Synapse Cloud Native
You set up a synapse cloud native workspace by linking identity groups to database roles. Then you separate storage from compute pools so each team runs isolated queries. Most teams start this setup by granting broad workspace roles to get pipelines running fast. Overly broad roles let users read private tables or run heavy queries without limits. How a synapse cloud native architecture works A cloud data platform splits storage layers from compute engines. Your raw files sit in cloud object
Cloud-Native Application Protection (CNAPP): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up a synapse cloud native workspace by linking identity groups to database roles. Then you separate storage from compute pools so each team runs isolated queries. Most teams start this setup by granting broad workspace roles to get pipelines running fast. Overly broad roles let users read private tables or run heavy queries without limits.
How a synapse cloud native architecture works
A cloud data platform splits storage layers from compute engines. Your raw files sit in cloud object storage buckets. Serverless and dedicated SQL pools read those files when a user sends a query. Apache Spark pools run data jobs on the same storage layer.
You control entry through two layers of roles. Cloud resource roles manage who can start, stop, or scale compute pools. Workspace and SQL roles govern who can read or write tables inside each pool. You map your corporate identity directory to both role layers.
Teams also set up network rules to lock down traffic. Private endpoints keep data traffic inside your virtual network. Firewall rules block public requests from unknown IP addresses. Managed identities let apps talk to storage without saving static keys in code.
What native roles solve and what they miss
Native directory roles solve the basic problem of who can log in. They help you group users by job function and block public network traffic. Storage policies also keep unauthorized apps out of your raw data folders. These controls form a strong first line of defense for your workspace.
Still, static roles only check permissions at login time. Once a user logs into a SQL pool, the role stays active. The native setup does not inspect individual queries before they run. A user with read permissions on a customer table can pull every row by default.
Shared service accounts create another gap for data teams. BI tools and scripts often share one high-privilege role to run reports. When a bad query slows down the pool, audit logs only show the shared account. You cannot tell which person or script sent the query.
Cloud-Native Application Protection (CNAPP): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Masking sensitive fields across pools also takes manual work. If you change a table schema, you must update masking rules by hand. Native rules only apply inside the specific pool where you set them up. When analysts query raw files through another engine, those table rules may not apply.
Best practices for day-to-day operations
Start by removing broad workspace admin roles from daily user accounts. Give each team member a role that matches their exact job tasks. Separate the accounts that build pipelines from the accounts that read reports. This split limits damage if a user key leaks.
Review your active SQL and Spark sessions every week. Look for unused roles and remove them right away. Set up alerts for failed login attempts and large data exports. For sensitive tables, check that masking rewrites matched fields like emails and card numbers in results.
Finally, require peer approval before anyone runs schema changes in production pools. Keep your dev and test pools separate from production data. Clear boundaries help teams move fast while keeping customer data safe.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
How do serverless and dedicated pools differ in permissions?
Dedicated pools store data in managed tables and use standard SQL permissions. Serverless pools query raw files in cloud storage and rely on storage folder roles.
Should developers use shared accounts for data pipelines?
No, shared accounts hide who ran a specific job in your audit logs. Use managed identities for automated jobs and personal directory accounts for human users.
How can we protect sensitive columns during ad-hoc queries?
Apply data masking so the system rewrites emails, phone numbers, and national IDs in results. Pair masking with row-level filters so analysts only see rows for their region.