Skip to content

Commit e3510e7

Browse files
committed
Revert "Added considerations related to delegation of responsibility"
This reverts commit 2dd0f5d.
1 parent 2dd0f5d commit e3510e7

File tree

1 file changed

+4
-8
lines changed

1 file changed

+4
-8
lines changed

articles/purview/how-to-enable-data-use-governance.md

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.author: vlrodrig
66
ms.service: purview
77
ms.subservice: purview-data-policies
88
ms.topic: how-to
9-
ms.date: 3/24/2022
9+
ms.date: 3/07/2022
1010
ms.custom:
1111
---
1212

@@ -56,13 +56,8 @@ To disable data use governance for a source, resource group, or subscription, a
5656

5757
1. Set the **Data use governance** toggle to **Disabled**.
5858

59-
## Delegation of access control responsibility to Azure Purview
60-
1. Once a resource has been enabled for *Data use Governance*, **any** Azure Purview *policy author* will be able to create access policies against it, and **any** Azure Purview *Data source admin* will be able to publish those policies at **any point afterwards**
61-
1. **Any** Azure Purview *root collection admin* can create **new** *Data Source Admin* and *Policy author* roles
6259

63-
Also, we mention in the documentation that root collection policy author / DSA are needed to create / publish policies. Have we tested or can we confirm that non-root policy authors or DSAs are prevented from creating or publishing policies? What other negative testing have we done?
64-
65-
## Additional considerations related to Data use governance
60+
### Important considerations related to Data use governance
6661
- Make sure you write down the **Name** you use when registering in Azure Purview. You will need it when you publish a policy. The recommended practice is to make the registered name exactly the same as the endpoint name.
6762
- To disable a source for *Data use governance*, remove it first from being bound (i.e. published) in any policy.
6863
- While user needs to have both data source *Owner* and Azure Purview *Data source admin* to enable a source for *Data use governance*, either of those roles can independently disable it.
@@ -73,7 +68,7 @@ Also, we mention in the documentation that root collection policy author / DSA a
7368
> - Moving data sources to a different resource group or subscription is not yet supported. If want to do that, de-register the data source in Azure Purview before moving it and then register it again after that happens.
7469
> - Once a subscription gets disabled for *Data use governance* any underlying assets that are enabled for *Data use governance* will be disabled, which is the right behavior. However, policy statements based on those assets will still be allowed after that.
7570
76-
## Data use governance best practices
71+
### Data use governance best practices
7772
- We highly encourage registering data sources for *Data use governance* and managing all associated access policies in a single Azure Purview account.
7873
- Should you have multiple Azure Purview accounts, be aware that **all** data sources belonging to a subscription must be registered for *Data use governance* in a single Azure Purview account. That Azure Purview account can be in any subscription in the tenant. The *Data use governance* toggle will become greyed out when there are invalid configurations. Some examples of valid and invalid configurations follow in the diagram below:
7974
- **Case 1** shows a valid configuration where a Storage account is registered in an Azure Purview account in the same subscription.
@@ -83,6 +78,7 @@ Also, we mention in the documentation that root collection policy author / DSA a
8378

8479
![Diagram shows valid and invalid configurations when using multiple Azure Purview accounts to manage policies.](./media/access-policies-common/valid-and-invalid-configurations.png)
8580

81+
8682
## Next steps
8783

8884
- [Create data owner policies for your resources](how-to-data-owner-policy-authoring-generic.md)

0 commit comments

Comments
 (0)