You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/sql-information-protection-policy.md
+19-30Lines changed: 19 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,28 +13,23 @@ SQL information protection's [data discovery and classification mechanism](/azur
13
13
14
14
The classification mechanism is based on the following two elements:
15
15
16
-
-**Labels** – The main classification attributes, used to define the *sensitivity level of the data* stored in the column.
16
+
-**Labels** – The main classification attributes, used to define the *sensitivity level of the data* stored in the column.
17
17
-**Information Types** – Provides additional granularity into the *type of data* stored in the column.
18
18
19
-
The information protection policy options within Defender for Cloud provide a predefined set of labels and information types which serve as the defaults for the classification engine. You can customize the policy, according to your organization's needs, as described below.
19
+
The information protection policy options within Defender for Cloud provide a predefined set of labels and information types that serve as the defaults for the classification engine. You can customize the policy, according to your organization's needs, as described below.
20
20
21
21
:::image type="content" source="./media/sql-information-protection-policy/sql-information-protection-policy-page.png" alt-text="The page showing your SQL information protection policy.":::
22
-
23
-
24
-
25
22
26
23
## How do I access the SQL information protection policy?
27
24
28
25
There are three ways to access the information protection policy:
29
26
30
27
-**(Recommended)** From the **Environment settings** page of Defender for Cloud
31
-
- From the security recommendation "Sensitive data in your SQL databases should be classified"
28
+
- From the security recommendation *Sensitive data in your SQL databases should be classified*
32
29
- From the Azure SQL DB data discovery page
33
30
34
31
Each of these is shown in the relevant tab below.
35
32
36
-
37
-
38
33
### [**From Defender for Cloud's settings**](#tab/sqlip-tenant)
39
34
40
35
<aname="sqlip-tenant"></a>
@@ -48,15 +43,13 @@ From Defender for Cloud's **Environment settings** page, select **SQL informatio
48
43
49
44
:::image type="content" source="./media/sql-information-protection-policy/environment-settings-link-to-information-protection.png" alt-text="Accessing the SQL Information Protection policy from the environment settings page of Microsoft Defender for Cloud.":::
50
45
51
-
52
-
53
46
### [**From Defender for Cloud's recommendation**](#tab/sqlip-db)
54
47
55
48
<aname="sqlip-db"></a>
56
49
57
50
### Access the policy from the Defender for Cloud recommendation
58
51
59
-
Use Defender for Cloud's recommendation, "Sensitive data in your SQL databases should be classified", to view the data discovery and classification page for your database. There, you'll also see the columns discovered to contain information that we recommend you classify.
52
+
Use Defender for Cloud's recommendation, *Sensitive data in your SQL databases should be classified*, to view the data discovery and classification page for your database. There, you'll also see the columns discovered to contain information that we recommend you classify.
60
53
61
54
1. From Defender for Cloud's **Recommendations** page, search for the recommendation **Sensitive data in your SQL databases should be classified**.
62
55
@@ -68,8 +61,6 @@ Use Defender for Cloud's recommendation, "Sensitive data in your SQL databases s
68
61
69
62
:::image type="content" source="./media/sql-information-protection-policy/access-policy-from-security-center-recommendation.png" alt-text="Opening the SQL information protection policy from the relevant recommendation in Microsoft Defender for Cloud's":::
70
63
71
-
72
-
73
64
### [**From Azure SQL**](#tab/sqlip-azuresql)
74
65
75
66
<aname="sqlip-azuresql"></a>
@@ -86,7 +77,7 @@ Use Defender for Cloud's recommendation, "Sensitive data in your SQL databases s
86
77
87
78
:::image type="content" source="./media/sql-information-protection-policy/access-policy-from-azure-sql.png" alt-text="Opening the SQL information protection policy from Azure SQL.":::
88
79
89
-
---
80
+
---
90
81
91
82
## Customize your information types
92
83
@@ -97,52 +88,50 @@ To manage and customize information types:
97
88
:::image type="content" source="./media/sql-information-protection-policy/manage-types.png" alt-text="Manage information types for your information protection policy.":::
98
89
99
90
1. To add a new type, select **Create information type**. You can configure a name, description, and search pattern strings for the information type. Search pattern strings can optionally use keywords with wildcard characters (using the character '%'), which the automated discovery engine uses to identify sensitive data in your databases, based on the columns' metadata.
100
-
91
+
101
92
:::image type="content" source="./media/sql-information-protection-policy/configure-new-type.png" alt-text="Configure a new information type for your information protection policy.":::
102
93
103
-
1. You can also modify the built-in types by adding additional search pattern strings, disabling some of the existing strings, or by changing the description.
94
+
1. You can also modify the built-in types by adding additional search pattern strings, disabling some of the existing strings, or by changing the description.
104
95
105
96
> [!TIP]
106
-
> You can't delete built-in types or change their names.
97
+
> You can't delete built-in types or change their names.
107
98
108
-
1.**Information types** are listed in order of ascending discovery ranking, meaning that the types higher in the list will attempt to match first. To change the ranking between information types, drag the types to the right spot in the table, or use the **Move up** and **Move down** buttons to change the order.
99
+
1.**Information types** are listed in order of ascending discovery ranking, meaning that the types higher in the list attempt to match first. To change the ranking between information types, drag the types to the right spot in the table, or use the **Move up** and **Move down** buttons to change the order.
109
100
110
-
1. Select **OK** when you are done.
101
+
1. Select **OK** when you're done.
111
102
112
-
1. After you completed managing your information types, be sure to associate the relevant types with the relevant labels, by clicking**Configure** for a particular label, and adding or deleting information types as appropriate.
103
+
1. After you completed managing your information types, be sure to associate the relevant types with the relevant labels, by selecting**Configure** for a particular label, and adding or deleting information types as appropriate.
113
104
114
105
1. To apply your changes, select **Save** in the main **Labels** page.
115
-
116
106
117
107
## Exporting and importing a policy
118
108
119
-
You can download a JSON file with your defined labels and information types, edit the file in the editor of your choice, and then import the updated file.
109
+
You can download a JSON file with your defined labels and information types, edit the file in the editor of your choice, and then import the updated file.
120
110
121
111
:::image type="content" source="./media/sql-information-protection-policy/export-import.png" alt-text="Exporting and importing your information protection policy.":::
122
112
123
113
> [!NOTE]
124
-
> You'll need tenant level permissions to import a policy file.
125
-
114
+
> You'll need tenant level permissions to import a policy file.
126
115
127
116
## Permissions
128
117
129
-
To customize the information protection policy for your Azure tenant, you'll need the following actions on the tenant's root management group:
Learn more in [Grant and request tenant-wide visibility](tenant-wide-permissions-management.md).
134
124
135
125
## Manage SQL information protection using Azure PowerShell
136
126
137
127
-[Get-AzSqlInformationProtectionPolicy](/powershell/module/az.security/get-azsqlinformationprotectionpolicy): Retrieves the effective tenant SQL information protection policy.
138
128
-[Set-AzSqlInformationProtectionPolicy](/powershell/module/az.security/set-azsqlinformationprotectionpolicy): Sets the effective tenant SQL information protection policy.
139
-
140
129
141
130
## Next steps
142
-
131
+
143
132
In this article, you learned about defining an information protection policy in Microsoft Defender for Cloud. To learn more about using SQL Information Protection to classify and protect sensitive data in your SQL databases, see [Azure SQL Database Data Discovery and Classification](/azure/azure-sql/database/data-discovery-and-classification-overview).
144
133
145
134
For more information on security policies and data security in Defender for Cloud, see the following articles:
146
-
135
+
147
136
-[Setting security policies in Microsoft Defender for Cloud](tutorial-security-policy.md): Learn how to configure security policies for your Azure subscriptions and resource groups
148
137
-[Microsoft Defender for Cloud data security](data-security.md): Learn how Defender for Cloud manages and safeguards data
0 commit comments