Azure Synapse Analytics Firewall

This article explains how to configure the firewall for your Azure Synapse Analytics workspace to secure your data and prevent unauthorized access.

Overview of Synapse Firewall

Azure Synapse Analytics provides a firewall that allows you to control access to your workspace. You can specify allowed IP addresses or virtual network rules to restrict access to authorized clients and services.

Key Firewall Features:

• IP Firewall Rules: Allow or deny access from specific public IP addresses or ranges.
• Virtual Network Rules: Allow access from specific subnets within your Azure Virtual Networks (VNet).
• Managed Virtual Network: Offers a more secure and isolated network environment for your workspace.
• Private Endpoints: Enable private connectivity from your VNet to the Synapse workspace without exposing it to the public internet.

Configuring IP Firewall Rules

IP firewall rules are essential for allowing connections from your on-premises network, specific client machines, or other Azure services that do not use private endpoints.

Steps to configure IP firewall rules:

1. Navigate to your Synapse workspace in the Azure portal.
2. In the left-hand menu, under "Security", select Firewall.
3. Click Add IP to add a new rule.
4. Enter a descriptive Name for the rule (e.g., "Office Network").
5. Specify the Start IP address and End IP address for the allowed range. For a single IP, use the same address for both.
6. Click Apply to save the rule.

Configuring Virtual Network Rules

Virtual network rules enhance security by allowing access from specific subnets within your Azure Virtual Networks. This is the recommended approach for securing access from within your Azure environment.

Steps to configure VNet rules:

1. Navigate to your Synapse workspace in the Azure portal.
2. In the left-hand menu, under "Security", select Firewall.
3. Under the "Virtual networks" section, click Add virtual network.
4. Select your Subscription, Virtual network, and the desired Subnet.
5. Ensure the subnet is delegated to "Microsoft.Synapse/workspaces".
6. Click Apply to save the rule.

Managed Virtual Network and Private Endpoints

For maximum security, consider enabling the managed virtual network for your Synapse workspace. This isolates your workspace and associated resources within a private network. You can then use private endpoints to establish secure, private connections from your on-premises network or other VNets.

Benefits:

• Enhanced Isolation: Prevents direct public internet exposure.
• Simplified Network Management: Integrates seamlessly with Azure networking.
• Secure Connectivity: Ensures data travels over the Azure backbone network.

Best Practices

• Principle of Least Privilege: Only allow access from networks and IP addresses that are strictly necessary.
• Use VNet Rules and Private Endpoints: Prefer these over IP firewall rules for connections originating from Azure.
• Regularly Review Rules: Periodically audit your firewall rules to ensure they are still relevant and secure.
• Enable Managed Virtual Network: For new workspaces, consider enabling the managed virtual network from the start.
• Monitor Network Activity: Use Azure Monitor and network logs to track access patterns and identify suspicious activity.

# Example PowerShell to add an IP firewall rule
            $workspaceName = "your-synapse-workspace-name"
            $resourceGroupName = "your-resource-group-name"
            $ipAddress = "203.0.113.0/24" # Example IP range

            Set-AzSynapseFirewallRule -WorkspaceName $workspaceName -ResourceGroupName $resourceGroupName -Name "AllowMyNetwork" -IpAddress $ipAddress

# Example Azure CLI to add an IP firewall rule
            az synapse workspace firewall-rule create \
                --workspace-name your-synapse-workspace-name \
                --resource-group your-resource-group-name \
                --name AllowMyIP \
                --start-ip-address 203.0.113.1 \
                --end-ip-address 203.0.113.10

For more detailed information and advanced configurations, refer to the official Azure Synapse Analytics networking documentation.