Forum Discussion

TK12345's avatar
TK12345
Icon for Resolver II rankResolver II
6 months ago
Solved

Using storedprocedures Fabric WH / Fabric SqlDB with block public internet access

Hi all, 

I have a question regarding using storedprocedures Fabric WH / Fabric SqlDB with block public internet access. At this moment we do not have any extra security for our tenant so we try to expand that a bit. For now we have a pipeline with a PostgreSQL connection that is using a Private Endpoint and VnetGateway. In our current situation we use StoredProcedures to do the logging of all our fabric items, that storedprocedures are settled in the SQLDB (Fabric item). 

In the new situation we have the Block Public Internet Access enabled. While enabled, we use the VM to go to Power BI, and I can extract the PostgreSQL with a copy activity using vnetgateway in a pipeline. Or notebook with ManagedPrivateEndpoint. We also blocked all outbound for that workspace. 

But, the thing is, when blocking outbound access, we can not make a Fabric SQL Database, no worries, we can change that to Fabric Warehouse with storedProcedures. Either way, in my pipeline, I can add a storedprocedure activity, but I do get the error: Error Code: RequestDeniedByInboundPolicy, Message: Request is denied due to inbound communication policy. 

So with Block Public Internet Access enabled it looks like I can not recreate my pipeline with stored procedures. 

Is there any other way that we can use it? 

Thanks in advance


data engineering
environment
lakehouse
notebook
Spark Job Definition
  • deborshi_nag's avatar
    deborshi_nag
    6 months ago

    Hello TK12345 

     

    Stored Procedure activity in Fabric Pipelines works by connecting to a SQL endpoint. Currently, this activity supports both Fabric SQL Database and Fabric Data Warehouse (in addition to Azure SQL/MI). However, the pipeline runtime needs to establish an inbound connection to the SQL endpoint. If Private Link or inbound network restrictions are enabled, the runtime won’t have access, and the connection will fail.

     

    Here are some possible workarounds:

     

    1) Use Azure SQL Database or Azure SQL Managed Instance as your logging target, set up behind your own Private Endpoint. The Stored Procedure activity fully supports these options, and they can be accessed via your VNet Data Gateway or Managed VNet.

     

    2) Consider logging to Lakehouse (Delta) tables instead. You can swap out the stored procedure with a Notebook step (using PySpark or T-SQL) to add log entries to a Delta table in your Lakehouse. Notebooks with Managed Private Endpoints can still connect to your private resources.

     

    3) As another option, you can temporarily allow inbound connections at the workspace level, specifically for Warehouse SQL endpoint calls. Fabric now offers workspace-level networking policies (in preview), which let you set Inbound public access default to Allow while keeping Outbound public access default set to Deny.

     

3 Replies

  • deborshi_nag's avatar
    deborshi_nag
    Icon for Super User rankSuper User
    6 months ago

    Hello TK12345 

     

    Stored Procedure activity in Fabric Pipelines works by connecting to a SQL endpoint. Currently, this activity supports both Fabric SQL Database and Fabric Data Warehouse (in addition to Azure SQL/MI). However, the pipeline runtime needs to establish an inbound connection to the SQL endpoint. If Private Link or inbound network restrictions are enabled, the runtime won’t have access, and the connection will fail.

     

    Here are some possible workarounds:

     

    1) Use Azure SQL Database or Azure SQL Managed Instance as your logging target, set up behind your own Private Endpoint. The Stored Procedure activity fully supports these options, and they can be accessed via your VNet Data Gateway or Managed VNet.

     

    2) Consider logging to Lakehouse (Delta) tables instead. You can swap out the stored procedure with a Notebook step (using PySpark or T-SQL) to add log entries to a Delta table in your Lakehouse. Notebooks with Managed Private Endpoints can still connect to your private resources.

     

    3) As another option, you can temporarily allow inbound connections at the workspace level, specifically for Warehouse SQL endpoint calls. Fabric now offers workspace-level networking policies (in preview), which let you set Inbound public access default to Allow while keeping Outbound public access default set to Deny.

     

    • v-menakakota's avatar
      v-menakakota
      Icon for Community Support rankCommunity Support
      6 months ago

      Hi TK12345 ,

      Thanks for reaching out to the Microsoft fabric community forum. 

       

      I would also take a moment to thank deborshi_nag   , for actively participating in the community forum and for the solutions you’ve been sharing in the community forum. Your contributions make a real difference.

      I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We’re always here to support you .

       

       

      Best Regards, 
      Community Support Team

    • trillionaires's avatar
      trillionaires
      New Member
      6 months ago

      With Block Public Internet Access enabled, Fabric Pipelines can’t call Stored Procedures on Fabric SQL/Warehouse because the runtime needs inbound access.

       

      Workarounds:

       

      1. Use Azure SQL/Managed Instance behind a Private Endpoint for logging.

       

       

      2. Log to Lakehouse (Delta) tables via a Notebook instead of Stored Procedures.

       

       

      3. Temporarily allow inbound access at the workspace level for SQL endpoint calls using workspace-level networking policies.

       

       

       

      Stored Procedure activity requires some form of inbound connectivity—fully blocking it prevents execution.