How would I create a role to be Synapse Admin but block particular pipeline and linked services

JayZee64 0 Reputation points
2024-06-06T10:59:15.0466667+00:00

We a introducing a new source of data into Synapse which is highly sensitive. However currently my team have admin on Synapse and dedicated SQL pool. How can I allow them to keep some of the admin access but not allow them to see the pipelines and linked service related to this new data source?

Azure Synapse Analytics
Azure Synapse Analytics
An Azure analytics service that brings together data integration, enterprise data warehousing, and big data analytics. Previously known as Azure SQL Data Warehouse.
4,612 questions
Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
708 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Smaran Thoomu 12,090 Reputation points Microsoft Vendor
    2024-06-06T11:24:39.8666667+00:00

    Hi @JayZee64

    Thanks for the question and using MS Q&A platform.

    To create a role in Synapse that allows users to have admin access but blocks access to particular pipelines and linked services, you can use Azure RBAC (Role-Based Access Control) to define a custom role with the necessary permissions.

    • Open the Azure Synapse Analytics workspace in the Azure portal. User's image

    So, here’s what I did, but at the Subscription level:

    • Click on the relevant Subscription.
    • Click on Access Control (IAM)
    • Click Add -> Add Custom Role

    User's image

    • Give the custom role a name (e.g. "Restricted Admin") and a description.
    • Under "Permissions", select the "Microsoft.Synapse/workspaces/" resource provider and grant the "Microsoft.Authorization//read" permission. This will allow users with this role to view the Synapse workspace and its resources. User's image
    • Under "Permissions", select the "Microsoft.Synapse/workspaces/linkedServices/" resource provider and grant the "Microsoft.Authorization//read" permission. This will allow users with this role to view the linked services in the Synapse workspace.
    • Under "NotActions", select the "Microsoft.Synapse/workspaces/pipelines/" resource provider and deny the "Microsoft.Authorization//read" permission. This will block users with this role from viewing the pipelines in the Synapse workspace.
    • Under "NotActions", select the "Microsoft.Synapse/workspaces/linkedServices/" resource provider and deny the "Microsoft.Authorization//read" permission. This will block users with this role from viewing the linked services in the Synapse workspace.
    • Click "Review + create" to create the custom role.
    • Assign the custom role to the users who need admin access but should be blocked from viewing the pipelines and linked services related to the new data source.

    Refer this article for more information: https://video2.skills-academy.com/en-us/azure/synapse-analytics/security/synapse-workspace-synapse-rbac-roles

    Hope this helps. Do let us know if you any further queries.

    If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.