Forum Discussion
Service Principle query endpoint - Failed to create or update SQL user from external provider.
We have created Service Principal that connects to SQL Endpoint (Lakehouse) and queries data for various reports. Service is running via Python using ClientSecretCredential to get token. And this process runs smoothly for year at least. This night it started to fail with - "timeout".
But when investigating, I came to conclusion that issue is elsewhere - Failed to create or update SQL user from external provider.
What I have done:
1-Renewed Service Principle to extend expiration date
2-Created completely new Service Principle, assigned same role, access rights
3-Removed existing Service Principles, and added back again same ones.
4-Tried to sync back and forth Lakehouse.
5 - created new Capacity, assigned Workspace to it to force full security sync.
Still same SQL error and in SQL endpoint still Failed to create or update SQL user from external provider.
Same Service Principle can access and queries other Lakehouses in other workspaces, also it can query different Lakehouse in SAME workspace where main Lakehouse is throwing error. So Service Principle can access, environments, Lakehouses except this one!
No issues when accessing with SQL client (like dbeaver, ssms)
Is there a solution for this?
So PY runs job - >ClientSecretCredential for ServicePrincipal - > sql endpoint lakehouse ->fail
Issue resolved "by itself" after 24hours, so my guess is that there were global issues (also that was reported for North Europe on particular day)
3 Replies
- tayloramy
Super User
Hi RaivisMezis​,
How are you granting access? Is it through SQL granular permissions or OneLake Security?
I would recommend using OneLake Security and setting your SQL endpoint into user identity access mode.If you are using SQL granular permissions, have you tried dropping the user entirely and re-creating it?
- RaivisMezisFrequent Visitor
Service Principle is created via Azure Entra, added to Security group and then this Security groups is added in PowerBi Admin portal to allow API functionality.
Then also thsi same Service Principal is added as Admin in Workspace where relevant Lakehouse exists. This is done across all our Workspaces but fails only one specific Lakehouse in one Workspace.
- RaivisMezisFrequent Visitor
Issue resolved "by itself" after 24hours, so my guess is that there were global issues (also that was reported for North Europe on particular day)