Private Data Storage

Sign in to your Azure Portal as an administrator.

Go to the Applications > App Registration page.

Select New Registration.

In the Name field, enter a name for your app. For example, the name of your AAC workspace.

In the Redirect URI dropdown, select Web and then enter the Callback URL. Follow this template: https://{platformEnvironment}/workspace/${workspaceName}/sso/azureCallback. Example:

https://us1.alteryx.com/workspace/YOUR-WORKSPACE/sso/azureCallback

Select Register.

Note and copy your Application (Client) ID and Directory (Tenant) ID. You will use these later in Step 2c.

Go to your application’s API Permissions page.

Select Add a permission and then select Microsoft Graph.

Select Delegated permissions.

Check the box next to email, profile, user.read, openid, and offline_access.

Select Add permissions.

Again select Add a permission and then select Azure Storage.

Select Delegated permissions.

Check the box next to user_impersontation.

Select Add permissions.

Go to your application's Certificates & secrets page. and then select the Client secrets tab.

Select New client secret.

In the Description field, enter a description of your app. For example, the name of your AAC workspace.

Set Expires to an appropriate value and then select Save.

Note and copy the secret Value. You will use this later in Step 2b.

Go to the Federated Credentials tab. and then select Add credential.

From the Federated credential scenario dropdown, select Other issuer.

In the Issuer field, enter https://accounts.google.com.

In the Subject Identifier field, enter 1 of these options based on your AAC enironment location:

1. US1: 115363405640771453608

2. EU1: 103517307997047250975

3. AU1: 106202870273509843893

In the Name field, enter AccessFromAlteryx.

Select Save.

Go to the Key Vaults page on your Azure Portal.

Select Create.

Under the Basics tab, select appropriate values for Subscription and Resource Group per your organization's requirements.

In the Key valut name field, enter a name for your key vault. For example, the name of your AAC workspace.

Select Next to go to the Access configurations tab.

Set the Permissions model to Vault access policy and then select Create under Access policies. A Create an access policy dialog appears.

In the access policy dialog under the Permissions tab, check all Secret permissions boxes.

Select Next to go to the Principal tab.

On the Principals tab, search for the app you created previously in Step 2a. Once you've located the app, select it and then select Next.

On the next Application tab, no action is needed. Select Next to continue.

On the Review + create tab, select Create. This action closes the access policy dialog and creates a new Access Policy for your application.

Return to the Create key vault dialog for your app. Select Review + Create and then select Create. This action initiates the deployment of your key vault.

Once the deployment completes, under Next Steps, select Go to resource. This action takes you to the Key Vault Overview page.

On the Key Vault Overview page, go to Secrets and then select Generate/Import to assign a secret.

In the Name field, enter a name for your secret. For example, the name of your AAC workspace.

In the Secret field, enter your app's secret Value you copied previously in Step 2a.

Select Create and then copy the Key Vault Secret Name. You will use this later in Step 2c.

Go to Overview and then copy the Vault URI. You will use this later in Step 2c.

Return to your AAC workspace.

Go to Profile menu > Workspace Admin > Private Data Handling > Cloud Authorization and then select Microsoft Azure.

Enter the Azure AD Tenant ID you copied in Step 2a after creating an app on the Azure Portal.

Enter the Azure AD Client ID you copied in Step 2a after creating an app on the Azure Portal.

Enter the Azure AD Client Secret Name you copied in Step 2b after creating a key vault on the Azure Portal.

Enter the Azure Key Vault URL you copied in Step 2b after creating a key vault on the Azure Portal.

Select Save.

Go to the Google Cloud Console and then sign in with your Google account.

If you have an existing project, select the project where you want to create the Service Account Key. If you don't have a project, create a project now.

Note and copy the project name. You will use this later in Step 2.

On the left pane, select IAM & Admin and then select Service Accounts.

Select Create Service Account.

Enter Service Account Details:

In the Keys section, select Create Key and then select the JSON key type.

Select the JSON key type and then select Create. The private key automatically generates and downloads to your computer. You will use this key later in Step 2.

Sign in to your AAC workspace.

Go to Profile menu > Account Management > Private Data Handling > Storage and then select Google Cloud Storage.

Under Service Account Key, copy and paste the entire JSON key you created previously in Step 2.

Under Default Bucket, enter the project name you copied previously in Step 2.

[Optional] Enter a Project ID. Note that this overrides the project ID from the service account key.

Select Save to provision your AAC workspace with Google Cloud Storage as Private Data Storage.