Workspace Identity with Azure SQL Databases

[JAnder]

I am currently mirroring an Azure SQL Database in a workspace using a Service Principal. There have been a few issues but it mostly works ok. However it was suggested trying a Workspace Identity so we dont need to manage the Service Principal secret.

So I have setup the Workspace Identity, it provided a name and it created an Enterprise Application (principal) in Entra. So according to this document

 https://learn.microsoft.com/en-gb/fabric/mirroring/azure-sql-database-tutorial#use-a-login-and-mappe...

I should go to the database and create a login and a user

CREATE LOGIN [Workspace Identity Name] FROM EXTERNAL PROVIDER;

CREATE USER [Workspace Identity Name] FOR LOGIN [workspace identity Name];
GRANT SELECT, ALTER ANY EXTERNAL MIRROR, VIEW DATABASE PERFORMANCE STATE, VIEW DATABASE SECURITY STATE TO [Workspace Identity Name];

This should provide the Workspace Identity access to handle mirroring. Very similar to how it was previously set up with a Service Principal.

However I now get the error 

This principal type is not supported in Azure SQL Database

I also tried setting it up with the command

CREATE USER [<Name>] FROM EXTERNAL PROVIDER
WITH OBJECT_ID = 'XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX';

and this also fails. 

So I tried creating a group in Entra. Adding the Workspace Identity Service Principal into that group and then applying the permissions to the group. There was no error when applying permissions but the mirror does not work with an error indication it does not have permission.

Can anyone clarify how to set up the Workspace Identity with Azure SQL Server? Is there a logical reason why its different to setting up other Service Principals?

[JAnder · Accepted solution]

@Zanqueta Thanks for the reply, appreciate you taking the time to do that.

I have managed to get the mirroring working. Having the Workspace Identity as part of a group, with the group created as a user on the db with relevant permissions

CREATE USER [Workspace Identity Name] FOR LOGIN [workspace identity Name];
GRANT SELECT, ALTER ANY EXTERNAL MIRROR, VIEW DATABASE PERFORMANCE STATE, VIEW DATABASE SECURITY STATE TO [Workspace Identity Name];

This failed for me initially, I expect there may have been a delay getting it all to work.

I set up a connection using the workspace identity and assigned that to a report to see if it would refresh and it did. I then retried assigning the connection to a mirror and it worked as well. 

[Zanqueta]

Hi @JAnder , thank you for sharing this information. Please consider marking the answer as the accepted solution so that other community members can easily follow it.

[Zanqueta]

Hi @JAnder,

Azure SQL Database currently supports Azure AD users and groups, but does not support Enterprise Applications (Service Principals) directly as logins. When you create a Workspace Identity, Fabric registers an Enterprise Application in Microsoft Entra ID, which is essentially a Service Principal. The error:

This principal type is not supported in Azure SQL Database

is expected because Azure SQL does not allow creating logins for Service Principals in the same way as for users or groups.

---

Logical Difference

• Service Principal approach: You can use it for token-based authentication in many Azure services, but Azure SQL Database does not allow direct login creation for Service Principals.
• Workspace Identity: It is an Enterprise Application, so it falls under the same limitation.

---

Supported Approach

The recommended way is to use an Entra ID group and assign permissions to that group, then add the Workspace Identity to the group. However, for Azure SQL Database to recognise the group, you must:

1. Ensure Azure AD authentication is enabled on the SQL Server.
2. Use CREATE USER [GroupName] FROM EXTERNAL PROVIDER; in the database.
3. Grant the required permissions to that group.

This works because Azure SQL supports Azure AD groups, not Enterprise Applications directly.

---

Why Your Attempt Failed

You created the group and added the Workspace Identity, but the mirror still failed because:

• The Workspace Identity might not be using the group token when connecting.
• Fabric currently does not support group-based token delegation for Workspace Identity in mirroring scenarios (as of current documentation).

---

Current Limitation

At this time, Workspace Identity cannot authenticate directly to Azure SQL Database for mirroring because Azure SQL does not support Enterprise Applications as principals. The official guidance still recommends using a Service Principal with a managed secret or Managed Identity (for other services), but Managed Identity is not yet supported for Fabric mirroring.

---

What You Can Do

• Continue using the Service Principal approach for now.
• Monitor updates to Fabric documentation:
  https://learn.microsoft.com/en-us/fabric/mirroring/azure-sql-database-tutorial
• Consider raising a feature request via Microsoft Ideas for Workspace Identity support in Azure SQL Database.

If this response was helpful in any way, I’d gladly accept a 👍much like the joy of seeing a DAX measure work first time without needing another FILTER.

Please mark it as the correct solution. It helps other community members find their way faster (and saves them from another endless loop 🌀.