FAQs on the Managed Data Platform permissions
As an authorised Microsoft Direct Bill Partner, and an Azure Expert MSP, Macquarie Cloud Services require access to your Microsoft Data Platform services in order to provide managed services for your business or organisation. On this page you will find answers to FAQs regarding the access we require for services, and the measures that you may take to protect that access.
What am I accepting?
- The following Entra ID security groups are required in the Entra Id tenancy with the following names. (NOTE: Group names can be changed to conform to your corporate naming conventions):
- MCS_Fabric_Automation_SPs
- MCS_Fabric_Workspace_Admins
- Add the Enterprise App as a member of the “MCS_Fabric_Automation_SPs” security group.
- Under the Fabric Portal Tenant settings , please grant the “MCS_Fabric_Automation_SPs” security group the following Fabric privileges.
- Service principals can access read-only admin APIs.
- Service principals can access admin APIs used for updates.
- Service principals can create workspaces, connections, and deployment pipelines.
- Service principals can call Fabric public APIs.
- Allow service principals to create and use profiles.
- In the Azure portal, please grant the Enterprise App the capacity administrator role:
- Log in to the Azure portal,
- Type in “Fabric” into the search bar
- Select Microsoft Fabric, Access Control
- Add role assignment, capacity administrator,
- Member, Enterprise App
- Select, Save and close
What security measures are in place to protect the priviledged roles?
Without the requested privileges, we are unable to deliver our managed services. The privileges requested are based on Just-Enough or the least privileges principles.
Since the security groups and the enterprise application are in your tenant directory, your existing security measures apply. As part of the managed service, our actions are logged and audited.
We recommend a regular review of service principal and enterprise app permissions.
What happends after the permissions are granted?
- removing the security groups or
- members from the security groups or
- the permissions from the enterprise app or
- removing the enterprise app.
What are we not requesting?
In this context, we are not requesting An Administer on Behalf of (AOBO) or a Granular Delegated Administrative Privileges (GDAP) . These permissions provide Azure and Entra ID platform-level granular roles and privileges that provide just enough permissions in order to execute the managed services.
If relevant, you may receive other requests from us that nominate these privileges.