Skip to content

Files

Latest commit

JasonWHowellJasonWHowell
Fix portal links batch 3
Feb 8, 2022
6a1dcac · Feb 8, 2022

History

History
83 lines (49 loc) · 5.4 KB

credentials.md

File metadata and controls

83 lines (49 loc) · 5.4 KB
title titleSuffix description author ms.service ms.subservice ms.topic ms.date ms.author ms.custom
Using credentials
Azure Data Factory & Azure Synapse
Learn about using Azure credentials for Azure Data Factory.
nabhishek
data-factory
security
conceptual
07/19/2021
abnarain
synapse

Credentials in Azure Data Factory and Azure Synapse

[!INCLUDEappliesto-adf-asa-md]

Prerequisites

Users must have the Managed Identity Operator (Azure RBAC) role or a custom role with Microsoft.ManagedIdentity/userAssignedIdentities/*/assign/action RBAC action to configure a user assigned managed identity as a credential. Additional RBAC is required to create and use credentials in Synapse. Learn more.

Using credentials

We are introducing Credentials which can contain user-assigned managed identities, service principals, and also lists the system-assigned managed identity that you can use in the linked services that support Azure Active Directory (AAD) authentication. It helps you consolidate and manage all your AAD-based credentials.

Below are the generic steps for using a user-assigned managed identity in the linked services for authentication.

Azure Data Factory

  1. If you do not have a user-assigned managed identity created in Azure, first create one in the Azure portal Managed Identities page.

  2. Associate the user-assigned managed identity to the data factory instance using Azure portal, SDK, PowerShell, REST API. The screenshot below used Azure portal (data factory blade) to associate the user-assigned managed identity.

    :::image type="content" source="media/credentials/uami-azure-portal.png" alt-text="Screenshot showing how to use Azure portal to associate an user-assigned managed identity.":::

  3. Create a Credential in data factory user interface interactively. You can select the user-assigned managed identity associated with the data factory in Step 1.

    :::image type="content" source="media/credentials/create-new-credential.png" alt-text="Screenshot showing the creation of new credentials.":::

    :::image type="content" source="media/credentials/user-assigned-credential-configuration.png" alt-text="Screenshot showing the configuration of new credentials.":::

  4. Create a new linked service and select User-assigned managed identity under authentication

    :::image type="content" source="media/credentials/create-new-linked-service.png" alt-text="Screenshot showing the new linked service with user-assigned managed identity authentication.":::

    :::image type="content" source="media/credentials/linked-service-credential-configuration.png" alt-text="Screenshot showing the new linked service configuration with User-Assigned Managed Identity and credentials selected.":::

Azure Synapse

  1. If you do not have a user-assigned managed identity created in Azure, first create one in the Azure portal Managed Identities page.

  2. Associate the user-assigned managed identity to the workspace using Azure portal, SDK, PowerShell, REST API. The screenshot below used Azure portal (Identity blade) to associate the user-assigned managed identity.

    :::image type="content" source="media/credentials/synapse-uami-azure-portal.png" alt-text="Screenshot showing how to use Azure portal to associate an user-assigned managed identity.":::

  3. Create a Credential in Synapse Studio interactively. You can select the user-assigned managed identity associated with the workspace in Step 1.

    :::image type="content" source="media/credentials/synapse-create-new-credential.png" alt-text="Screenshot showing the creation of new credentials.":::

    :::image type="content" source="media/credentials/user-assigned-credential-configuration.png" alt-text="Screenshot showing the configuration of new credentials.":::

  4. Create a new linked service and select User-assigned managed identity under authentication

    :::image type="content" source="media/credentials/synapse-create-new-linked-service.png" alt-text="Screenshot showing the new linked service with user-assigned managed identity authentication.":::

    :::image type="content" source="media/credentials/linked-service-credential-configuration.png" alt-text="Screenshot showing the new linked service configuration with User-Assigned Managed Identity and credentials selected.":::

Note

You can use SDK/ PowerShell/ REST APIs for the above actions. Linked services with user-assigned managed identity are currently not supported in Synapse Spark.

Next steps

See the following topics that introduce when and how to use managed identity:

See Managed Identities for Azure Resources Overview for more background on managed identities for Azure resources, which data factory managed identity is based upon.