Is there any way to create a managed application that contains a DB server that publisher can't access data on it but customer can?

Question

Hello,

I planning to create Azure Managed Application that will contain Linux VM with the application server and DB. As far as I understand from this article https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/overview I as a publisher can access to all resources from the Managed Resource Group of Managed Application. But customer can store confidential data on DB that I have access.

Is there any way to limit access for a publisher to some resources in Managed Resource Group that can store customer internal data?

Answer 1

Hi @Ivan Karimov One of ways can be --- restrict publisher account access on DB.(assuming its SQL -SQL managed Studio) ---- Create a user (publisher) account (make sure its not mapped to any Database)---Right Click on the upper section of the SQL (SQLSERVER Name)>Properties>Permissions>Click on the user account, and select Deny to view databases.---Right Click on the newly created DB, Properties,Files, and change the Owner to the newly created account.
At this point, once the user/publisher logs in to Db he will see the Master,tempdb and will also see the new DB which he is a DB Owner of.

OR
DENY VIEW any DATABASE TO PUBLIC;
GRANT CREATE DATABASE TO PUBLIC;

Ref: https://stackoverflow.com/questions/13809456/sql-database-restrict-view-of-data