Hotspot Question You need to recommend a solution to integrate Azure Cosmos DB and Azure Synapse. The solution must meet the following requirements: - Traffic from an Azure Synapse workspace to the…

Question

Exhibit

Answer Area

• When provisioning the Azure Synapse workspace:
  Configure a dedicated managed virtual network.Disable public network access to the workspace endpoints.Enable the use of the Azure AD authentication.
• When configuring the Azure Cosmos DB account, enable:
  Managed private endpointsServer-level firewall rulesService endpoint policies

Explanation

To enable private connectivity between Azure Synapse and Azure Cosmos DB over the Microsoft backbone without traversing the internet, the Synapse workspace must be provisioned with a managed virtual network, and then managed private endpoints should be configured for the Cosmos DB account within Synapse.

Approach. The core requirement is to ensure traffic between Azure Synapse and Azure Cosmos DB uses the Microsoft backbone network and does not route over the internet, while minimizing implementation effort.

For 'When provisioning the Azure Synapse workspace:', the correct option is 'Configure a dedicated managed virtual network'. Deploying an Azure Synapse Analytics workspace with a managed virtual network isolates the compute resources (e.g., Spark pools, data integration runtimes) within an Azure-managed VNet. This is a prerequisite for the Synapse workspace to securely connect to other Azure services (like Cosmos DB) using Managed Private Endpoints, ensuring that outbound traffic from Synapse to these services flows privately within the Azure backbone.

For 'When configuring the Azure Cosmos DB account, enable:', the correct option is 'Managed private endpoints'. Once the Synapse workspace has a managed virtual network, you can create 'Managed private endpoints' from the Synapse workspace to the Azure Cosmos DB account. A Managed Private Endpoint creates a private IP address for the Cosmos DB account within the Synapse's managed VNet. This ensures that all traffic from Synapse to Cosmos DB travels exclusively over the Microsoft backbone network, bypassing the public internet, and fulfilling all specified requirements efficiently.

Common mistakes.

• common_mistake. 1. For Azure Synapse:
  • 'Disable public network access to the workspace endpoints': This option controls inbound access to the Synapse workspace (e.g., to Synapse Studio). While good for security, it does not address the outbound traffic routing requirements from Synapse to Cosmos DB.
  • 'Enable the use of the Azure AD authentication': This is an identity and access management feature, not a network connectivity solution. It does not ensure private routing over the Microsoft backbone.

1. For Azure Cosmos DB:
   • 'Server-level firewall rules': These rules control public network access to the Cosmos DB account based on allowed IP addresses or virtual networks. They only filter public traffic and do not ensure that traffic is routed exclusively over the Microsoft backbone or prevent internet routing.
   • 'Service endpoint policies': While Azure Service Endpoints route traffic over the Azure backbone, they still connect to the service's public endpoint. Private Endpoints provide a more secure and fully private connection by creating a private IP within the virtual network. Moreover, Synapse's managed VNet capability is designed to integrate with Managed Private Endpoints for outbound private connectivity to other services, making it the most direct and integrated approach for this scenario.

Concept tested. Azure Synapse Analytics Managed Virtual Networks, Azure Private Link (Private Endpoints), and secure private connectivity between Azure services over the Microsoft backbone network.

Reference. https://docs.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-managed-vnet https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-configure-private-endpoint

No community discussion yet for this question.