create**.
59
+
6.Select**Create**.
60
60
61
61
62
62
@@ -65,24 +65,24 @@ In this section, you create a storage account.
65
65
Files require blob storage so you need to create a blob container in which to store the file. You then upload a file to the blob container in the new storage account.
66
66
67
67
1. Navigate back to your newly created storage account.
68
-
2. Under **Blob Service**, click**Containers**.
69
-
3.Click**+ Container** on the top of the page.
70
-
4. Under **New container**, enter a name for the container and under **Public access level** keep the default value.
68
+
2. Under **Blob Service**, select**Containers**.
69
+
3.Select**+ Container** on the top of the page.
70
+
4. Under **New container**, enter a name for the container and under **Public access level** keep the default value.
5. Using an editor of your choice, create a file titled *hello world.txt* on your local machine. Open the file and add the text (without the quotes) "Hello world! :)" and then save it.
75
75
6. Upload the file to the newly created container by clicking on the container name, then **Upload**
76
-
7. In the **Upload blob** pane, under **Files**, click the folder icon and browse to the file **hello_world.txt** on your local machine, select the file, then click**Upload**.
76
+
7. In the **Upload blob** pane, under **Files**, select the folder icon and browse to the file **hello_world.txt** on your local machine, select the file, then select**Upload**.
77
77
78
78
79
79
### Grant access
80
80
81
81
This section shows how to grant your VM access to an Azure Storage container. You can use the VM's system-assigned managed identity to retrieve the data in the Azure storage blob.
82
82
83
83
1. Navigate back to your newly created storage account.
84
-
1.Click**Access control (IAM)**.
85
-
1.Click**Add** > **Add role assignment** to open the Add role assignment page.
84
+
1.Select**Access control (IAM)**.
85
+
1.Select**Add** > **Add role assignment** to open the Add role assignment page.
86
86
1. Assign the following role. For detailed steps, see [Assign Azure roles using the Azure portal](../../role-based-access-control/role-assignments-portal.md).
87
87
88
88
| Setting | Value |
@@ -96,9 +96,9 @@ This section shows how to grant your VM access to an Azure Storage container. Yo
96
96
97
97
## Access data
98
98
99
-
Azure Storage natively supports Azure AD authentication, so it can directly accept access tokens obtained using a managed identity. This is part of Azure Storage's integration with Azure AD, and is different from supplying credentials on the connection string.
99
+
Azure Storage natively supports Azure AD authentication, so it can directly accept access tokens obtained using a managed identity. This approach uses Azure Storage's integration with Azure AD, and is different from supplying credentials on the connection string.
100
100
101
-
Here's a .NET code example of opening a connection to Azure Storage using an access token and then reading the contents of the file you created earlier. This code must run on the VM to be able to access the VM's managed identity endpoint. .NET Framework 4.6 or higher is required to use the access token method. Replace the value of `<URI to blob file>` accordingly. You can obtain this value by navigating to file you created and uploaded to blob storage and copying the **URL** under **Properties** the **Overview** page.
101
+
Here's a .NET code example of opening a connection to Azure Storage. The example uses an access token and then reads the contents of the file you created earlier. This code must run on the VM to be able to access the VM's managed identity endpoint. .NET Framework 4.6 or higher is required to use the access token method. Replace the value of `<URI to blob file>` accordingly. You can obtain this value by navigating to file you created and uploaded to blob storage and copying the **URL** under **Properties** the **Overview** page.
102
102
103
103
```csharp
104
104
usingSystem;
@@ -181,7 +181,7 @@ The response contains the contents of the file:
181
181
182
182
## Next steps
183
183
184
-
In this tutorial, you learned how enable a Windows VM's system-assigned identity to access Azure Storage. To learn more about Azure Storage see:
184
+
In this tutorial, you learned how enable a Windows VM's system-assigned identity to access Azure Storage. To learn more about Azure Storage, see:
This tutorial shows you how to use a system-assigned managed identity for a Windows virtual machine (VM) to access an Azure Data Lake Store. Managed Service Identities are automatically managed by Azure and enable you to authenticate to services that support Azure AD authentication, without needing to insert credentials into your code. You learn how to:
24
+
This tutorial shows you how to use a system-assigned managed identity for a Windows virtual machine (VM) to access an Azure Data Lake Store. Managed identities are automatically managed by Azure. They enable your application to authenticate to services that support Azure AD authentication, without needing to insert credentials into your code.
25
+
26
+
In this article you learn how to:
25
27
26
28
> [!div class="checklist"]
27
29
> * Grant your VM access to an Azure Data Lake Store
@@ -48,34 +50,34 @@ This tutorial shows you how to use a system-assigned managed identity for a Wind
48
50
49
51
Now you can grant your VM access to files and folders in an Azure Data Lake Store. For this step, you can use an existing Data Lake Store or create a new one. To create a new Data Lake Store using the Azure portal, follow this [Azure Data Lake Store quickstart](../../data-lake-store/data-lake-store-get-started-portal.md). There are also quickstarts that use the Azure CLI and Azure PowerShell in the [Azure Data Lake Store documentation](../../data-lake-store/data-lake-store-overview.md).
50
52
51
-
In your Data Lake Store, create a new folder and grant your VM's system-assigned identity permission to read, write, and execute files in that folder:
53
+
In your Data Lake Store, create a new folder and grant your VM's system-assigned identity permission. The identity needs rights to read, write, and execute files in that folder:
52
54
53
-
1. In the Azure portal, click**Data Lake Store** in the left-hand navigation.
54
-
2.Click the Data Lake Store you want to use for this tutorial.
55
-
3.Click**Data Explorer** in the command bar.
56
-
4. The root folder of the Data Lake Store is selected. Click**Access** in the command bar.
57
-
5.Click**Add**. In the **Select** field, enter the name of your VM, for example **DevTestVM**. Click to select your VM from the search results, then click**Select**.
58
-
6.Click**Select Permissions**. Select **Read** and **Execute**, add to **This folder**, and add as **An access permission only**. Click**Ok**. The permission should be added successfully.
55
+
1. In the Azure portal, select**Data Lake Store** in the left-hand navigation.
56
+
2.Select the Data Lake Store you want to use for this tutorial.
57
+
3.Select**Data Explorer** in the command bar.
58
+
4. The root folder of the Data Lake Store is selected. Select**Access** in the command bar.
59
+
5.Select**Add**. In the **Select** field, enter the name of your VM, for example **DevTestVM**. Select to select your VM from the search results, then select**Select**.
60
+
6.Select**Select Permissions**. Select **Read** and **Execute**, add to **This folder**, and add as **An access permission only**. Select**Ok**. The permission should be added successfully.
59
61
7. Close the **Access** blade.
60
-
8. For this tutorial, create a new folder. Click**New Folder** in the command bar, and give the new folder a name, for example **TestFolder**. Click**Ok**.
61
-
9.Click on the folder you created, then click**Access** in the command bar.
62
-
10. Similar to step 5, click**Add**, in the **Select** field enter the name of your VM, select it and click**Select**.
63
-
11. Similar to step 6, click**Select Permissions**, select **Read**, **Write**, and **Execute**, add to **This folder**, and add as **An access permission entry and a default permission entry**. Click**Ok**. The permission should be added successfully.
62
+
8. For this tutorial, create a new folder. Select**New Folder** in the command bar, and give the new folder a name, for example **TestFolder**. Select**Ok**.
63
+
9.Select on the folder you created, then select**Access** in the command bar.
64
+
10. Similar to step 5, select**Add**, in the **Select** field enter the name of your VM, select it and select**Select**.
65
+
11. Similar to step 6, select**Select Permissions**, select **Read**, **Write**, and **Execute**, add to **This folder**, and add as **An access permission entry and a default permission entry**. Select**Ok**. The permission should be added successfully.
64
66
65
67
Your VM's system-assigned managed identity can now perform all operations on files in the folder you created. For more information on managing access to Data Lake Store, read this article on [Access Control in Data Lake Store](../../data-lake-store/data-lake-store-access-control.md).
66
68
67
69
## Access data
68
70
69
-
Azure Data Lake Store natively supports Azure AD authentication, so it can directly accept access tokens obtained using managed identities for Azure resources. To authenticate to the Data Lake Store filesystem you send an access token issued by Azure AD to your Data Lake Store filesystem endpoint, in an Authorization header in the format "Bearer <ACCESS_TOKEN_VALUE>". To learn more about Data Lake Store support for Azure AD authentication, read [Authentication with Data Lake Store using Azure Active Directory](../../data-lake-store/data-lakes-store-authentication-using-azure-active-directory.md)
71
+
Azure Data Lake Store natively supports Azure AD authentication, so it can directly accept access tokens obtained using managed identities for Azure resources. To authenticate to the Data Lake Store filesystem, you send an access token issued by Azure AD to your Data Lake Store filesystem endpoint in an Authorization header. The header has the format "Bearer <ACCESS_TOKEN_VALUE>". To learn more about Data Lake Store support for Azure AD authentication, read [Authentication with Data Lake Store using Azure Active Directory](../../data-lake-store/data-lakes-store-authentication-using-azure-active-directory.md)
70
72
71
73
> [!NOTE]
72
74
> The Data Lake Store filesystem client SDKs do not yet support managed identities for Azure resources. This tutorial will be updated when support is added to the SDK.
73
75
74
76
In this tutorial, you authenticate to the Data Lake Store filesystem REST API using PowerShell to make REST requests. To use the VM's system-assigned managed identity for authentication, you need to make the requests from the VM.
75
77
76
-
1. In the portal, navigate to **Virtual Machines**, go to your Windows VM, and in the **Overview**click**Connect**.
78
+
1. In the portal, navigate to **Virtual Machines**, go to your Windows VM, and in the **Overview**select**Connect**.
77
79
2. Enter in your **Username** and **Password** for which you added when you created the Windows VM.
78
-
3. Now that you have created a **Remote Desktop Connection** with the virtual machine, open **PowerShell** in the remote session.
80
+
3. Now that you've created a **Remote Desktop Connection** with the virtual machine, open **PowerShell** in the remote session.
79
81
4. Using PowerShell’s `Invoke-WebRequest`, make a request to the local managed identities for Azure resources endpoint to get an access token for Azure Data Lake Store. The resource identifier for Data Lake Store is `https://datalake.azure.net/`. Data Lake does an exact match on the resource identifier and the trailing slash is important.
80
82
81
83
```powershell
@@ -94,7 +96,7 @@ In this tutorial, you authenticate to the Data Lake Store filesystem REST API us
94
96
$AccessToken = $content.access_token
95
97
```
96
98
97
-
5. Using PowerShell's `Invoke-WebRequest', make a request to your Data Lake Store's REST endpoint to list the folders in the root folder. This is a simple way to check everything is configured correctly. It is important the string "Bearer" in the Authorization header has a capital "B". You can find the name of your Data Lake Store in the **Overview** section of the Data Lake Store blade in the Azure portal.
99
+
5.Check that everything is configured correctly. Using PowerShell's `Invoke-WebRequest', make a request to your Data Lake Store's REST endpoint to list the folders in the root folder. It's important the string "Bearer" in the Authorization header has a capital "B". You can find the name of your Data Lake Store in the **Overview** section of your Data Lake Store.
If you inspect the value of `$HdfsRedirectResponse` it should look like the following response:
140
+
If you inspect the value of `$HdfsRedirectResponse`, it should look like the following response:
139
141
140
142
```powershell
141
143
PS C:\> $HdfsRedirectResponse
@@ -190,7 +192,7 @@ Using other Data Lake Store filesystem APIs you can append to files, download fi
190
192
191
193
## Next steps
192
194
193
-
In this tutorial, you learned how to use a system-assigned managed identity for a Windows virtual machine to access an Azure Data Lake Store. To learn more about Azure Data Lake Store see:
195
+
In this tutorial, you learned how to use a system-assigned managed identity for a Windows virtual machine to access an Azure Data Lake Store. To learn more about Azure Data Lake Store, see:
194
196
195
197
> [!div class="nextstepaction"]
196
198
>[Azure Data Lake Store](../../data-lake-store/data-lake-store-overview.md)
0 commit comments