Resource Groups - Protection and Managed Applications

Question

We have a Resource Group that loads files into a Azure sql database. The resource group contains adf, sql database, blob storage. As its a commercial offering were keen to ensure access to the resource group is limited by the customer with the exception of consuming the data in the database. Also and importantly restricting access to the resource group would allow us to protect IP and reduce the risk of customer amendments and possibly breaking the process.

I understand that implementing the resource group into a Clients/Customer tenant means their Admin has full access to the resource group. However does the Azure managed applications approach offer a possible solution?

I understand the customer will have limited access to the resource group which we can control however can I check whether the resource group would sit in the clients tenant/subscription or would the resource group still be located in our local tenant? Hope the above makes sense and happy to clarify further.

Answer 1

Hello @jasejackson-8880 and thank you for your question.

Managed Applications is not one of the areas I work in, but I wanted to let you know of another possible solution.

Azure Data Share can allow you to keep the resource group in your tenant while providing the customer access to the end data. This would protect your IP while still getting the data to the customer. Azure Data Share copies the data from your datastore ( the sql database in your tenant) to the customer's datastore (which sits in the customer's tenant).

Using Azure Data Share in your case actually gives you more options. The customer can opt to receive full snapshots of the tables from your Azure SQL Database into their Azure SQL Database, or choose to receive the same data into their Azure Storage Account (Blob or ADL gen 2).

I am also reaching out internally for more information regarding your question on Managed Applications. If I hear back, I will let you know.