Forum Discussion
InvalidRequest when adding "Private Link Service" as a "Managed Private Endpoint"
I get a simple error saying "InvalidRequest" when i try to add my Private Link Service as a Managed Private Endpoint in the Workspace Setttings Network Security page. I can add others fine like a PE for my Azure SQL server. It just seems to be an issue with "Private Link Service" specifically. Is this possibly a bug with adding PLS as a Managed Private Endpoint?
This is extremely frustrating. Here is the support response:
Hello Josh,
I hope you are having an amazing day.
We have shared the issue with all collected details in our SME channel. They responded that currently, private endpoints targeting Private Link Service are not supported. Additionally, we do not support creating managed private endpoints with FQDNs at this time and there is no ETA. The product team will add this limitation to public documents once they have an ETA.
I am pleased to inform you that there is no issue from your side; however, the actual feature is not supported currently. We have already created an incident with the product team, and they are working on updating the feature.
I apologize for any inconvenience this may cause. Rest assured, you will be able to access this feature soon.
Please feel free to reach out to me if you have any questions, concerns, or additional information that you would like to share. I'll be more than happy to assist you.
Thank you for your understanding.
29 Replies
Hi Digidank,
What type of capacity are you worked? Trial or fabric capacity? Which region are you host to configure the private link service? Please share some more detail information about these.
BTW, the document mentioned some of regions not support PLS feature, perhaps you can take a look at the following link to know more about these:
Overview of managed private endpoints for Microsoft Fabric - Microsoft Fabric | Microsoft Learn
Regards,
Xiaoxin Sheng
I read that doc before and according to it I thought it should work. I'm in US East2 and tried F2 and F4 capacity. The PLS and capacity are both in US East2.
According to this it says Private Link Service is an option for Managed Private Endpoint https://learn.microsoft.com/en-us/fabric/security/security-managed-private-endpoints-create#supported-data-sources.
I can create managed pe's for Azure SQL fine. Appears to just be a Private Link Service that gets the error.
I have a PLS configured to a load balancer that routes sql traffic to an onprem sql server through a VM. The PLS works fine in a VM and onprem servers. If this won't work do you suggest anything else I could try to access my onprem sql server in spark? I don't want to use a Pipeline. I already have that working fine with the onprem data gateway. I'm wanting to do this in Spark specifically. Creating a PE to fabric is not an option at the moment due to some of the limitations it defined here: https://learn.microsoft.com/en-us/fabric/security/security-private-links-overview#other-considerations-and-limitations.HI Digidank,
I check the document of PLS limitations part and find it include one scenario for fabric users:
For Fabric users: On-premises data gateways aren't supported and fail to register when Private Link is enabled. To run the gateway configurator successfully, Private Link must be disabled. Learn more about this scenario. VNet data gateways will work. For more information, see these considerations.
If that is the case, it means the private link service will conflict with on-premises data gateway usages.(based on your description, you already use this on-premise data gateway mapping an on premise source to the azure SQL)
Regards,
Xiaoxin Sheng
Yeah, I read that in the documentation as well. That was why i was saying we cannot use it.
However, I think there is some confusion between "Private Link" for Fabric and using a "Private Link Service" as a datasource for a "Managed Private Endpoint".
I am not trying to enable "Private Link" for INBOUND access to Fabric privately. That is documented here: https://learn.microsoft.com/en-us/fabric/security/security-private-links-overview and what the tenant admin setting for "Private Link" is for. I am referring to OUTBOUND using the Azure resource called "Private Link Service" as a datasource for a "Managed Private Endpoint" documented here: https://learn.microsoft.com/en-us/fabric/security/security-managed-private-endpoints-create.
I can create "Managed Private Endpoint" perfectly fine for Azure SQL and already am using it in a spark job. It works great. It is solely adding the specific azure resource called "Private Link Service". "Private Link Service" is not the same thing as "Private Link" in Fabric settings as they are 2 completely different things.I'm having the exact same problem.
I've created a PLS in region Sweden, but get InvalidRequest when trying to add it as Managed Private endpoint in Fabric. I've tried both with my Trial capacity in region North Europe, and with a WS connected to a F2 capacity in region Sweden.
Also tried changing the Visibility on the PLS to "Anyone with your alias". But still same error no matter.
Sounds like we are both struggling with the same thing. My ongoing support ticket with PowerBI/Fabric support keeps saying that "Private Link" in admin tenant settings needs to be enabled, which is for enabling private access into Fabric. But they also keep referring me to documentation about creating a PL into Fabric, which is not what I am trying to do. So, I really do not think that is the issue. Seems like support cannot differentiate PL for Fabric vs a PLS.
Are you able to try enabling "Private Link" in your Tenant Admin settings? Our PowerBI admins will not enable it because some of the limitations defined here: https://learn.microsoft.com/en-us/fabric/security/security-private-links-overview#other-considerations-and-limitationsI am going to try on my personal Azure account later today when i get a chance. I just want to rule that out.
I've tried now to enable Private Link under Tenant Admin settings, waited 30 min, but still get the same error.
I have the same issue. When entering the details in Fabric->Workspace settings->Network Security it passes all input validation. But when I click create, I get "InvalidRequest". I know the target resource is working because I can create a private link from Azure and that works just fine - the request is sent and can be approved just fine. But that doesn't help me connect Fabric to the managed private endpoint.
Are you also trying to create a PE linked to a "Private Link Service", or what backend service type are you trying to connect to?
Sorry for the delay. Yea, the resource type is an Azure "Private Link Service" that I'm trying to connect to with Fabric's private endpoint.
