Avoid previewing data in Copy Data activity in ADF before it gets encrypted

Question

As an entry point in an ADF data pipeline, I have a Copy Data activity that gets plain text data from a spreadsheet on a file share and copy it to an Always Encrypted table on an Azure SQL Database. That’s done using a dedicated ADF Managed Identity that has permissions on the Encryption Key stored in the Azure Key Vault. All the remaining steps in the pipeline is executed using an account that doesn’t have access to the encryption key. So, the only problem I have is that data can be previewed in the Source/Linked Service of the initial Copy Data by an Admin user on production.

Any suggestions on how to avoid this security gap?

Is there anywhere else this data could be visualized by an admin user, like logs, execution plans, etc?

thank you very much.

Answer 1

Hi Marcelo Barbieri,

Thank you for posting query in Microsoft Q&A Platform.

If I understand your query correctly, you created a linked service with dedicated ADF Managed Identity which has permissions for encryption Key in Copy activity. And concern is Admin user who opens ADF can click on preview data in copy activity and view the data, how to avoid it? Please correct me if my understanding is wrong.

One way is, you can avoid giving roles for Admin use to open ADF and perform preview data.

Regarding below query,

Is there anywhere else this data could be visualized by an admin user, like logs, execution plans, etc?

Apart from preview data, no other way admin can visualize this data.

Hope this helps. Please let me know any further queries.

---

Please consider hitting Accept Answer button. Accepted answers help community as well.

Answer 2

Hello @Marcelo Barbieri , We are also facing similar issue where users should not be allowed to preview data in the UI experience without providing the password. Can you provide us some additional details on your solution approach. Would like to know where does the password validation happens in your approach. Assuming the user is entering the password, wanted to understand how the password will be validated if it's correct or not. Any additional details will be highly appreciated !!

Answer 3

My solution was to create a SQL Login on the Azure SQL Database (external knowledge factor) and store the password in the key vault. Then I used a Web Activity to get the password and pass it to the Copy Activity as a parameter. With this implementation, the only way to preview data on the UI is by providing the password required by the parameter.