What controls when Synapse SQL (COPY INTO) uses SAS token?

[PanuO]

I am using this simple Notebook code to write data into Fabric Warehouse:

import com.microsoft.spark.fabric
from pyspark.sql.types import StructType, StructField, StringType, IntegerType

df = spark.createDataFrame([{
    "id": 1,
}], StructType([
    StructField("id", IntegerType(), True)
]))
df.write.mode("overwrite").synapsesql("SampleWarehouse.dbo.sampletbl")

If I run this code in my own tenant everything works perfectly. Now if I run this exactly same code in another tenant, I will receive this error:

2025-05-22 10:21:30,053 INFO FabricTDSSQLUtility$ [Thread-61]: SQL query to execute - COPY INTO [Sample].[dbo].[sampletbl]
FROM 'abfss://(guid)@i-api.onelake.fabric.microsoft.com/_system/artifacts/(guid)/(guid)/user/trusted-service-user/sampletbl1984837a384855/*.parquet'
WITH(
   FILE_TYPE = 'PARQUET',
   CREDENTIAL = (
       IDENTITY='Shared Access Signature',
       SECRET='?tid=(SAS TOKEN?)&st=2025-05-22T10:03:48Z&se=2025-06-05T10:33:48Z'))
2025-05-22 10:21:30,123 WARN FabricTDSSQLUtility$ [Thread-61]: Un-supported SQL error code 13832 for retry query execution.
2025-05-22 10:21:30,123 INFO FabricTDSSQLUtility$ [Thread-61]: Won't attempt any more SQL query execution.
2025-05-22 10:21:30,123 INFO FabricTDSSQLUtility$ [Thread-61]: Skipping an attempt to close TDS (JDBC) connection that belongs to an active transaction.
2025-05-22 10:21:30,123 ERROR FabricSparkTDSSQLCommitHandler$ [Thread-61]: Failed to commit to the data warehouse. Client Connection ID - (guid)
2025-05-22 10:21:30,123 ERROR FabricSparkTDSSQLCommitHandler$ [Thread-61]: Copying data into warehouse failed. Issuing a rollback.
2025-05-22 10:21:30,126 INFO FabricTDSTelemetryRegister [Thread-61]: Marked register as closed.

In both tenants I have following settings:

Warehouse is in same workspace as the notebook is in both tenants.

Synapse SQL uses COPY INTO behind the scene and it seems to be not working with SAS token. How can I control which login method is used for that command?
 

[v-vpabbu]

Hi @PanuO,

Thank you for reaching out to Microsoft Fabric Community Forum.

The issue isn't with the SAS token settings — those are preview features and mostly related to future support for user-delegated SAS tokens, which do not currently control the behavior of COPY INTO in Microsoft Fabric.

Please check the following Tenant Settings under Admin Portal > Tenant Settings:

• Allow workspace managed identity to access OneLake
• Allow trusted workspace access to OneLake

If these are disabled, Fabric cannot use MSI

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

Regards,
Vinay Pabbu

[PanuO]

Ok, thank you for pointing out the SAS-token limit.

I think there are no setting for "Allow trusted workspace access to OneLake" and "Allow workspace managed identity to access OneLake" in Fabric anymore?

[v-vpabbu]

Hi @PanuO,

Thanks for pointing that out. Earlier advice was based on legacy configuration options that have since been deprecated. In the current Fabric model, access between the workspace and OneLake is managed automatically by the platform, and manual configuration of these trust settings is no longer available.

The issue is likely due to either a trust issue between the workspace and OneLake, or a platform-level constraint preventing MSI usage.

I recommended, raising a Microsoft support ticket to investigate and resolve the issue.

https://learn.microsoft.com/en-us/power-bi/support/create-support-ticket 

Regards,

Vinay Pabbu

[v-vpabbu]

Hi @PanuO,

As we haven't heard back from you, I hope you have raised a support ticket. At this time we are closing this thread. If you have any further issues, please start a new thread in the community forum, and we are here to assist you. Thankyou for your understanding and continuous support.

Thank you for being part of the Microsoft Fabric Community.

Regards,

Vinay Pabbu

[PanuO]

I made a ticket and lets see what we can come up on this. I would like to update the resolution here if it something that others can apply.

[v-vpabbu]

Hi @PanuO,

Thanks for the response As we haven't heard back from you, we are closing this thread for now. If you have any further issues, please start a new thread in the community forum, and we are here to assist you.

Thank you for being part of the Microsoft Fabric Community.

Regards,

Vinay Pabbu

[PanuO]

The reason was this error was that workspace was using Private Links.

[v-vpabbu · Accepted solution]

Hi @PanuO,

Thanks for the update — that makes perfect sense. Private Links often restrict the required access path.

I suggest you to accept this post as the solution — it will help other community members facing similar problems to find the answer faster.

Regards,

Vinay Pabbu