There are various scenarios wherein you would need to access data on Azure Storage or secrets from Azure Key Vault from a Data Factory pipeline or your applications. Often there is a security requirement to prevent any unknown sources from accessing the Storage account or the Azure Key Vault service. In such circumstances, you can use the ‘Allow trusted Microsoft services...’ setting in the firewall to enable access to your data from 'Trusted Services' without requiring you to allow connections from all network. For more details on 'Trusted Services', please refer azure storage and azure key vault documentation.
Data Factory is now part of ‘Trusted Services’ in Azure Key Vault and Azure Storage. Integration runtime (Azure or Self-hosted) can now connect to Storage/ Key Vault without having to be inside the same virtual network or requiring you to allow all inbound connections to the service.
Note: Mapping Data flows does not work using the ‘Trusted Services’ yet. We will be enabling this functionality for data flows soon.
Note: We are actively working on adding the capability to add/ peer an Azure IR inside VNET.
Note: Only Managed Identity authentication is supported when using ‘Trusted Service’ functionality in storage to allow Azure Data Factory to access its data.
See the following related articles for more details:
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.