Cannot connect to Fabric Lakehouse SQL endpoint from Azure Function App (MSI) — works locally

Hi aniruddhabh ,

This is a classic identity mapping issue specific to non-interactive principals (Service Principals / MSI).

The Root Cause: The error 18456 with "Authentication was successful" is the smoking gun. It means Entra ID (AAD) validated the MSI token successfully, but the SQL Engine inside Fabric rejected the login.

• Why it works locally: DefaultAzureCredential falls back to your personal user credentials (e.g., from VS Code or Azure CLI). Since you are a User in the workspace, the SQL engine maps you automatically.

• Why it fails in Azure: Even though the MSI is a Workspace Contributor, Fabric SQL Endpoints (unlike Azure SQL DB) sometimes do not automatically map Service Principals/MSIs to a database user context effectively, or there is a propagation delay.

The Fix: You need to explicitly create the MSI as a user inside the SQL Endpoint using T-SQL.

1. Open SSMS or Azure Data Studio.

2. Connect to the Fabric SQL Endpoint using your working Entra ID user account.

3. Run the following commands on the Lakehouse/Warehouse database:

-- Ensure you type the exact name of the Function App MSI
CREATE USER [Your-Function-App-Name] FROM EXTERNAL PROVIDER;

-- Grant permissions (read or owner depending on need)
ALTER ROLE [db_datareader] ADD MEMBER [Your-Function-App-Name];
ALTER ROLE [db_datawriter] ADD MEMBER [Your-Function-App-Name];

Once the MSI exists explicitly as a database user, the "Database not found" error (which is a generic mask for "Access Denied") will disappear.

Let us know if that resolves the handshake!

If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.
This response was assisted by AI for translation and formatting purposes.