Forum Discussion
connect to Azure resources from a User Data Function
Hi mehr_sa ,
Yes, you can connect to Azure resources like Azure SQL Database and Azure Storage from a Fabric User Data Function (UDF).
Inside your UDF, you can use Managed Identity or Service Principal authentication, similar to what you do in your standalone Python script. Here’s the approach:
Enable Managed Identity for the Fabric workspace (if available in your tenant).
Grant appropriate permissions to that identity — for example:
db_datareader / db_datawriter roles on Azure SQL.
Storage Blob Data Contributor role on the storage account.
In your Python UDF, use libraries like azure-identity and azure-storage-blob or pyodbc with Azure AD authentication to connect.
Use DefaultAzureCredential() from azure.identity — it will automatically pick up the Managed Identity when running inside Fabric.
This way, you don’t have to store any credentials in code, and authentication is handled securely by Azure.
Example (conceptual):
from azure.identity import DefaultAzureCredential
from azure.storage.blob import BlobServiceClientcredential = DefaultAzureCredential()
blob_service_client = BlobServiceClient(account_url="https://<storage_account>.blob.core.windows.net", credential=credential)For Azure SQL:
import pyodbc
token = credential.get_token("https://database.windows.net/.default")
conn = pyodbc.connect("Driver={ODBC Driver 18 for SQL Server};Server=tcp:<server>.database.windows.net;Database=<db>;Encrypt=yes;TrustServerCertificate=no;", attrs_before={1256: token.token})That’s the recommended way to connect securely from a Fabric UDF.
Best regards,
Gopi Krishna
Hi mehr_sa,
Thank you Ugk161610 for your answer and helpful explanation.
Alongside the previously mentioned points, there are some Fabric-specific considerations when connecting to Azure SQL and Azure Storage from a User Data Function. When your Python script runs inside a User Data Function, it operates within the Fabric runtime, not on your local machine. Therefore, connection details like server names, database names, or storage account names should be stored securely in Fabric, such as in the Workspace Variable Library, rather than on your computer. This approach prevents hard-coding values and simplifies management across different environments.
Ensure the identity used by the function has the necessary permissions in Azure. If using a managed identity or service principal, it needs to be added to Azure SQL as an Entra user with the appropriate database roles, and the SQL server firewall or network settings must allow access from Fabric. For Azure Storage, the same identity should have a suitable data access role, like Storage Blob Data Contributor, and the storage networking should permit Fabric to access the account.
Lastly, User Data Functions are intended for short and efficient tasks. If your ETL script is lengthy, consider dividing it into smaller segments or handling extensive processing in a Fabric pipeline or notebook, with the UDF managing only the necessary function call operations.
Thank you.