Authentication Type for High Sensitive data

Question

Hi all,

I've a new requirement where I've to load very high sensitive data within the organization to Azure SQL Database via Azure Data Factory. Only very few people have access to the database due to data sensitivity level.

I'm looking into various Authentication Type available in Linked Service that make the ADF more secure in terms of data load or access. Is there any Authentication Type that provides high level security?

Thank you!

Answer 1

@Nivaethitha Thangiah Marthandam

Thanks for reaching out to Microsoft Q&A.

I understand you're concerned about security when loading highly sensitive data into Azure SQL Database using Azure Data Factory (ADF). Here's how to approach this for maximum security:

Authentication:

-Azure Active Directory (Azure AD) with Managed Identity: This is the recommended approach for high security. It eliminates storing credentials in ADF.  ADF gets credentials through a managed identity assigned to it, granting access based on Azure AD roles.  Only authorized users with access to the managed identity can trigger data pipelines.

• System-assigned Managed Identity: This identity is tied to the lifecycle of the service instance. When the resource is deleted, Azure automatically deletes the identity.
• User-assigned Managed Identity: This identity is managed separately from the resources that use it. You can create a user-assigned managed identity and assign it to one or more instances of a data factory.

Additional Security Measures:

• Azure Key Vault: Store connection strings and other secrets used by ADF in Azure Key Vault. Key Vault provides secure storage with access control using Azure AD identities. ADF can access secrets securely using managed identity or a service principal with access to the Key Vault.
• Data Encryption: Encrypt data at rest in Azure SQL Database using Transparent Data Encryption (TDE). This encrypts the entire database with a customer-managed key stored in Azure Key Vault.
• Network Security Groups (NSGs): Use NSGs to restrict access to the Azure SQL Database to specific IP addresses or Azure Virtual Networks. This ensures only authorized sources can access the database.
• Minimize Permissions: Grant the absolute minimum permissions in Azure AD roles for users interacting with ADF and the database.
• Service Principal: This is another type of authentication that can be used in ADF.
• Refer:https://learn.microsoft.com/en-us/azure/data-factory/credentials?tabs=data-factory

By combining these techniques, you can significantly enhance the security of your sensitive data transfer using ADF. Remember, security is an ongoing process, so regularly review and update your security practices.

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.