Update-AzSynapseWorkspace

Module:

Az.Synapse Module

Updates a Synapse Analytics workspace.

Update-AzSynapseWorkspace
 -Name <String>
 [-ResourceGroupName <String>]
 [-Tag <Hashtable>]
 [-SqlAdministratorLoginPassword <SecureString>]
 [-ManagedVirtualNetwork <PSManagedVirtualNetworkSettings>]
 [-EncryptionKeyName <String>]
 [-UserAssignedIdentityInEncryption <String>]
 [-UseSystemAssignedIdentityInEncryption <Object>]
 [-GitRepository <PSWorkspaceRepositoryConfiguration>]
 [-UserAssignedIdentityAction <UserAssignedManagedIdentityActionType>]
 [-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>]
 [-EnablePublicNetworkAccess <Boolean>]
 [-AsJob]
 [-DefaultProfile <IAzureContextContainer>]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

Update-AzSynapseWorkspace
 -InputObject <PSSynapseWorkspace>
 [-Tag <Hashtable>]
 [-SqlAdministratorLoginPassword <SecureString>]
 [-ManagedVirtualNetwork <PSManagedVirtualNetworkSettings>]
 [-EncryptionKeyName <String>]
 [-UserAssignedIdentityInEncryption <String>]
 [-UseSystemAssignedIdentityInEncryption <Object>]
 [-GitRepository <PSWorkspaceRepositoryConfiguration>]
 [-UserAssignedIdentityAction <UserAssignedManagedIdentityActionType>]
 [-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>]
 [-EnablePublicNetworkAccess <Boolean>]
 [-AsJob]
 [-DefaultProfile <IAzureContextContainer>]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

Update-AzSynapseWorkspace
 -ResourceId <String>
 [-Tag <Hashtable>]
 [-SqlAdministratorLoginPassword <SecureString>]
 [-ManagedVirtualNetwork <PSManagedVirtualNetworkSettings>]
 [-EncryptionKeyName <String>]
 [-UserAssignedIdentityInEncryption <String>]
 [-UseSystemAssignedIdentityInEncryption <Object>]
 [-GitRepository <PSWorkspaceRepositoryConfiguration>]
 [-UserAssignedIdentityAction <UserAssignedManagedIdentityActionType>]
 [-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>]
 [-EnablePublicNetworkAccess <Boolean>]
 [-AsJob]
 [-DefaultProfile <IAzureContextContainer>]
 [-WhatIf]
 [-Confirm]
 [<CommonParameters>]

The Update-AzSynapseWorkspace cmdlet updates an Azure Synapse Analytics workspace.

Update-AzSynapseWorkspace -Name ContosoWorkspace -Tag @{'key'='value'}

This command updates tags for the specified Azure Synapse Analytics workspace.

$ws = Get-AzSynapseWorkspace -Name ContosoWorkspace
$ws | Update-AzSynapseWorkspace -Tag @{'key'='value1'}

This commands updates tags for the specified Azure Synapse Analytics workspace through pipeline.

Update-AzSynapseWorkspace -ResourceId /subscriptions/21686af7-58ec-4f4d-9c68-f431f4db4edd/resourceGroups/ContosoResourceGroup/providers/Microsoft.Synapse/workspaces/ContosoWorkspace -Tag @{'key'='value2'}

This commands updates tags for the specified Azure Synapse Analytics workspace through pipeline with resource ID.

$config = New-AzSynapseGitRepositoryConfig -RepositoryType GitHub -AccountName ContosoAccount -RepositoryName ContosoRepo -CollaborationBranch main
Update-AzSynapseWorkspace -Name ContosoWorkspace -GitRepository $config

This commands updates Git repository which workspace is connected to for the specified Azure Synapse Analytics workspace.

Update-AzSynapseWorkspace -Name ContosoWorkspace -EnablePublicNetworkAccess $True

This commands updates the specified Azure Synapse Analytics workspace to enable public network access.

$uamis = Get-AzUserAssignedIdentity -ResourceGroupName ContosoResourceGroup
$uamilist = New-Object System.Collections.Generic.List[string]
foreach($uami in $uamis){
	$uamilist.Add($uami.Id)
}

Update-AzSynapseWorkspace -Name ContosoWorkspace -UserAssignedIdentityAction Add -UserAssignedIdentityId $uamilist

This commands updates workspace to add user assigned managed identities in $uamilist.

$uamis = Get-AzUserAssignedIdentity -ResourceGroupName ContosoResourceGroup
$uamilist = New-Object System.Collections.Generic.List[string]
foreach($uami in $uamis){
	$uamilist.Add($uami.Id)
}

Update-AzSynapseWorkspace -Name ContosoWorkspace -UserAssignedIdentityAction Remove -UserAssignedIdentityId $uamilist[0]

This commands removes user assigned managed identities $uamilist[0] from workspace.

$uamis = Get-AzUserAssignedIdentity -ResourceGroupName ContosoResourceGroup
$uamilist = New-Object System.Collections.Generic.List[string]
foreach($uami in $uamis){
	$uamilist.Add($uami.Id)
}

Update-AzSynapseWorkspace -Name ContosoWorkspace -UserAssignedIdentityAction Set -UserAssignedIdentityId $uamilist

This commands updates workspace with user assigned managed identities $uamilist that will cover current identities.

##Add a temp key to the workspace
New-AzSynapseWorkspaceKey -ResourceGroupName ContosoResourceGroup -WorkspaceName ContosoWorkspace -Name TempKey -EncryptionKeyIdentifier https://contosoKeyVault.vault.azure.net/keys/TempKey

##Update the workspace and set the temp key as the TDE protector
Update-AzSynapseWorkspace -WorkspaceName ContosoWorkspace -EncryptionKeyName TempKey -UseSystemAssignedIdentityInEncryption $true

##Note, we need to create a new key version for the original encryption key of the Azure key vault before moving to next steps.

##Update the workspace and set the encryption key back after we created a new key version.
Update-AzSynapseWorkspace -WorkspaceName ContosoWorkspace -EncryptionKeyName default -UseSystemAssignedIdentityInEncryption $true

##Remove the temp key
Remove-AzSynapseWorkspaceKey -WorkspaceName ContosoWorkspace -Name TempKey

This commands demonstrate how to rotate the encryption key of a Synapse workspace, and it is using System Assigned Managed Identity to access the Azure Key Vault.

$uamis = Get-AzUserAssignedIdentity -ResourceGroupName ContosoResourceGroup
$identityId = $uamis[0].Id
$ws = Get-AzSynapseWorkspace -Name ContosoWorkspace
$ws | Update-AzSynapseWorkspace -UseSystemAssignedIdentityInEncryption $false -UserAssignedIdentityInEncryption $identityId
$ws = Get-AzSynapseWorkspace -Name ContosoWorkspace
$ws.Encryption.CustomerManagedKeyDetails.Key

Name KeyVaultUrl
---- -----------
default https://contosoKeyValut.vault.azure.net/keys/testkey

$ws = Get-AzSynapseWorkspace -name ContosoWorkspace
$ws.Encryption.CustomerManagedKeyDetails.KekIdentity

UserAssignedIdentity UseSystemAssignedIdentity
-------------------- -------------------------
/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/ContosoResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/uaminame False

This commands updates workspace Encryption Managed Identity as User Assigned and specify an user assigned identity Id to access your customer-managed key stored in key vault. After updating, we can call Get-AzSynapseWorkspace to get Encryption properties of workspace.

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.