How to Add a Microsoft Entra Security Group to a Database Role in Microsoft Fabric Warehouse?

Hi Ramkishor 

In a Microsoft Fabric Warehouse, you typically:

1. **Create a database user for the Microsoft Entra ID security group**
2. **Add that user to the database role**

### Syntax

```sql
CREATE USER [My Entra Security Group] FROM EXTERNAL PROVIDER;
ALTER ROLE [MyDatabaseRole] ADD MEMBER [My Entra Security Group];
```

### Example

```sql
CREATE USER [FABRIC-Finance-Readers] FROM EXTERNAL PROVIDER;
ALTER ROLE [db_datareader] ADD MEMBER [FABRIC-Finance-Readers];
```

### Notes
- The principal must be a **Microsoft Entra ID security group**.
- The name in brackets should match the Entra group name.
- If the group/user does not already exist in the warehouse, you need to create it first before adding it to the role.

### Microsoft references
- `ALTER ROLE` syntax: https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-role-transact-sql?view=sql-server-ver17
- `CREATE USER ... FROM EXTERNAL PROVIDER`: https://learn.microsoft.com/en-us/sql/t-sql/statements/create-user-transact-sql?view=sql-server-ver17
- Fabric warehouse permissions overview: https://learn.microsoft.com/en-us/fabric/data-warehouse/share-warehouse-manage-permissions

Hi Ramkishor ,

Since a security group doesn't have an email/UPN, you reference it by its Entra ID display name instead. The approach is the same one used for Azure SQL / Synapse: first create a database user mapped to the group, then add that user as a member of your role.

Step 1: Create a database user for the group

CREATE USER [Your Security Group Display Name] FROM EXTERNAL PROVIDER;

Use the exact display name of the group as it appears in Entra ID, in square brackets - not an email/UPN, since groups don't have one. If you use the wrong name or an alias, you'll get an error like:

Msg 33130 ... Principal 'xxx' could not be found or this principal type is not supported.

Step 2: Add the group user as a member of your role

ALTER ROLE test
ADD MEMBER [Your Security Group Display Name];

That's it - no need to add individual users anymore. Every user in that Entra security group now inherits whatever GRANT/REVOKE permissions you've set on "test".

Full example:

CREATE ROLE test;

CREATE USER [Sales Data Readers] FROM EXTERNAL PROVIDER;

ALTER ROLE test
ADD MEMBER [Sales Data Readers];

GRANT SELECT
ON dbo.[********]
TO test;

Note please:

Permissions to resolve the group - to use CREATE USER with FROM EXTERNAL PROVIDER, you must be a member of the Directory Readers role in Microsoft Entra. If the lookup still fails, it's usually because resolution actually happens via the workspace's managed identity, not your own permissions. The Warehouse needs its own Managed Identity enabled, granted the Directory Readers role in Entra ID, plus Microsoft Graph Directory.Read.All application permission with admin consent.

Name uniqueness - if two groups happen to share the same display name, CREATE USER [name] FROM EXTERNAL PROVIDER becomes ambiguous. In that case you'd need to resolve by object ID instead of display name (via Graph/PowerShell to confirm the correct object first).

Nested groups - Fabric/Entra does support nested group membership resolution for auth, but it's worth testing with a real user in the group after setup rather than assuming it works automatically for deeply nested groups.
You don't have to pre-create the user manually if you're managing roles through the Fabric portal's "Manage SQL Security" UI - the portal automatically creates users when needed. But since you're scripting this with T-SQL, doing the explicit CREATE USER ... FROM EXTERNAL PROVIDER step yourself is the correct approach.