How to integrate Azure Synapse to app and access data with users' permission

Question

How to integrate Azure Synapse to app and access data with users' permission

Leyuan Chen 1 Microsoft Employee

I want to add data filter function in my app (it's a portal that help users preview and filter data in browser), and I have successfully connected to Synapse in C# code using service principle.

The problem is that my app is used by users and I don't want to use app's permission to access data but use user's permission to do so. That means, if I login, then I can access all the data that I can access. But I don't find doc to describe how to do that

Is it possible to implement such a function?

1 answer

Your answer

Answer 1

HimanshuSinha-msft 19,486 Microsoft Employee Moderator

Hello @Leyuan Chen ,
Thanks for the question and using MS Q&A platform.
As we understand the ask here is how to provide user access on Synapse , please do let us know if its not accurate.
To be honest , i am not sure at this time as what different pernissions you are looking at and more over since you are inteacting with Synapse using Servive Prinicpal even adds to the complexity . I request you to please go through the below link and know about the Synapse access .

https://learn.microsoft.com/en-us/azure/synapse-analytics/guidance/security-white-paper-access-control

Please do let me if you have any queries.
Thanks
Himanshu

Please don't forget to click on or upvote button whenever the information provided helps you. Original posters help the community find answers faster by identifying the correct answer. Here is how
Want a reminder to come back and check responses? Here is how to subscribe to a notification
- If you are interested in joining the VM program and help shape the future of Q&A: Here is how you can be part of Q&A Volunteer Moderators

Leyuan Chen 1 Reputation point Microsoft Employee

2022-12-12T05:41:07.577+00:00

Thank you @HimanshuSinha-msft ,

Maybe my problem is not about how to access Synapse Workshop, but to access data with serverless SQL pool. I can make my description clearer.

Now I'm working on a preview&filter tool to help users in my team access data in Blueshift environment. I use Azure Synapese serverless SQL pool as the fundamental to filter data in Cosmos, Blueshift, etc. I want the tool that uses like Synapse Workspace (or Cosmos portal) which means users can login, preview or filter data from streams, and the permission to the data when I use the tool is exactly the permission of my own. If people from other team want to use the tool, he/she may have different permission to the data because we login with different user.

As for Service Principle(SP), now the tool use SP to access Synapse Workshop well, but SP cannot resolve the problem of permission to data. Because if I use Service Principle of the tool to gain access to all the VC/accounts in Blueshift/Cosmos, it will make people who use this tool to have access to all the data, even he/she doesn't have such permission in his/her own account, which is not compliance.
Leyuan Chen 1 Reputation point Microsoft Employee

2022-12-12T08:26:08.333+00:00

Thank you @HimanshuSinha-msft ,

Maybe I solve the problem by this https://github.com/Azure-Samples/ms-identity-aspnet-webapp-openidconnect , which shows how to use MSFT login info to authenticate...

And this link shows how to use Synapse in .Net with Service Principle, but its resource name is "database.windows.net" which cannot be found in Azure Api Permission page
https://mscosmos.visualstudio.com/CosmosWiki/_wiki/wikis/Cosmos.wiki/1214/Using-NET-to-query-SS-on-Cosmos-via-Serverless

Finally one last thing is the useable resource name of Synapse SQL pool, we can find it with "Azure SQL Database" following this guidance, but the resource link is "sql.azuresynapse-dogfood.net" rather than "database.windows.net"
https://stackoverflow.com/questions/71315574/where-to-allow-database-windows-net-scope-in-azure-application

Share via

How to integrate Azure Synapse to app and access data with users' permission

1 answer

Your answer