Browsers are
difficult
Please wait, loading your map...
Through MS trusted services (Network authentication with Synapse MSI)
Through MS trusted services (Network authentication with Synapse MSI)
Spark script created in synapse studio contacts this to run script on hosts
Azure Synapse Security
mindmap kindly
provided by DMARC-
EXPERT.COM
Secure networking
To Azure Synapse
services
Dedicated SQL pool
Published through PE
Serverless SQL pools
Published through PE
Synapse studio
Published through PE
integrated ADF
Synapse studio
Published through PE
Spark pools
Synapse studio
Published through PE
Development endpoint
(for devops to publish
code for example or to
run spark script)
Published through PE
Access to external
assets
From Serverless SQL
pools
Access to external
storage (network
authentication)
Data lake
From Dedicated SQL
pools
Access to external
storage (network
authentication)
Data lake
From spark pools
Managed VNET
Managed private
endpoint
Data Lake and
supported sources
Data exfiltration
security
From integrated ADF
Managed VNET
Managed private
endpoint
Data Lake and
supported sources
Data exfiltration
security
Vnet
Self hosted IR VM to be
privileged
Availability
Dedicated SQL pool
Backup
Save all Synapse
workspace
configurations in Azure
devops
Azure devops security
to consider
Encryption
Synapse Workspace
encryption
Dedicated SQL pool
Encryption
Collum lvl encryption
Transparent data
encryption
Serverless SQL pools
No data in serverless
SQL pool to encrypt (all
data are in external
storages)
Secure authentication
and authorization
Synapse RBAC
Can be given at
individual object lvl
(more details here)
SQL pools
Authentication
Local SQL
authentication
Azure AD
authentication with
external identities
Authorization
SQL role security
Raw lvl security
Data masking
Access to external
storage from serverless
SQL pools
Default is user pass
trough authentication
with AAD (no credential
in code). Issue :
Connection to data lake
is not done via
Microsoft trusted
services. It is done via
Azure IPs : all Azure IP
must be whitelisted :
0.0.0.0)
Data lake
Use Managed system
identity of Synapse
workspace and create
database tables scoped
to some folders and
only accessible by some
SQL usersIssue :
Connection to data lake
is done via Microsoft
trusted services which
is great to secure the
storage access from
internet. But by using
the MSI of Synapse we
are losing the ADLS
audit traiil. To see
actions performed by
users in SQL pool SQL
audit must be activated
Data lake
Consideration for Spark
pools to authenticate to
external sources
Default is user pass
trough authentication
with AAD (no credential
in code)
Can store credential in
KV and access it (be
carefull of losing user
accountability)
Access KV secret from
spark pool
To do that user should
have access to
credentials (Synapse
RBAC) role scoped in the
credentials.
Use MSI of Synapse
Workspace (be carefull
of losing user
accountability. Prefer
connection with
managed private
endpoint)
To do that user should
have access to
credentials user access
to the MSI(Synapse
RBAC)
Consideration for
integrated ADF to
authenticate to
external sources
Can store credential in
KV and access it
Use internal ADF to
access data source with
password in KV
Use MSI of Synapse
Workspace
Logs
SQL pools
Audit logs activated
Sparks no logs so audit
access to ADLS
Consideration for
serverless SQL pool :
audit access to ADLS
×
Created using
MindMup.com
