Minimum permission to create a Synapse Analytics workspace

Question

Minimum permission to create a Synapse Analytics workspace

pmscorca 1,052

Hi,

I'd like to know which is the minimum permission inside Azure in order to create a Synapse Analytics workspace.

Is contributor enough to accomplish a such task?

Thanks

1 answer

Your answer

Answer 1

Smaran Thoomu 32,520 Microsoft External Staff Moderator

Hi @pmscorca ,

Thanks for the question and using MS Q&A platform.

Yes, you are correct! The minimum permission required to create a Synapse Analytics workspace in Azure is "Contributor" access to the resource group where the workspace will be created. This permission allows the user to create, read, update, and delete resources in the resource group.

For more details, refer to Understand the roles required to perform common tasks in Azure Synapse

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

pmscorca 1,052 Reputation points

2023-12-11T17:28:48.5266667+00:00

Hi @Smaran Thoomu , thanks for the suggested article that but it doesn't talk about the minimum permission to create a Synapse workspace.
Smaran Thoomu 32,520 Reputation points Microsoft External Staff Moderator

2023-12-12T09:41:07.18+00:00
Hi @pmscorca ,

Thanks for the response, the article I provided does not specifically address the minimum permission required to create a Synapse Analytics workspace.

Roles for workspace creation:

Azure Owner: Full access to all resources and configurations, including workspace creation.

Azure Contributor: Can create and manage resources within the workspace, including SQL pools, Spark pools, and Integration Runtimes. This is the minimum permission needed to create a workspace.

Synapse Administrator: Can manage all Synapse resources within the workspace, but cannot create or manage Azure resources like storage accounts.

Synapse Contributor: Can manage most Synapse resources within the workspace but cannot manage workspace-level settings like security policies.

Synapse Artifact Publisher: Can create and manage code artifacts like scripts, notebooks, and pipelines.

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Smaran Thoomu 32,520 Reputation points Microsoft External Staff Moderator

2023-12-13T05:31:07.8833333+00:00

@pmscorca Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
pmscorca 1,052 Reputation points

2023-12-13T09:46:53.61+00:00

Hi @Smaran Thoomu , during the Synapse workspace creation an ADLS gen 2 has to exist already or a new ADLS gen2 has to create.

In agreement with this message:

are you sure that the Azure Contributor represents the minimum role to create a workspace?

Does it exist any articles about this subject?

I don't talk about a role to use after the workspace creation but I refer to a role capable to create the workspace.
Smaran Thoomu 32,520 Reputation points Microsoft External Staff Moderator

2023-12-13T14:39:42.61+00:00

Hi @pmscorca
Thank you for the follow-up question.

Regarding your first question, the document snippet you provided shows that Azure Synapse will automatically grant the workspace identity data access to the specified ADLS Gen2 storage account using the Storage Blob Data Contributor role. This means that you do not need to explicitly assign this role to the workspace identity yourself.

However, you do need to assign the Azure Contributor role to the user or service principal that will be creating the Synapse workspace. This will ensure that the user or service principal has the necessary permissions to create all of the resources required for the workspace, including the ADLS Gen2 storage account (if it does not already exist).

Regarding your second question, the Azure Contributor role is sufficient to create a workspace. The Contributor role allows users to create and manage all Azure resources, including Synapse workspaces. However, it is recommended to follow the principle of least privilege and grant only the necessary permissions to users.

Reference: https://learn.microsoft.com/en-us/azure/role-based-access-control/overview#role-assignments

I hope this information helps.

Share via

Minimum permission to create a Synapse Analytics workspace

1 answer

Your answer