Forum Discussion

SwedishJAS's avatar
SwedishJAS
Regular Visitor
1 year ago
Solved

Clarification on Access Control for SQL Endpoints in Fabric Workspaces

Hi everyone, I’m trying to better understand the current access control model for SQL endpoints in Microsoft Fabric. Based on my experience, it seems that: Any user with a Viewer role in a workspa...
admin
security
workspaces
SwedishJAS's avatar
SwedishJAS
Regular Visitor
1 year ago

 

Hi AndyDDC,

Thank you for your detailed explanation and walkthrough! Your solution was actually my first approach since it really makes sense that users can be added to the SQL Endpoint without being part of the workspace permissions.

However, I ran into the following issue when attempting to connect to the SQL Endpoint using SQL Server Management Studio (SSMS):

Error message:

 

sql
TITLE: Connect to Server
------------------------------ Cannot connect to xnb6epbstkvehph4bskzardro4-gzozj7rlzjyunl3uzqzmtneqwm.datawarehouse.fabric.microsoft.com. ------------------------------ ADDITIONAL INFORMATION: Login failed for user '<token-identified principal>'. (Microsoft SQL Server, Error: 18456) For help, click: https://docs.microsoft.com/sql/relational-databases/errors-events/mssqlserver-18456-database-engine-error
 

After investigating further, I found that the only way to resolve this issue was to add the user to the workspace. To double-check, I reviewed the documentation, YouTube videos, and discussions, and these sources confirmed that adding the user to the workspace is required.

My question to you is: Have you verified that it actually works for you in practice to add users to the SQL Endpoint without including them in the workspace? Or did you, like me, make the assumption that it should work based on the design?

Thanks again for sharing your solution! It would be very interesting to hear if you've successfully managed to get this working without workspace permissions.


AndyDDC's avatar
AndyDDC
Icon for Most Valuable Professional rankMost Valuable Professional
1 year ago

Can you point me towards documentation/videos that state that users need to be added to Workspaces?  I have confirmed that adding users to a workspace is not required, I have tested this myself with both SSMS and browsing the OneLake catalog.

 

What version of SSMS are you using?

  • SwedishJAS's avatar
    SwedishJAS
    Regular Visitor
    1 year ago
    A big thank you to both of you—I’ll give it another shot next time. This time, I worked around the issue by creating a dedicated workspace for a SQL endpoint. I’m glad that a dedicated Fabric capacity is no longer required. 🙂

    I trust your explanations, and that does seem like the most reasonable scenario. I couldn’t find the description I initially interpreted as confirming the worse situation—it might have been incorrect or outdated.

    Thanks again for your quick and detailed responses!
    /Jens