How should access to a workspace be granted to a data scientist?
Why A is the answer
A role scoped to the workspace, with only what they need
Use role-based access at the narrowest scope.
In detail
- Scope the role to the workspace.
- Grant only what they need.
- Assign roles to groups.
Use case
An illustrative scenario, not a real incident.
A data scientist needs one workspace. A scoped role grants that, rather than Owner on the subscription.
See it in different ways
sequenceDiagram participant D as Developer participant G as GitHub participant A as GitHub Actions participant Z as Azure D->>G: Merges a Bicep change G->>A: Starts the workflow A->>Z: Signs in with OpenID Connect A->>Z: Deploys to dev, test and prod
flowchart TD
Q{"What access is needed?"}
Q -->|"One workspace"| A0["Scoped workspace role"]
Q -->|"Whole subscription"| A1["Far too broad"]Key point: Scope access to the workspace.
Why the other options are wrong
- B. The account key for the workspace's storage account
- An account key gives broad access to the data.
- C. A shared login used by everyone on the data team
- A shared login removes accountability.
- D. Owner on the subscription, so that nothing is ever blocked
- Owner on the subscription is far too broad.