You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/mysql/flexible-server/azure-pipelines-deploy-database-task.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Azure Pipelines task for Azure Database for MySQL - Flexible Server
3
-
description: Enable Azure Database for MySQL - Flexible Server CLI task for using with Azure Pipelines
2
+
title: Azure Pipelines task for Azure Database for MySQL - Flexible Server
3
+
description: Enable Azure Database for MySQL - Flexible Server CLI task for using with Azure Pipelines.
4
4
ms.service: mysql
5
5
ms.subservice: flexible-server
6
6
ms.topic: how-to
@@ -12,7 +12,7 @@ ms.date: 08/09/2021
12
12
13
13
# Azure Pipelines for Azure Database for MySQL - Flexible Server
14
14
15
-
You can automatically deploy your database updates to Azure Database for MySQL - Flexible Server after every successful build with **Azure Pipelines**. You can use Azure CLI task to update the database either with a SQL file or an inline SQL script against the database. This task can be run on cross-platform agents running on Linux, macOS, or Windows operating systems.
15
+
You can automatically deploy your database updates to an Azure Database for MySQL flexible server after every successful build with **Azure Pipelines**. You can use Azure CLI task to update the database either with a SQL file or an inline SQL script against the database. This task can be run on cross-platform agents running on Linux, macOS, or Windows operating systems.
16
16
17
17
## Prerequisites
18
18
@@ -22,8 +22,8 @@ You can automatically deploy your database updates to Azure Database for MySQL -
22
22
- Microsoft hosted agents have Azure CLI pre-installed. However if you are using private agents, [install Azure CLI](/cli/azure/install-azure-cli) on the computer(s) that run the build and release agent. If an agent is already running on the machine on which the Azure CLI is installed, restart the agent to ensure all the relevant stage variables are updated.
23
23
24
24
This quickstart uses the resources created in either of these guides as a starting point:
25
-
- Create an Azure Database for MySQL - Flexible Server using [Azure portal](./quickstart-create-server-portal.md) or [Azure CLI](./quickstart-create-server-cli.md)
26
25
26
+
- Create an Azure Database for MySQL flexible server using [Azure portal](./quickstart-create-server-portal.md) or [Azure CLI](./quickstart-create-server-cli.md)
Copy file name to clipboardExpand all lines: articles/mysql/flexible-server/concepts-audit-logs.md
+2-3Lines changed: 2 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ ms.reviewer:
7
7
ms.date: 11/21/2022
8
8
ms.service: mysql
9
9
ms.subservice: flexible-server
10
-
ms.topic: conceptual
10
+
ms.topic: conceptual
11
11
---
12
12
13
13
# Track database activity with Audit Logs in Azure Database for MySQL - Flexible Server
@@ -46,7 +46,7 @@ Other parameters you can adjust to control audit logging behavior include:
46
46
47
47
## Access audit logs
48
48
49
-
Audit logs are integrated with Azure Monitor diagnostic settings. Once you've enabled audit logs on your MySQL flexible server, you can emit them to Azure Monitor logs, Event Hubs, or Azure Storage. To learn more about diagnostic settings, see the [diagnostic logs documentation](../../azure-monitor/essentials/platform-logs-overview.md). To learn more about how to enable diagnostic settings in the Azure portal, see the [audit log portal article](tutorial-configure-audit.md#set-up-diagnostics).
49
+
Audit logs are integrated with Azure Monitor diagnostic settings. Once you've enabled audit logs on your flexible server, you can emit them to Azure Monitor logs, Event Hubs, or Azure Storage. To learn more about diagnostic settings, see the [diagnostic logs documentation](../../azure-monitor/essentials/platform-logs-overview.md). To learn more about how to enable diagnostic settings in the Azure portal, see the [audit log portal article](tutorial-configure-audit.md#set-up-diagnostics).
50
50
51
51
> [!NOTE]
52
52
> Premium Storage accounts are not supported if you send the logs to Azure storage via diagnostics and settings.
@@ -198,4 +198,3 @@ Once your audit logs are piped to Azure Monitor Logs through Diagnostic Logs, yo
198
198
199
199
- Learn more about [slow query logs](concepts-slow-query-logs.md)
@@ -23,17 +23,17 @@ Microsoft Azure Active Directory (Azure AD) authentication is a mechanism of con
23
23
- Multiple forms of authentication supported by Azure Active Directory, which can eliminate the need to store passwords
24
24
- Customers can manage database permissions using external (Azure AD) groups.
25
25
- Azure AD authentication uses MySQL database users to authenticate identities at the database level
26
-
- Support of token-based authentication for applications connecting to Azure Database for MySQL - Flexible Server
26
+
- Support of token-based authentication for applications connecting to Azure Database for MySQL flexible server
27
27
28
28
## Use the steps below to configure and use Azure AD authentication
29
29
30
-
1. Select your preferred authentication method for accessing the MySQL flexible server. By default, the authentication selected is set to MySQL authentication only. Select Azure Active Directory authentication only or MySQL and Azure Active Directory authentication to enable Azure AD authentication.
30
+
1. Select your preferred authentication method for accessing the flexible server. By default, the authentication selected is set to MySQL authentication only. Select Azure Active Directory authentication only or MySQL and Azure Active Directory authentication to enable Azure AD authentication.
31
31
1. Select the user managed identity (UMI) with the following privileges to configure Azure AD authentication:
32
32
-[User.Read.All](/graph/permissions-reference#user-permissions): Allows access to Azure AD user information.
33
33
-[GroupMember.Read.All](/graph/permissions-reference#group-permissions): Allows access to Azure AD group information.
34
34
-[Application.Read.ALL](/graph/permissions-reference#application-resource-permissions): Allows access to Azure AD service principal (application) information.
35
35
36
-
1. Add Azure AD Admin. It can be Azure AD Users or Groups, which have access to Azure Database for MySQL - Flexible Server.
36
+
1. Add Azure AD Admin. It can be Azure AD Users or Groups, which has access to a flexible server.
37
37
1. Create database users in your database mapped to Azure AD identities.
38
38
1. Connect to your database by retrieving a token for an Azure AD identity and logging in.
39
39
@@ -44,27 +44,27 @@ Microsoft Azure Active Directory (Azure AD) authentication is a mechanism of con
44
44
45
45
User-managed identities are required for Azure Active Directory authentication. When a User-Assigned Identity is linked to the flexible server, the Managed Identity Resource Provider (MSRP) issues a certificate internally to that identity. When the managed identity is deleted, the corresponding service principal is automatically removed.
46
46
47
-
The service then uses the managed identity to request access tokens for services that support Azure AD authentication. Azure Database currently supports only a User-assigned Managed Identity (UMI) for MySQL-Flexible Server. For more information, see [Managed identity types](../../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) in Azure.
47
+
The service then uses the managed identity to request access tokens for services that support Azure AD authentication. Azure Database currently supports only a User-assigned Managed Identity (UMI) for Azure Database for MySQL - Flexible Server. For more information, see [Managed identity types](../../active-directory/managed-identities-azure-resources/overview.md#managed-identity-types) in Azure.
48
48
49
49
The following high-level diagram summarizes how authentication works using Azure AD authentication with Azure Database for MySQL. The arrows indicate communication pathways.
50
50
51
51
:::image type="content" source="media/concepts-azure-ad-authentication/azure-ad-authentication-flow.jpg" alt-text="Diagram of how Azure AD authentication works.":::
52
52
53
53
1. Your application can request a token from the Azure Instance Metadata Service identity endpoint.
54
54
1. When you use the client ID and certificate, a call is made to Azure AD to request an access token.
55
-
1. A JSON Web Token (JWT) access token is returned by Azure AD. Your application sends the access token on a call to Azure Database for MySQL - Flexible Server.
56
-
1.MySQL flexible server validates the token with Azure AD.
55
+
1. A JSON Web Token (JWT) access token is returned by Azure AD. Your application sends the access token on a call to your flexible server.
56
+
1.The flexible server validates the token with Azure AD.
57
57
58
58
## Administrator structure
59
59
60
60
There are two Administrator accounts for the MySQL server when using Azure AD authentication: the original MySQL administrator and the Azure AD administrator.
61
61
62
-
Only the administrator based on an Azure AD account can create the first Azure AD contained database user in a user database. The Azure AD administrator sign-in can be an Azure AD user or an Azure AD group. When the administrator is a group account, it can be used by any group member, enabling multiple Azure AD administrators for the MySQL flexible server. Using a group account as an administrator enhances manageability by allowing you to centrally add and remove group members in Azure AD without changing the users or permissions in the MySQL Flexible server. Only one Azure AD administrator (a user or group) can be configured at a time.
62
+
Only the administrator based on an Azure AD account can create the first Azure AD contained database user in a user database. The Azure AD administrator sign-in can be an Azure AD user or an Azure AD group. When the administrator is a group account, it can be used by any group member, enabling multiple Azure AD administrators for the flexible server. Using a group account as an administrator enhances manageability by allowing you to centrally add and remove group members in Azure AD without changing the users or permissions in the Flexible server. Only one Azure AD administrator (a user or group) can be configured at a time.
63
63
64
64
:::image type="content" source="media/concepts-azure-ad-authentication/azure-ad-admin-structure.jpg" alt-text="Diagram of Azure AD admin structure.":::
65
65
66
-
Methods of authentication for accessing the MySQL flexible server include:
67
-
- MySQL Authentication only - This is the default option. Only the native MySQL Authentication with a MySQL sign-in and password can be used to access Azure Database for MySQL - Flexible Server.
66
+
Methods of authentication for accessing the flexible server include:
67
+
- MySQL authentication only - This is the default option. Only the native MySQL authentication with a MySQL sign-in and password can be used to access the flexible server.
68
68
- Only Azure AD authentication - MySQL native authentication is disabled, and users are able to authenticate using only their Azure AD user and token. To enable this mode, the server parameter **aad_auth_only** is set to _enabled_.
69
69
- Authentication with MySQL and Azure AD - Both native MySQL authentication and Azure AD authentication are supported. To enable this mode, the server parameter **aad_auth_only** is set to _disabled_.
70
70
@@ -90,7 +90,7 @@ Azure AD authentication in Azure Database for MySQL - Flexible Server ensures th
90
90
- Token is signed by Azure AD and hasn't been tampered.
91
91
- Token was issued by Azure AD for the tenant associated with the server.
92
92
- Token hasn't expired.
93
-
- Token is for the Azure Database for MySQL - Flexible Server resource (and not another Azure resource).
93
+
- Token is for the flexible server resource (and not another Azure resource).
94
94
95
95
## Connect using Azure AD identities
96
96
@@ -112,9 +112,9 @@ Once you authenticate against the Active Directory, you retrieve a token. This t
112
112
113
113
## Other considerations
114
114
115
-
-Only one Azure AD administrator can be configured for an Azure Database for MySQL - Flexible Server at any time.
115
+
-You can only configure one Azure AD administrator per flexible server at any time.
116
116
117
-
- Only an Azure AD administrator for MySQL can initially connect to the Azure Database for MySQL - Flexible Server using an Azure Active Directory account. The Active Directory administrator can configure subsequent Azure AD database users or an Azure AD group. When the administrator is a group account, it can be used by any group member, enabling multiple Azure AD administrators for the MySQL Flexible server. Using a group account as an administrator enhances manageability by allowing you to centrally add and remove group members in Azure AD without changing the users or permissions in the MySQL Flexible server.
117
+
- Only an Azure AD administrator for MySQL can initially connect to the flexible server using an Azure Active Directory account. The Active Directory administrator can configure subsequent Azure AD database users or an Azure AD group. When the administrator is a group account, it can be used by any group member, enabling multiple Azure AD administrators for the flexible server. Using a group account as an administrator enhances manageability by allowing you to centrally add and remove group members in Azure AD without changing the users or permissions in the flexible server.
118
118
119
119
- If a user is deleted from Azure AD, that user can no longer authenticate with Azure AD. Therefore, acquiring an access token for that user is no longer possible. Although the matching user is still in the database, connecting to the server with that user isn't possible.
120
120
@@ -123,10 +123,10 @@ Once you authenticate against the Active Directory, you retrieve a token. This t
123
123
124
124
- If the Azure AD admin is removed from the server, the server is no longer associated with an Azure AD tenant, and therefore all Azure AD logins are disabled for the server. Adding a new Azure AD admin from the same tenant re-enables Azure AD logins.
125
125
126
-
-Azure Database for MySQL - Flexible Server matches access tokens to the Azure Database for MySQL users using the user's unique Azure AD user ID instead of the username. This means that if an Azure AD user is deleted in Azure AD and a new user is created with the same name, Azure Database for MySQL considers that a different user. Therefore, if a user is deleted from Azure AD and then a new user with the same name is added, the new user isn't able to connect with the existing user.
126
+
-A flexible server matches access tokens to the Azure Database for MySQL users using the user's unique Azure AD user ID instead of the username. This means that if an Azure AD user is deleted in Azure AD and a new user is created with the same name, the flexible server considers that a different user. Therefore, if a user is deleted from Azure AD and then a new user with the same name is added, the new user isn't able to connect with the existing user.
127
127
128
128
> [!NOTE]
129
-
> The subscriptions of an Azure MySQL flexible server with Azure AD authentication enabled cannot be transferred to another tenant or directory.
129
+
> The subscriptions of a flexible server with Azure AD authentication enabled can't be transferred to another tenant or directory.
0 commit comments