Synapse workspace should use managed virtual network

High Azure General synapse-managed-vnet

Applies to

Microsoft.Synapse/workspaces

What CGPulse checks

A resource passes this rule when managedVirtualNetwork must be set true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable managed virtual network for data exfiltration protection. In Azure Portal: Synapse workspace > Networking > enable Managed virtual network. See: https://learn.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-managed-vnet

CLI

az synapse workspace create -n "{name}" -g "{rg}" --storage-account "<storage-account>" --file-system "<filesystem>" --sql-admin-login-user "<admin>" --sql-admin-login-password "<password>" --managed-virtual-network default

Bicep

resource synapseWorkspace 'Microsoft.Synapse/workspaces@2021-06-01' = {
  name: '{name}'
  location: location
  properties: {
    defaultDataLakeStorage: {
      accountUrl: '<storage-account-url>'
      filesystem: '<filesystem-name>'
    }
    managedVirtualNetwork: 'default'
    managedVirtualNetworkSettings: {
      preventDataExfiltration: true
    }
  }
  identity: { type: 'SystemAssigned' }
}

Terraform

resource "azurerm_synapse_workspace" "{name}" {
  name                                 = "{name}"
  resource_group_name                  = "{rg}"
  location                             = var.location
  storage_data_lake_gen2_filesystem_id = "<adls-filesystem-id>"
  sql_administrator_login              = "<admin-login>"
  sql_administrator_login_password     = "<admin-password>"
  managed_virtual_network_enabled      = true
  data_exfiltration_protection_enabled = true
  identity {
    type = "SystemAssigned"
  }
}

Compliance frameworks

Cloud Security: Azure Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan