Custom role to restrict Azure Data Factory pipeline developers to create/delete linked services

[JohnEmileLucien]

Restrict ADF pipeline developers to create connection using linked services

Azure Data Factory has some built-in role such as Data Factory Contributor. Once this role is granted to the developers, they can create and run pipelines in Azure Data Factory. The role can be granted at the resource group or above depending on the assignable scope you want the users or group to have access to.

When there is a requirement that the Azure Data Factory pipeline developers should not create or delete linked services to connect to the data sources that they have access to, the built-in role (Data Factory Contributor) will not restrict them. This calls for the creation of custom roles. However, you need to be cognizant about the number of role assignments that you can have depending on your subscription. This can be verified by choosing your resource group and selection the Role assignments under Access Control (IAM).

How do we create a custom role to allow the Data Factory pipeline developers to create pipelines but restrict them only to the existing linked service for connection but not create or delete them?

The following steps will help to restrict them:

1. In the Azure portal, select the resource group where you have the data factory created.
2. Select Access Control (IAM)
3. Click + Add
4. Select Add custom role
5. Under Basics provide a Custom role name. For example: Pipeline Developers
6. Provide a description
7. Select Clone a role for Baseline permissions
8. Select Data Factory Contributor for Role to clone

9. Click Next
10. Under Permissions select + Exclude permissions

11. Under Exclude Permissions, type Microsoft Data Factory and select it.

12. Under Microsoft.DataFactory permissions, type Linked service
13. Select Not Actions
14. Select Delete: Delete Linked Service and Write: Create or Update any Linked service

15. Click Add
16. Click Next
17. Under Assignable Scopes, make sure you want assignable scope to resource group or subscription. Delete and Add assignable scopes accordingly
18. Go over the JSON Tab
19. Click Review + create
20. Once validated, click create

Note: Once the custom role is created, you can assign a user or group to this role. You can login with this user to Azure Data Factory. You will still be able to create a linked service but will not be able to save/publish.