You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/data-share/concepts-roles-permissions.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,13 +15,13 @@ This article describes the roles required to share data using Azure Data Share P
15
15
16
16
## Roles and requirements
17
17
18
-
Azure Data Share uses Managed Identities for Azure Services (previously known as MSIs) to authenticate to underlying storage accounts in order to be able to read data to be shared by a data provider, as well as receive data shared as a data consumer. This ensures that there is no exchange of credentials between the data provider and the data consumer.
18
+
Azure Data Share uses Managed Identities for Azure Services (previously known as MSIs) to authenticate to underlying storage accounts in order to be able to read data to be shared by a data provider, as well as receive data shared as a data consumer. As a result, there is no exchange of credentials between the data provider and the data consumer.
19
19
20
-
In order to facilitate this, the Managed Service Identity needs to be granted access to the underlying storage accounts. The Azure Data Share service uses the Azure Data Share resource's Managed Service Identity to to read and write data. This means that the user of Azure Data Share needs the ability to create a role assignment for the Managed Service Identity to the storage account that they are sharing data from/to. Typically this is a permission that exists in the **owner** role, User Access Administrator role or a custom role with Microsoft.Authorization/role assignments/write permission assigned.
20
+
The Managed Service Identity needs to be granted access to the underlying storage accounts. The Azure Data Share service uses the Azure Data Share resource's Managed Service Identity to read and write data. The user of Azure Data Share needs the ability to create a role assignment for the Managed Service Identity to the storage account that they are sharing data from/to. Permission to create role assignments exists in the **owner** role, User Access Administrator role, or a custom role with Microsoft.Authorization/role assignments/write permission assigned.
21
21
22
22
If you are not an owner of the storage account in question, and you are unable to create a role assignment for the Azure Data Share resource's Managed Identity yourself, you can request an Azure Administrator to create a role assignment on your behalf.
23
23
24
-
Below is a summary of the roles assigned to Data Share resourceManaged Identity:
24
+
Below is a summary of the roles assigned to Data Share resource-Managed Identity:
25
25
26
26
||||
27
27
|---|---|---|
@@ -31,9 +31,9 @@ Below is a summary of the roles assigned to Data Share resource Managed Identity
31
31
|Azure Data Lake Gen2 | Storage Blob Data Reader | Storage Blob Data Contributor
32
32
|
33
33
### Data Providers
34
-
To add a dataset to an Azure Data Share, the data providers data share resourcemanaged identity needs to be added to the Storage Blob Data Reader role. This is done automatically by the Azure Data Share service if the user is adding datasets via the Azure Portal and is an owner of the storage account, or is a member of a custom role which has the Microsoft.Authorization/role assignments/write permission assigned.
34
+
To add a dataset to an Azure Data Share, the data providers data share resource-managed identity needs to be added to the Storage Blob Data Reader role. This is done automatically by the Azure Data Share service if the user is adding datasets via Azure and is an owner of the storage account, or is a member of a custom role that has the Microsoft.Authorization/role assignments/write permission assigned.
35
35
36
-
In the absence of the above conditions, the user can have an Azure Administrator add the Data Share resource Managed Identity to the Storage Blob Data Reader account. Creating this role assignment manually by the Administrator will void having to be an owner of the Storage account or have a custom role assignment. Note that this applies to data being shared from Azure Storage or Azure Data Lake Gen2.
36
+
Alternatively, the user can have an Azure Administrator add the data share resource-managed identity to the Storage Blob Data Reader role manually. Creating this role assignment manually by the Administrator will void having to be an owner of the Storage account or have a custom role assignment. This applies to data being shared from Azure Storage or Azure Data Lake Gen2.
37
37
38
38
If sharing data from Azure Data Lake Gen1, the role assignment must be made to the Owner role.
39
39
@@ -47,11 +47,11 @@ To create a role assignment for the Data Share resource's Managed Identity, foll
47
47
1. Click *Save*
48
48
49
49
### Data Consumers
50
-
To receive data, the data consumers data share resourcemanaged identity needs to be added to the Storage Blob Data Contributor role. This role is required to enable the Azure Data Share service to be able to write to the storage account. This is done automatically by the Azure Data Share service if the user is adding datasets via the Azure Portal and is an owner of the storage account, or is a member of a custom role which has the Microsoft.Authorization/role assignments/write permission assigned.
50
+
To receive data, the data consumers data share resource-managed identity needs to be added to the Storage Blob Data Contributor role. This role is required to enable the Azure Data Share service to be able to write to the storage account. This is done automatically by the Azure Data Share service if the user is adding datasets via Azure and is an owner of the storage account, or is a member of a custom role which has the Microsoft.Authorization/role assignments/write permission assigned.
51
51
52
-
In the absence of the above conditions, the user can have an Azure Administrator add the Data Share resource Managed Identity to the Storage Blob Data Contributor account. Creating this role assignment manually by the Administrator will void having to be an owner of the Storage account or have a custom role assignment. Note that this applies to data being shared to Azure Storage or Azure Data Lake Gen2. Receiving data to Azure Data Lake Gen1 is not supported.
52
+
Alternatively, the user can have an Azure Administrator add the data share resource-managed identity to the Storage Blob Data Contributor role manually. Creating this role assignment manually by the Administrator will void having to be an owner of the Storage account or have a custom role assignment. Note that this applies to data being shared to Azure Storage or Azure Data Lake Gen2. Receiving data to Azure Data Lake Gen1 is not supported.
53
53
54
-
To create a role assignment for the Data Share resource's Managed Identity, follow the below steps:
54
+
To create a role assignment for the Data Share resource's Managed Identity manually, follow the below steps:
55
55
56
56
1. Navigate to the Storage account
57
57
1. Select **Access Control (IAM)**
@@ -62,7 +62,7 @@ To create a role assignment for the Data Share resource's Managed Identity, foll
62
62
63
63
If you are sharing data using our REST APIs, you will need to create these role assignments manually by adding the data share account in to the appropriate roles.
64
64
65
-
To learn more about how to add a role assignment, refer to [this documentation](https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal#add-a-role-assignment) which outlines how to add a role assignment to an Azure resource.
65
+
To learn more about how to add a role assignment, refer to [this documentation,](https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal#add-a-role-assignment) which outlines how to add a role assignment to an Azure resource.
Copy file name to clipboardExpand all lines: articles/data-share/scripts/powershell/create-view-trigger-powershell.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -42,8 +42,8 @@ This script uses the following commands:
42
42
43
43
| Command | Notes |
44
44
|---|---|
45
-
|[New-AzDataShareTrigger](/powershell/module/az.resources/new-azdatasharetrigger)| Create a share snapshot trigger. |
46
-
|[Get-AzDataShareTrigger](/powershell/module/az.resources/get-azdatasharetrigger)| Gets synchronization settings of a share synchronization. |
45
+
|[New-AzDataShareTrigger](/powershell/module/az.datashare/new-azdatasharetrigger?view=azps-2.6.0)| Create a share snapshot trigger. |
46
+
|[Get-AzDataShareTrigger](/powershell/module/az.datashare/get-azdatasharesynchronizationsetting?view=azps-2.6.0)| Gets synchronization settings of a share synchronization. |
Copy file name to clipboardExpand all lines: articles/data-share/scripts/powershell/monitor-usage-powershell.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,8 +39,8 @@ This script uses the following commands:
39
39
40
40
| Command | Notes |
41
41
|---|---|
42
-
|[Get-AzDataShareSynchronization](/powershell/module/az.resources/get-azdatasharesynchronizationdetails)| List synchronizations on a share. |
43
-
|[Get-AzDataShareSynchronizationDetails](/powershell/module/az.resources/get-azdatasharesynchronizationdetails)| Gets synchronization details of a share synchronization. |
42
+
|[Get-AzDataShareSynchronization](/powershell/module/az.datashare/get-azdatasharesynchronization?view=azps-2.6.0)| List synchronizations on a share. |
43
+
|[Get-AzDataShareSynchronizationDetails](/powershell/module/az.datashare/get-azdatasharesynchronizationdetail?view=azps-2.6.0)| Gets synchronization details of a share synchronization. |
Copy file name to clipboardExpand all lines: articles/data-share/scripts/powershell/set-view-synchronizations-powershell.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -43,8 +43,8 @@ This script uses the following commands:
43
43
44
44
| Command | Notes |
45
45
|---|---|
46
-
|[New-AzDataShareSynchronizationSetting](/powershell/module/az.resources/new-azdatasharesynchronizationsettings)| Create a share synchronization. |
47
-
|[Get-AzDataShareSynchronizationSetting](/powershell/module/az.resources/get-azdatasharesynchronizationsetting)| Gets synchronization settings of a share synchronization. |
46
+
|[New-AzDataShareSynchronizationSetting](/powershell/module/az.datashare/new-azdatasharesynchronizationsetting?view=azps-2.6.0)| Create a share synchronization. |
47
+
|[Get-AzDataShareSynchronizationSetting](/powershell/module/az.datashare/get-azdatasharesynchronizationsetting?view=azps-2.6.0)| Gets synchronization settings of a share synchronization. |
0 commit comments