Azure Synapse Analytics(workspaces): Deploy and Debug - Part 1
Tags: azure, azuresynapseanalytics, azurearm, datawarehouse
Published: 2020-08-21 16:05:25



#Disclaimer:
<em> This post is provided "as-is".</em>

<em>Information and views expressed in this post, including URL and other Internet Web site references, may change without notice. Some examples depicted herein are provided for illustration only and are fictitious.  No real association or connection is intended or should be inferred. This document does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use this document for your internal, reference purposes.
</em>

# [Setting up the Definitions clear](#setting-up-the-definitions-clear)

## Azure Synapse Analytics
[Azure Synapse](https://docs.microsoft.com/en-in/azure/synapse-analytics/sql-data-warehouse/sql-data-warehouse-overview-what-is) is an analytics service that brings together enterprise data warehousing and Big Data analytics. It gives you the freedom to query data on your terms, using either serverless on-demand or provisioned resources-at scale

## Azure Synapse Analytics Workspace *(Preview)*

Azure Synapse comes with a web-native Studio user experience that provides a single experience and model for management, monitoring, coding, and security called [synapse analytics workspace](https://docs.microsoft.com/en-in/azure/synapse-analytics/overview-what-is).
*(As of writing this post, Azure synapse Analytics workspace is in preview)*

If you are familiar with [Azure Data Platform](https://azure.microsoft.com/en-in/overview/data-platform/), I can simply put synapses workspace in a single pic like below 😉

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/0pciicguz94dfzmj31wx.JPG)

## [Roadmap of Azure Synapse Analytics](#Roadmap-of-Azure-Synapse-Analytics)

![Alt Text](https://i.stack.imgur.com/XP6QJ.jpg)

# [What we are going to see in this Post?](#What-we-are-going-to-see-in-this-Post)

We can create the synapses workspace which is a public preview from azure portal easily. However currently, there are no official docs yet available that can give detailed steps for creating synapses workspace programmatically using ARM. In this post *(part 1)*, we are going to see how we can deploy azure synapses from the ARM template using service principal, deployment architecture, the different levels of access, and conditions.

I choose this topic because right now most of the docs are still under development, I faced a lot of troubles initially, even I created few issues and PR. So this post it's just a matter of sharing my new knowledge to others 😊

{% github https://github.com/MicrosoftDocs/azure-docs/issues/60705 %}

{% github https://github.com/Azure/azure-cli/issues/14708 %}

{% github https://github.com/Azure/azure-rest-api-specs/issues/10500 %}

{% github https://github.com/Azure/azure-powershell/pull/12622 %}

# [Getting ARM Template from Azure Portal](#Getting-ARM-Template-from-Azure-Portal)

We can easily grab the template for the synapses workspace template from the Azure portal itself.

## Step 1:
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/61ktaocgv3yqprrx4opl.JPG)

## Step 2:
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/drm2pk3hjhydjkcq94zu.JPG)

After getting the ARM template will look like the below

{% gist https://gist.github.com/jayendranarumugam/82088ef384efa4c95c2a67cd661c339c %}

ARM Parameters,

{% gist https://gist.github.com/jayendranarumugam/b4683f48c66dcc9a6d968256b3afd3d1 %}

# [Architecture of Synapses Workspace:](#Architecture-of-Synapses-Workspace)

Here I'm just giving a very simple & high-level architecture image for understanding the synapses workspace components.


![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/s878xvo3p5hvoika6cgg.jpg)

As you see synapses workspace itself consist of a storage account gen2 and default on-demand SQL pool, it can be accessed by 3 different roles *(NOT RBAC roles)* called 
- Workspace Admin
- SQL Admin
- Spark Admin

I'll explain these roles in part 2. As of now just assume its a role needed for any user to access the workspace.

# [ARM Graphical Viewer](#ARM-Graphical-Viewer)

We can easily understand this ARM using VS Code + [ARM Template View extension](https://marketplace.visualstudio.com/items?itemName=bencoleman.armview). Here the final result will look like

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/uws0nyoc11fupx8max73.jpg)

Great! now we understood that synapses workspace needs a *storage account(gen2)* and a *container (gen2filessystem)* in it. The ARM also has some other components like *roleassignments, managedidentitysqlcontrolsettings, and firewall*. which are basically for giving correct permissions for our workspace, we will look more about these in the below sections.

# [Analyzing Parameters from ARM](#Analyzing-Parameters-from-ARM)

Most of the parameters are self-explanatory, however, some of them depend on some high privilege permission. Let's see those

- **setWorkspaceIdentityRbacOnStorageAccount** :
If true, this will assign the role of the workspace(MSI) as the storage blob contributor to the existing or the new storage account.
This needs *Microsoft.Authorization/roleAssignments/write* permission which requires **owner** role or at-least **User Access Administrator**. So make sure you give owner/User Access Administrator access to your SPN if you set this true.

The below table will help you to understand this parameter based on your SPN access.

{% gist
https://gist.github.com/jayendranarumugam/953b38cf6d9342ef989d3297d2af8c70 %}

- **grantWorkspaceIdentityControlForSql** :
Grant CONTROL to the workspace's managed identity on all SQL pools and SQL on-demand

- **isNewFileSystemOnly**: If the storage account new/exist but when we need to create a new filesystem, use this variable to true

- **setSbdcRbacOnStorageAccount** : If we need to enable the user, (whose object id will be provided in **userObjectId**) as the *Storage Blob contributor* to the Storage account gen2.

This is a nested task which depends on **setWorkspaceIdentityRbacOnStorageAccount** parameter, i.e., this will be executed only if you provide *setWorkspaceIdentityRbacOnStorageAccount* as true. 
*E.g* If you provide *setWorkspaceIdentityRbacOnStorageAccount* as false and even if you provide *setSbdcRbacOnStorageAccount* as true it won't affect anything.

# [Conclusion](#conclusion)

I hope you get some additional information about the synapse workspace from this post. I'll explain more about API's, security best practice in [Part 2](https://dev.to/jayendran/azure-synapse-analytics-workspaces-deploy-and-debug-part-2-l5c)