Forum Discussion
Fabric - Mirroring SQLServer MI - Permissions
You need to set up the VNET Data Gateway in Azure, rather than on Windows. This gateway is an Azure resource that should be deployed within the same Virtual Network as your SQL Managed Instance. Its function is strictly for connectivity, so the service principal doesn’t require any permissions beyond those already assigned in Fabric and SQL MI.
Helpful Document: Microsoft Fabric Mirrored Databases From Azure SQL Managed Instance - Microsoft Fabric | Microsoft Learn
I hope this clarifies the situation. If I’ve misunderstood any part of your situation, please let us know.
thanks for your reply, I don't see anyware stating that workspace identity is allowed, where did you saw it? can you please send me the link?
About the permissions ? see that one : CONTROL DATABASE but seems additional ones are required, no? I mean in the SQL Server MI instance
Community SupportWorkspace identity isn't supported for SQL MI mirroring in Fabric only service principals are allowed, which is why workspace identity isn't mentioned in the documentation.
Additionally, db datareader permission alone isn't sufficient. Since mirroring uses CDC behind the scenes, the service principal needs at least the following permission
GRANT CONTROL ON DATABASE:[YourDatabaseName] TO [your-service-principal]This permission enables the necessary CDC and replication operations for mirroring. Typically, CONTROL DATABASE is enough, and it's best to grant this only on the specific database being mirrored.
Both F4 and F16 capacities are compatible for mirroring. You can use the same service principal in both.
Let me know if you need any further clarification.
Thank you, I will do Change feed, I suppose that when you say CDC, its because the change feed uses behind the scenes some CDC?
What about the permissions for the VNET gateway ? shall I use as well the same service prinicipal? and which permissions do I need to provide in the VNET gateway to this user for both, SQLMI and Fabric?
- V-yubandi-msft
Yes, that's correct the change feed operates on top of CDC in the background. For the VNET gateway, you don't need to provide any special permissions like you would for SQL MI or Fabric; it's mainly used for connectivity.
You can use the same service principal, and there aren't any specific roles to assign on the gateway side. Just make sure the gateway is running and can connect to SQL MI, and your Fabric connection uses the same service principal. Permissions are only required at the workspace level and on the SQL MI database.
Hope this clarifies things.
And where do I configure the VNET Gateway? is it in azure that I need to create this item? or is it a windows compnent?