Enabling Data Use Management on your Microsoft Purview sources – Microsoft Purview

Table of Contents0.1 In this article1 Prerequisites1.1 Register Microsoft Purview as a resource provider in other subscriptions1.2 Configure permissions for policy management actions1.2.1 Permissions to make a data resource available for Data Use Management1.2.2 Permissions for policy authoring and publishing1.2.3 Delegation of access control responsibility to Microsoft Purview2 Enable Data […]

Data Use Management (DUM) is an option within the data source registration in Microsoft Purview. This option lets Microsoft Purview manage data access for your resources. The high level concept is that the data owner allows its data resource to be available for access policies by enabling DUM.

Currently, a data owner can enable DUM on a data resource for these types of access policies:

To be able to create any data policy on a resource, DUM must first be enabled on that resource. This article will explain how to enable DUM on your resources in Microsoft Purview.

Important

Because Data Use Management directly affects access to your data, it directly affects your data security. Review additional considerations and best practices below before enabling DUM in your environment.

Prerequisites

Register Microsoft Purview as a resource provider in other subscriptions

Execute this step only if the data sources and the Microsoft Purview account are in different subscriptions. Register Microsoft Purview as a resource provider in each subscription where data sources reside by following this guide: Register resource provider.

The Microsoft Purview resource provider is:

Microsoft.Purview

Configure permissions for policy management actions

This section discusses the permissions needed to:

  • Make a data resource available for Data Use Management. This step is needed before a policy can be created in Microsoft Purview for that resource.
  • Author and publish policies in Microsoft Purview.

Important

Currently, Microsoft Purview roles related to policy operations must be configured at root collection level.

Permissions to make a data resource available for Data Use Management

To enable the Data Use Management (DUM) toggle for a data source, resource group, or subscription, the same user needs to have both certain IAM privileges on the resource and certain Microsoft Purview privileges.

  1. User needs to have either one of the following IAM role combinations on the resource’s ARM path or any parent of it (using inheritance).

    • IAM Owner
    • Both IAM Contributor + IAM User Access Administrator

    Follow this guide to configure Azure RBAC role permissions. The following screenshot shows how to access the Access Control section in Azure portal experience for the data resource to add a role assignment:

Screenshot shows how to access Access Control in Azure Portal to add a role assignment

  1. In addition, the same user needs to have Microsoft Purview Data source administrator (DSA) role at the root collection level. See the guide on managing Microsoft Purview role assignments. The following screenshot shows how to assign Data Source Admin at root collection level:

Screenshot shows how to assign Data Source Admin at root collection level

Permissions for policy authoring and publishing

The following permissions are needed in Microsoft Purview at the root collection level:

  • Policy authors role can create or edit policies.
  • Data source administrator role can publish a policy.

Check the section on managing Microsoft Purview role assignments in this guide.

Note

Known issues related to permissions

  • In addition to Microsoft Purview Policy authors role, user may need Directory Reader permission in Azure Active Directory to create data owner policy. This is a common permission for users in an Azure tenant. You can check permissions for Azure AD Directory Reader

Delegation of access control responsibility to Microsoft Purview

Warning

  • IAM Owner role for a data source can be inherited from parent resource group, subscription or subscription Management Group.
  • Once a resource has been enabled for Data Use Management, any Microsoft Purview root-collection policy author will be able to create access policies against it, and any Microsoft Purview root-collection Data source admin will be able to publish those policies at any point afterwards.
  • Any Microsoft Purview root Collection admin can assign new root-collection Data Source Admin and Policy author roles.
  • If the Microsoft Purview account is deleted then any published policies will stop being enforced within an amount of time that is dependent on the specific data source. This can have implications both on security and data access availability.

With these warnings in mind, here are some suggested best practices for permissions:

  • Minimize the number of people that hold Microsoft Purview root Collection admin, root Data Source Admin or root Policy author roles.
  • To ensure check and balances, assign the Microsoft Purview Policy author and Data source admin roles to different people in the organization. With this, before a data policy takes effect, a second person (the Data source admin) must review it and explicitly approve it by publishing it.
  • A Microsoft Purview account can be deleted by Contributor and Owner roles in IAM. You can check these permissions by navigating to the Access control (IAM) section for your Microsoft Purview account and selecting Role Assignments. You can also place a lock to prevent the Microsoft Purview account from being deleted through ARM locks.

Enable Data Use Management

To enable Data Use Management for a resource, the resource will first need to be registered in Microsoft Purview.
To register a resource, follow the Prerequisites and Register sections of the source pages for your resources.

Once you have your resource registered, follow the rest of the steps to enable an individual resource for Data Use Management.

  1. Go to the Microsoft Purview governance portal.

  2. Select the Data map tab in the left menu.

  3. Select the Sources tab in the left menu.

  4. Select the source where you want to enable Data Use Management.

  5. At the top of the source page, select Edit source.

  6. Set the Data Use Management toggle to Enabled, as shown in the image below.


Set Data Use Management toggle to **Enabled** at the bottom of the menu.

Disable Data Use Management

To disable Data Use Management for a source, resource group, or subscription, a user needs to either be a resource IAM Owner or a Microsoft Purview Data source admin. Once you have those permissions follow these steps:

  1. Go to the Microsoft Purview governance portal.

  2. Select the Data map tab in the left menu.

  3. Select the Sources tab in the left menu.

  4. Select the source you want to disable Data Use Management for.

  5. At the top of the source page, select Edit source.

  6. Set the Data Use Management toggle to Disabled.

  • Make sure you write down the Name you use when registering in Microsoft Purview. You will need it when you publish a policy. The recommended practice is to make the registered name exactly the same as the endpoint name.
  • To disable a source for Data Use Management, remove it first from being bound (i.e. published) in any policy.
  • While user needs to have both data source Owner and Microsoft Purview Data source admin to enable a source for Data Use Management, either of those roles can independently disable it.
  • Make sure you write down the Name you use when registering in Microsoft Purview. You will need it when you publish a policy. The recommended practice is to make the registered name exactly the same as the endpoint name.
  • To disable a source for Data Use Management, remove it first from being bound (i.e., published) in any policy.
  • While user needs to have both data source Owner and Microsoft Purview Data source admin to enable a source for Data Use Management, either of those roles can independently disable it.
  • Disabling Data Use Management for a subscription will disable it also for all assets registered in that subscription.

Warning

Known issues related to source registration

  • Moving data sources to a different resource group or subscription is not yet supported. If want to do that, de-register the data source in Microsoft Purview before moving it and then register it again after that happens.
  • Once a subscription gets disabled for Data Use Management any underlying assets that are enabled for Data Use Management will be disabled, which is the right behavior. However, policy statements based on those assets will still be allowed after that.

Data Use Management best practices

  • We highly encourage registering data sources for Data Use Management and managing all associated access policies in a single Microsoft Purview account.
  • Should you have multiple Microsoft Purview accounts, be aware that all data sources belonging to a subscription must be registered for Data Use Management in a single Microsoft Purview account. That Microsoft Purview account can be in any subscription in the tenant. The Data Use Management toggle will become greyed out when there are invalid configurations. Some examples of valid and invalid configurations follow in the diagram below:
    • Case 1 shows a valid configuration where a Storage account is registered in a Microsoft Purview account in the same subscription.
    • Case 2 shows a valid configuration where a Storage account is registered in a Microsoft Purview account in a different subscription.
    • Case 3 shows an invalid configuration arising because Storage accounts S3SA1 and S3SA2 both belong to Subscription 3, but are registered to different Microsoft Purview accounts. In that case, the Data Use Management toggle will only enable in the Microsoft Purview account that wins and registers a data source in that subscription first. The toggle will then be greyed out for the other data source.
  • If the Data Use Management toggle is greyed out and cannot be enabled, hover over it to know the name of the Microsoft Purview account that has registered the data resource first.

Diagram shows valid and invalid configurations when using multiple Microsoft Purview accounts to manage policies.

Next steps

Source Article

Next Post

Microsoft Purview readiness checklist for the cloud-scale analytics - Cloud Adoption Framework

Thu Jun 23 , 2022
Table of Contents0.1 In this article1 Overview2 Phase 1: Planning and organizational readiness3 Phase 2: Build your data governance and management foundation4 Phase 3: Onboard your first data landing zone5 Phase 4: Onboard more data landing zones Article 06/03/2022 5 minutes to read […]