Materialized Views in Mirrored Azure Databricks Catalog not working

carlhsg​ The DelegationSAS vs OAuth difference in your storage logs is most likely the whole story. Trusted workspace access only admits Entra-authenticated requests: the Learn page lists organizational account, service principal and workspace identity as the only methods that work with a firewall-enabled storage account, and the mirroring tutorial says Fabric uses the Workspace Identity to traverse the firewall. Your Delta reads use OAuth, so the resource instance rule lets them in. A user delegation SAS is not one of those methods, so the firewall refuses it even though the path, container and roles are the same.

Where the SAS comes from is an inference, not documented: Unity Catalog credential vending on Azure returns exactly this token type (azure_user_delegation_sas), so the MV reads look like they use vended credentials instead of the workspace identity. Neither the Databricks mirroring docs nor the MV announcement mention firewalled storage for MVs, so I could not find a supported setting that makes a SAS pass a resource instance rule.

What you can do today:

1. Open a support ticket with the failing request IDs, the DelegationSAS log lines and one successful OAuth line for a Delta table in the same folder. It looks like a gap in the new MV support, and your logs show it clearly.

2. As a workaround, have the pipeline also write the MV result to a regular Unity Catalog Delta table in the same schema (for example a job task after each pipeline refresh that runs CREATE OR REPLACE TABLE ... AS SELECT * FROM your MV). Regular tables already mirror through OAuth in your setup. The cost is an extra copy and a refresh step.

3. Keep the firewall on. Opening the account just for MVs gives up the protection the resource instance rule gives you.

To check which requests are refused and by whom, run this against the storage diagnostic logs:

StorageBlobLogs
| where TimeGenerated > ago(1d) and Uri has "<your MV folder>"
| summarize Requests = count() by AuthenticationType, StatusCode, StatusText, CallerIpAddress

If every refused row is the SAS type and every OAuth row succeeds, that confirms it for the ticket.

If this solves it, please mark it as the solution.

References:

https://learn.microsoft.com/en-us/fabric/security/security-trusted-workspace-access

https://learn.microsoft.com/en-us/fabric/mirroring/azure-databricks-tutorial