Minimum RBAC Needed to Perform Data Sync

Question

Minimum RBAC Needed to Perform Data Sync

Rodriguez,Mario (HHSC) 20

Trying to figure out how we can put up some guard rails up for allowing Application areas to address their own Data Sync process. Per Azure SQL Best Practices, membership in the SQL DB Contributor role is necessary. Are there any actions/non-actions that are necessary in order to allow least privileged access to perform a Data Sync?

0 comments

Answer accepted by question author

Alberto Morillo 35,506 MVP Volunteer Moderator

At the subscription level you may need the following Azure RBAC permissions or you may get the error Syn0022.

"Microsoft.Sql/locations/syncMemberOperationResults/read"
"Microsoft.Sql/locations/syncAgentOperationResults/read"
"Microsoft.Sql/locations/syncGroupOperationResults/read"

Rodriguez,Mario (HHSC) 20 Reputation points

2023-07-25T19:17:59.1866667+00:00
Thanks, Albert. I did see this in Best Practices:

Permissions at the subscription level should not be needed, but could provide a simplified (though not least required) way to provide necessary permissions for multiple Azure Data Sync implementations in a subscription. An original, deprecated API required these Azure RBAC permissions, but should no longer be in use.

"Microsoft.Sql/locations/syncMemberOperationResults/read"

"Microsoft.Sql/locations/syncAgentOperationResults/read"

"Microsoft.Sql/locations/syncGroupOperationResults/read"
Alberto Morillo 35,506 Reputation points MVP Volunteer Moderator

2023-07-25T19:32:37.0566667+00:00

Yes, those are the RBAC permissions that were mentioned since SQL Data Sync appeared on 2012 and they say no longer needed but in the troubleshooting documentation they list an error that occurs when there is lack of those RBAC permissions.
Oury Ba-MSFT 21,156 Reputation points Microsoft Employee Moderator

2023-07-26T16:30:20.65+00:00

Rodriguez,Mario (HHSC)

Please do not forget to mark as accept answer if the reply from @Alberto Morillo was helpful.

Regards,

Oury

1 additional answer

Your answer

Rodriguez,Mario (HHSC) 20 Reputation points

2023-07-25T19:17:59.1866667+00:00

Thanks, Albert. I did see this in Best Practices:

Permissions at the subscription level should not be needed, but could provide a simplified (though not least required) way to provide necessary permissions for multiple Azure Data Sync implementations in a subscription. An original, deprecated API required these Azure RBAC permissions, but should no longer be in use.

"Microsoft.Sql/locations/syncMemberOperationResults/read"

"Microsoft.Sql/locations/syncAgentOperationResults/read"

"Microsoft.Sql/locations/syncGroupOperationResults/read"
Alberto Morillo 35,506 Reputation points MVP Volunteer Moderator

2023-07-25T19:32:37.0566667+00:00

Yes, those are the RBAC permissions that were mentioned since SQL Data Sync appeared on 2012 and they say no longer needed but in the troubleshooting documentation they list an error that occurs when there is lack of those RBAC permissions.
Oury Ba-MSFT 21,156 Reputation points Microsoft Employee Moderator

2023-07-26T16:30:20.65+00:00

Rodriguez,Mario (HHSC)

Please do not forget to mark as accept answer if the reply from @Alberto Morillo was helpful.

Regards,

Oury

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

Minimum RBAC Needed to Perform Data Sync

1 additional answer

Your answer