Fabric Connection to Azure SQL DB Failing Even After Whitelisting Southeast Asia ADF & PowerBI IPs

[BharathKumarS]

Hi everyone,

I am trying to create a connection from Microsoft Fabric to Azure SQL Database using SQL authentication, but connection creation keeps failing with:

Error: "Unable to create connection for the following reason: We could not access the data source. Please make sure you have permission to access the data source and that your credentials are correct."

Setup details:

• Fabric capacity region: Southeast Asia

• Tried both Trial Capacity and Dedicated Capacity

• Azure SQL DB is also in Southeast Asia

• Firewall enabled with DataFactory.SoutheastAsia, 
  ServiceFabric.SoutheastAsia and PowerBI.SoutheastAsia IP range added to firewall rules
• Allow Azure services and resources to access this server = disabled

What I have tried:

• tested with:

  • Allow Azure Services = Enabled (Connection gets created, but i dont want to enable this option)

  • Public Network Access = All Networks

Still unable to create the Fabric connection.

Has anyone tried this before?
Are there any additional Fabric IPs/service tags needed apart from DataFactory and PowerBI service tags?

Any help would be appreciated.

[deborshi_nag · Accepted solution]

Hello @BharathKumarS apologies for misreading that. For PaaS services too, your best bet is to use Managed Private Endpoint on Fabric pointing to your Azure SQL instance. 

[v-ssriganesh]

Hello @BharathKumarS,

We hope you're doing well. Could you please confirm whether your issue has been resolved or if you're still facing challenges? Your update will be valuable to the community and may assist others with similar concerns.

Thank you.

[v-ssriganesh]

Hi @BharathKumarS,

Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to @deborshi_nag & @Lodha_Jaydeep for sharing valuable insights.

Could you please confirm if your query has been resolved by the provided solutions? This would be helpful for other members who may encounter similar issues.

Thank you for being part of the Microsoft Fabric Community.

[Lodha_Jaydeep]

@BharathKumarS, Were you able to connect the same DB into SSMS or in the Azure? Please try to connect same DB with same credentials (Which you have used to create connection...). Please let me know what you found?

[BharathKumarS]

yes, I used SQL User auth and via SSMS I am able to connect to db.
Sql user is also a db_owner.
I am even able to create the connection when I enable "Allow Azure services and resources to access this server"
But i am looking for ways to connect without enabling that option.

[Lodha_Jaydeep · Accepted solution]

You can try below options.

• On-premises data gateway: install the gateway on a VM/server with a fixed outbound public IP, then add only that IP to the Azure SQL firewall.
• VNet data gateway / private endpoint: use private networking so Fabric reaches Azure SQL through a controlled VNet/private endpoint path.
• Azure SQL firewall rule: allow only the required client/gateway public IP, instead of enabling all Azure services.

As @deborshi_nag mentioned you can upvote on the same feature requested. Please consider this as an accepted soltuon if helps or give some kudos.

[BharathKumarS]

Hi @deborshi_nag 
This is a Azure SQL DB. (Not On Prem)
and its not in any Vnet too. 

[deborshi_nag · Accepted solution]

Hello @BharathKumarS apologies for misreading that. For PaaS services too, your best bet is to use Managed Private Endpoint on Fabric pointing to your Azure SQL instance. 

[deborshi_nag]

Hello @BharathKumarS 

Currently, there isn't a specific Microsoft Fabric service tag that enables outbound connectivity to an on-prem SQL server behind a firewall. As a result, using DataFactory and PowerBI service tags won't resolve this issue.

There is already a Fabric Idea submitted regarding this topic. You can find the link below if you'd like to upvote it.

Enable the possibility of having your own public I... - Microsoft Fabric Community

In the meantime, I suggest considering the private link or managed private endpoint option, which would let you create a private connection to your on-prem SQL server behind a firewall.