SQL endpoint connectivity following a fabric capacity migration

[jmaillra]

I am getting the following error whenever I use an external tool such as SSMS or power bi to connect to my lakehouse sql endpoint after the capacity migration. Please note that xxxxxxxxxxx is used to mask security info.

Error: Microsoft SQL: A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 0 - An existing connection was forcibly closed by the remote host.) Details: DataSourceKind=SQL DataSourcePath=xxxxxxxxxxxxxxxx.datawarehouse.fabric.microsoft.com;XXXXXXX Message=A connection was successfully established with the server, but then an error occurred during the pre-login handshake. (provider: TCP Provider, error: 0 - An existing connection was forcibly closed by the remote host.) ErrorCode=-2146232060 Number=10054 Class=20 State=0 ConnectionId=xxxxxxxxxxxxxxxxxxxx

[v-sgandrathi]

Hi  @jmaillra,

Thanks for the update, it’s good to hear that your network team is working with Microsoft on this. Please keep us posted on the outcome so others facing similar issues can benefit from your experience.

Thankyou.

[jmaillra]

The network team is working with Microsoft to resolve the issue. Thanks all for your responses.

[v-sgandrathi]

Hi @jmaillra,

Just wanted to follow up and confirm that everything has been going well on this. Please let me know if there’s anything from our end.
Please feel free to reach out Microsoft fabric community forum.

Thank you.

[v-sgandrathi]

Hi @jmaillra,

You’re on the right track, network restrictions and TLS configuration are the two main causes of this error. After a capacity migration, your Lakehouse SQL endpoint might now point to a different internal address, so it’s helpful to check a few Fabric-specific settings. Make sure the SQL endpoint URL matches what’s in your workspace and that you use an up-to-date client, like SSMS version 19 or later. Power BI can also connect directly to a Lakehouse or Warehouse, which can help determine if the issue is with the client or the network.

Ensure outbound TCP 1433 is open and that your firewall or proxy allows Fabric SQL domains, not just IP addresses, since IPs can change after migration. If your organization has SSL or TLS inspection, exclude the Fabric SQL endpoint, as intercepted certificates can cause handshake failures.

Verify that TLS 1.2 is enabled and that no proxy or middlebox is downgrading cipher negotiation. When using SSMS, select “Azure AD – Universal with MFA” and confirm you have at least “Read” access to the Fabric item. Also, check that workspace capacity and region match the endpoint, and try flushing DNS or using a clean network to avoid caching issues.

For quick troubleshooting, try connecting from another network, like a mobile hotspot. If that works, your corporate firewall or proxy may be blocking the handshake. You can also capture a network trace to see if a TCP reset occurs during TLS negotiation. For diagnostics, you can temporarily set TrustServerCertificate=True to test the connection; if it succeeds, it’s likely a TLS inspection or certificate validation issue that needs to be addressed on the network.

Additional references for your idea:
How to Connect - Microsoft Fabric | Microsoft Learn
Solved: Re: Loading Data On Prem to Fabric - SQL Endpoint ... - Microsoft Fabric Community
Warehouse Connectivity - Microsoft Fabric | Microsoft Learn
Add Fabric URLs to your allowlist - Microsoft Fabric | Microsoft Learn
An existing connection was forcibly closed (OS error 10054) - SQL Server | Microsoft Learn
Secure Your Fabric Data Warehouse - Microsoft Fabric | Microsoft Learn

Thanks and regards,
Community Memebr.

[svenchio]

Hi @jmaillra  is commonly caused by network security configurations, but you mentioned that this error started "after capacity migration", meaning you change your workspace to a different capacity (e.g. from trial to a pay capacity?) if so, there could be many moving parts on this, but my guess is that this is transient issue due to Fabric Lakehouse endpoints may redirect to a different internal endpoint after migration, I won't be surprise if after a few  hours, everything comes back to normal ... if no, I would recommend going for some testing in this order: 

#1. Confirm the endpoint URL hasn’t changed post-migration.

#2 Test with SSMS v18.5+ using Azure AD - Universal with MFA

#3. Verify TLS 1.2 is enabled on your machine.

#4. Check firewall/proxy rules for outbound SQL traffic.

#5. Try connecting from a different network or machine to isolate local issues.

Let me know how it works! If this has been of any help, thumbs up and if you issue has been solved, marked this question as answered, best of lucks. 

[lbendlin]

Your company's firewall rules are blocking/dropping the return packets from the authentication dialog. Talk to your network admin team.

[jmaillra]

Thanks for the feedback. The network team has been informed about the issue which still has not been resolved.