Forum Discussion

JAnder's avatar
JAnder
Helper II
7 months ago
Solved

Workspace Identity with Azure SQL Databases

I am currently mirroring an Azure SQL Database in a workspace using a Service Principal. There have been a few issues but it mostly works ok. However it was suggested trying a Workspace Identity so w...
Need Help
  • JAnder's avatar
    JAnder
    7 months ago

    Zanqueta Thanks for the reply, appreciate you taking the time to do that.

     

    I have managed to get the mirroring working. Having the Workspace Identity as part of a group, with the group created as a user on the db with relevant permissions

    CREATE USER [Workspace Identity Name] FOR LOGIN [workspace identity Name];
GRANT SELECT, ALTER ANY EXTERNAL MIRROR, VIEW DATABASE PERFORMANCE STATE, VIEW DATABASE SECURITY STATE TO [Workspace Identity Name];

     

    This failed for me initially, I expect there may have been a delay getting it all to work.

    I set up a connection using the workspace identity and assigned that to a report to see if it would refresh and it did. I then retried assigning the connection to a mirror and it worked as well. 

Zanqueta's avatar
Zanqueta
Super User
7 months ago

Hi JAnder,

 

Azure SQL Database currently supports Azure AD users and groups, but does not support Enterprise Applications (Service Principals) directly as logins. When you create a Workspace Identity, Fabric registers an Enterprise Application in Microsoft Entra ID, which is essentially a Service Principal. The error:
This principal type is not supported in Azure SQL Database
is expected because Azure SQL does not allow creating logins for Service Principals in the same way as for users or groups.

Logical Difference

  • Service Principal approach: You can use it for token-based authentication in many Azure services, but Azure SQL Database does not allow direct login creation for Service Principals.
  • Workspace Identity: It is an Enterprise Application, so it falls under the same limitation.

Supported Approach

The recommended way is to use an Entra ID group and assign permissions to that group, then add the Workspace Identity to the group. However, for Azure SQL Database to recognise the group, you must:
  1. Ensure Azure AD authentication is enabled on the SQL Server.
  2. Use CREATE USER [GroupName] FROM EXTERNAL PROVIDER; in the database.
  3. Grant the required permissions to that group.
This works because Azure SQL supports Azure AD groups, not Enterprise Applications directly.

Why Your Attempt Failed

You created the group and added the Workspace Identity, but the mirror still failed because:
  • The Workspace Identity might not be using the group token when connecting.
  • Fabric currently does not support group-based token delegation for Workspace Identity in mirroring scenarios (as of current documentation).

Current Limitation

At this time, Workspace Identity cannot authenticate directly to Azure SQL Database for mirroring because Azure SQL does not support Enterprise Applications as principals. The official guidance still recommends using a Service Principal with a managed secret or Managed Identity (for other services), but Managed Identity is not yet supported for Fabric mirroring.

What You Can Do

 

If this response was helpful in any way, Iā€™d gladly accept a šŸ‘much like the joy of seeing a DAX measure work first time without needing another FILTER.

Please mark it as the correct solution. It helps other community members find their way faster (and saves them from another endless loop šŸŒ€.