Forum Discussion
SQL Server MI Fabric Mirroring Security question - TDA
Dears,
I am creating a technical design authority doc (TDA)
One of the sources I am using is a SQL Server Managed Instance
We will do a Fabric Mirroring to SQLMI DB and bring the data into our landing zone (Fabric Raw)
The solution itself creates a datawarehouse and manages the things (the sync)
We will be using a service principal with permissions on SQLMI and Permissions on our Fabric Workspace (as conrtributor) so that the fuincionality can do the sync
Please find the figure below:
The help that I am asking is related with security as I don't know which terms to use to descrive this security
For example:
Security at rest
security in Transit
Like Service-to-Service security
Can someone please help?
Thanks a lot,
Pedro
Hi
At a TDA level, you can describe the security of the SQL Server Managed Instance (SQL MI) to Microsoft Fabric mirroring solution in terms of identity, access control, data protection, and platform-managed security. The integration uses Microsoft Entra ID–based service principal authentication to enable secure service-to-service communication between SQL MI and Fabric, eliminating the need for embedded credentials or SQL authentication. Access is governed through Role-Based Access Control (RBAC) and database-level permissions, following the principle of least privilege, where the service principal is granted only the minimum permissions required to perform mirroring and synchronization activities.
From a data protection perspective, all data transmitted between SQL Managed Instance and Microsoft Fabric is encrypted in transit using TLS 1.2 or higher, ensuring confidentiality and integrity over the network. Data at rest is protected through platform-managed encryption mechanisms, including Transparent Data Encryption (TDE) in SQL MI and Microsoft-managed encryption within Fabric storage. The mirroring capability itself is a platform-managed service, meaning synchronization and data movement are handled internally by Fabric’s managed infrastructure, reducing the need for custom integration components and minimizing the attack surface. If SQL MI is deployed within a virtual network, network boundary protections such as private connectivity and controlled outbound access further strengthen the overall security posture.
Thank you.
3 Replies
Hi Perdo, I can do one better and share the link to the Microsoft fabric security white paper for you.
That way you know your terminology is correct.
https://learn.microsoft.com/en-us/fabric/security/white-paper-landing-pageI don't have enought knowhow to interpretate it and be able to generate something at TDA level
Hi
At a TDA level, you can describe the security of the SQL Server Managed Instance (SQL MI) to Microsoft Fabric mirroring solution in terms of identity, access control, data protection, and platform-managed security. The integration uses Microsoft Entra ID–based service principal authentication to enable secure service-to-service communication between SQL MI and Fabric, eliminating the need for embedded credentials or SQL authentication. Access is governed through Role-Based Access Control (RBAC) and database-level permissions, following the principle of least privilege, where the service principal is granted only the minimum permissions required to perform mirroring and synchronization activities.
From a data protection perspective, all data transmitted between SQL Managed Instance and Microsoft Fabric is encrypted in transit using TLS 1.2 or higher, ensuring confidentiality and integrity over the network. Data at rest is protected through platform-managed encryption mechanisms, including Transparent Data Encryption (TDE) in SQL MI and Microsoft-managed encryption within Fabric storage. The mirroring capability itself is a platform-managed service, meaning synchronization and data movement are handled internally by Fabric’s managed infrastructure, reducing the need for custom integration components and minimizing the attack surface. If SQL MI is deployed within a virtual network, network boundary protections such as private connectivity and controlled outbound access further strengthen the overall security posture.
Thank you.
