Skip to content

Commit f9e7b09

Browse files
author
Jill Grant
authored
Merge pull request #289711 from jovinson-ms/deid-storage-tutorial
Adding storage configuration tutorial to deid
2 parents d67ff55 + 446ec25 commit f9e7b09

File tree

3 files changed

+108
-1
lines changed

3 files changed

+108
-1
lines changed

‎articles/healthcare-apis/deidentification/configure-storage.md

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
---
2+
title: Learn how to configure Azure Storage to de-identify documents with the de-identification service
3+
description: "Learn how to configure Azure Storage to de-identify documents with the de-identification service."
4+
author: jovinson-ms
5+
ms.author: jovinson
6+
ms.service: azure-health-data-services
7+
ms.subservice: deidentification-service
8+
ms.topic: tutorial
9+
ms.date: 11/01/2024
10+
11+
#customer intent: As an IT admin, I want to know how to configure an Azure Storage account to allow access to the de-identification service to de-identify documents.
12+
13+
---
14+
15+
# Tutorial: Configure Azure Storage to de-identify documents
16+
17+
The Azure Health Data Services de-identification service (preview) can de-identify documents in Azure Storage via an asynchronous job. If you have many documents that you would like
18+
to de-identify, using a job is a good option. Jobs also provide consistent surrogation, meaning that surrogate values in the de-identified output will match across
19+
all documents. For more information about de-identification, including consistent surrogation, see [What is the de-identification service (preview)?](overview.md)
20+
21+
When you choose to store documents in Azure Blob Storage, you're charged based on Azure Storage pricing. This cost isn't included in the
22+
de-identification service pricing. [Explore Azure Blob Storage pricing](https://azure.microsoft.com/pricing/details/storage/blobs).
23+
24+
In this tutorial, you:
25+
26+
> [!div class="checklist"]
27+
> * Create a storage account and container
28+
> * Upload a sample document
29+
> * Grant the de-identification service access
30+
> * Configure network isolation
31+
32+
## Prerequisites
33+
34+
* An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
35+
* A de-identification service with system-assigned managed identity. [Deploy the de-identification service (preview)](quickstart.md).
36+
37+
## Open Azure CLI
38+
39+
Install [Azure CLI](/cli/azure/install-azure-cli) and open your terminal of choice. In this tutorial, we're using PowerShell.
40+
41+
## Create a storage account and container
42+
1. Set your context, substituting the subscription name containing your de-identification service for the `<subscription_name>` placeholder:
43+
```powershell
44+
az account set --subscription "<subscription_name>"
45+
```
46+
1. Save a variable for the resource group, substituting the resource group containing your de-identification service for the `<resource_group>` placeholder:
47+
```powershell
48+
$ResourceGroup = "<resource_group>"
49+
```
50+
1. Create a storage account, providing a value for the `<storage_account_name>` placeholder:
51+
```powershell
52+
$StorageAccountName = "<storage_account_name>"
53+
$StorageAccountId = $(az storage account create --name $StorageAccountName --resource-group $ResourceGroup --sku Standard_LRS --kind StorageV2 --min-tls-version TLS1_2 --allow-blob-public-access false --query id --output tsv)
54+
```
55+
1. Assign yourself a role to perform data operations on the storage account:
56+
```powershell
57+
$UserId = $(az ad signed-in-user show --query id -o tsv)
58+
az role assignment create --role "Storage Blob Data Contributor" --assignee $UserId --scope $StorageAccountId
59+
```
60+
1. Create a container to hold your sample document:
61+
```powershell
62+
az storage container create --account-name $StorageAccountName --name deidtest --auth-mode login
63+
```
64+
## Upload a sample document
65+
Next, you upload a document that contains synthetic PHI:
66+
```powershell
67+
$DocumentContent = "The patient came in for a visit on 10/12/2023 and was seen again November 4th at Contoso Hospital."
68+
az storage blob upload --data $DocumentContent --account-name $StorageAccountName --container-name deidtest --name deidsample.txt --auth-mode login
69+
```
70+
71+
## Grant the de-identification service access to the storage account
72+
73+
In this step, you grant the de-identification service's system-assigned managed identity role-based access to the container. You grant the **Storage Blob
74+
Data Contributor** role because the de-identification service will both read the original document and write de-identified output documents. Substitute the name of
75+
your de-identification service for the `<deid_service_name>` placeholder:
76+
```powershell
77+
$DeidServicePrincipalId=$(az resource show -n <deid_service_name> -g $ResourceGroup --resource-type microsoft.healthdataaiservices/deidservices --query identity.principalId --output tsv)
78+
az role assignment create --assignee $DeidServicePrincipalId --role "Storage Blob Data Contributor" --scope $StorageAccountId
79+
```
80+
81+
## Configure network isolation on the storage account
82+
Next, you update the storage account to disable public network access and only allow access from trusted Azure services such as the de-identification service.
83+
After running this command, you won't be able to view the storage container contents without setting a network exception.
84+
Learn more at [Configure Azure Storage firewalls and virtual networks](/azure/storage/common/storage-network-security).
85+
86+
```powershell
87+
az storage account update --name $StorageAccountName --public-network-access Disabled --bypass AzureServices
88+
```
89+
90+
## Clean up resources
91+
Once you're done with the storage account, you can delete the storage account and role assignments:
92+
```powershell
93+
az role assignment delete --assignee $DeidServicePrincipalId --role "Storage Blob Data Contributor" --scope $StorageAccountId
94+
az role assignment delete --assignee $UserId --role "Storage Blob Data Contributor" --scope $StorageAccountId
95+
az storage account delete --ids $StorageAccountId --yes
96+
```
97+
98+
## Next step
99+
100+
> [!div class="nextstepaction"]
101+
> [Quickstart: Azure Health De-identification client library for .NET](quickstart-sdk-net.md)

‎articles/healthcare-apis/deidentification/quickstart.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,4 +69,5 @@ If you no longer need them, delete the resource group and de-identification serv
6969

7070
## Related content
7171

72-
[De-identification service overview](overview.md)
72+
> [!div class="nextstepaction"]
73+
> [Tutorial: Configure Azure Storage to de-identify documents](configure-storage.md)

‎articles/healthcare-apis/deidentification/toc.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,11 @@ items:
1515
href: quickstart.md
1616
- name: Azure Health De-identification client library for .NET
1717
href: quickstart-sdk-net.md
18+
- name: Tutorials
19+
expanded: true
20+
items:
21+
- name: Configure Azure Storage to de-identify documents
22+
href: configure-storage.md
1823
- name: How-to
1924
expanded: true
2025
items:

0 commit comments

Comments
 (0)