Not Able to connect Fabrib database using C# .Net Core API

[v-jdubey]

I am developing RESTful services using a C# .NET Core API. The application connects to a Microsoft Fabric Analytics database using ADO.NET. In my local development environment, the database connection works perfectly.

However, after deploying the same application to Azure App Services, the database connection fails. We are encountering the following error:

Could not login because the authentication failed.

We have verified that the connection string is correct and works locally. This issue appears to be specific to the Azure environment. Possible causes we are considering include:

• Incorrect or missing connection string configuration in Azure App Service settings.
• Authentication method used locally may not be supported or permitted in the Azure environment.
• Network or firewall restrictions preventing Azure App Service from reaching the database.
• Missing environment variables or secrets required for authentication.

We would appreciate any guidance on how to resolve this issue, particularly around configuring secure and compatible authentication for Microsoft Fabric Analytics when hosted on Azure App Services.

ERROR MESSAGE

{
    "Error": "Access token acquired. Expires on: 6/24/2025 10:22:13 PM +00:00"
  },
  {
    "Error": "Exception in GetData: Could not login because the authentication failed."
  }
}

Bellow is my code snippet

public DataTable GetData(string storedProcedureName, SqlParameter[] parameters, string environment)
{
DataTable dt = new DataTable();
dt.Columns.Add("Error", typeof(string));
try
{
string sqlServer = "xxxx";
string database = "xxxx";
var connectionString = $"Server=tcp:{sqlServer},1433;Database={database};Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;";

// Log environment
dt.Rows.Add($"Environment: {environment}");
dt.Rows.Add($"ConnectionString: {connectionString}");

// Acquire token using DefaultAzureCredential (can fallback to Azure CLI when local)
var credential = new DefaultAzureCredential();
var token = credential.GetToken(new TokenRequestContext(new[] { "https://database.windows.net/.default" }));

dt.Rows.Add($"Access token: {token.Token}");
dt.Rows.Add($"Access token acquired. Expires on: {token.ExpiresOn}");

using (SqlConnection connection = new SqlConnection(connectionString))
{
connection.AccessToken = token.Token;
connection.Open();

using (SqlCommand command = new SqlCommand(storedProcedureName, connection))
{
command.CommandTimeout = 10000;
command.CommandType = CommandType.StoredProcedure;

if (parameters != null)
{
command.Parameters.AddRange(parameters);
}

using (SqlDataAdapter adapter = new SqlDataAdapter(command))
{
DataSet dataSet = new DataSet();
adapter.Fill(dataSet);

if (dataSet.Tables.Count > 0)
{
return dataSet.Tables[0];
}
else
{
dt.Rows.Add("Stored procedure executed but returned no data.");
return dt;
}
}
}
}
}
catch (Exception ex)
{
dt.Rows.Add($"Exception in GetData: {ex.Message}");

if (ex.InnerException != null)
{
dt.Rows.Add($"Inner Exception: {ex.InnerException.Message}");
}

return dt;
}
}

[v-tsaipranay]

Hi @v-jdubey ,

Thank you for reaching out to the Microsoft Fabric Community forum.

Based on your explanation, it appears the issue arises when your .NET Core API, hosted on Azure App Service, attempts to connect to a Microsoft Fabric Warehouse SQL endpoint using ManagedIdentityCredential. While it works locally, it fails in Azure with the error “Could not login because the authentication failed”despite successfully acquiring an access token.This typically indicates a permissions or identity scope issue. Below are recommended steps to address it:

In the Azure portal, navigate to your App Service → Identity → System assigned → Enable. This will generate an Azure AD identity for the app. Note the Object ID for permission assignment. Please refer the following documentation for your reference:Managed Identities - Azure App Service | Microsoft Learn

In your Fabric workspace, navigate to the target Warehouse → More options (⋯) → Permissions. Add the App Service’s Managed Identity with Admin or Contributor role. Also ensure the identity has workspace-level permissions.

 Permission model - Microsoft Fabric | Microsoft Learn

Use the correct Fabric SQL endpoint (typically ends with .sql.azuresynapse.net). Do not include username/password in the connection string when using Azure AD tokens.

Warehouse Connectivity - Microsoft Fabric | Microsoft Learn

Your use of ManagedIdentityCredential is appropriate for Azure-hosted environments. Just ensure this logic is environment-specific and that your local development uses DefaultAzureCredential only.

Please refer the following link: ManagedIdentityCredential Class (Azure.Identity) - Azure for .NET Developers | Microsoft Learn

By following these steps and ensuring that the Managed Identity has appropriate access to both the workspace and warehouse, you should be able to resolve the login authentication issue.

Hope this helps. Please reach out for further assistance.

If this post helps, then please consider to Accept as the solution to help the other members find it more quickly and a kudos would be appreciated.

Thank you.

[NiharP]

@lbendlin, we're connecting to Microsoft Fabric SQL Analytics endpoint for a warehouse.

Acquiring the bearer token with the below code:
var credential = new ManagedIdentityCredential();
var token = credential.GetToken(new TokenRequestContext(new[] { "https://database.windows.net/.default" }));

Using it with the connection as below:
using (SqlConnection connection = new SqlConnection(connectionString))
{
connection.AccessToken = token.Token;
connection.Open();

}

[lbendlin]

Please be more specific. Are you connecting to a Fabric SQL database or to a SQL Endpoint for a warehouse or lakehouse? How are you acquiring the bearer token?