Forum Discussion
Is it possible to Mirror Azure SQL via VNet Gateway with Workspace Identity?
I'm trying to do a first test of mirroring one of our databases that is private within our Azure Network.
I have created a VNet Data Gateway, assigned the Workspace Identity the necessary permissions in Azure SQL, but when trying to create a connection, either from the Mirroring Wizard or Manage Connections and Gateways, it doesn't appear to be possible to createa combination of the VNet Data Gateway and Workspace Identity.
I couldn't see this listed as a known issue or limitation anywhere, but I'm assuming that it currently is?
I'm going to try out Service Principal authentication as that appears to be the next least-bad option, but that will break when the secret expires. We don't generally allow SQL Logins to our servers.
Hi AndrewDMay ,
Workspace identities are not supported for gateway-based connections. That said, according to the documentation you referenced, workspace identity can be used to authenticate directly to an Azure SQL Database, provided the connection does not go through a gateway.
Thank you
3 Replies
Hi AndrewDMay ,
Thanks for reaching out to the Microsoft Fabric Community forum.Although Workspace Identity can be used with several Fabric items (such as pipelines, notebooks, Dataflows Gen2, and OneLake shortcuts), Fabric Mirroring uses a different connection and execution model and does not yet support Workspace Identity–based authentication. This limitation applies regardless of whether the source database is public or private, and even when a VNet Data Gateway is configured.
Source: Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn
Please try using alternate authentication method to connect to Azure SQL database and let us know if you face any hurdles.
I hope this information helps. Please do let us know if you have any further queries.
Thank youThanks for the information. I see on that page this limitation listed:
Workspace-Identity-based authentication is currently not supported for gateway connections.
But in the tutorial for Mirroring Azure SQL: https://learn.microsoft.com/en-us/fabric/mirroring/azure-sql-database-tutorial there are instructions for using Workspace identity (although a note at the top saying that Entra logins are currently in preview) - so I do think mirroring using Workspace identity may be supported for public Azure SQL databases (with normal caveats about relying ons something in preview).
It feels odd that something that's largely a networking construct (using a gateway) should be tied into the authentication mechanism, but I don't claim to understand how that this all works under the hood.
Hopefully it will be a supported configuration soon - the more things that can use Workspace identity the better.
Hi AndrewDMay ,
Workspace identities are not supported for gateway-based connections. That said, according to the documentation you referenced, workspace identity can be used to authenticate directly to an Azure SQL Database, provided the connection does not go through a gateway.
Thank you
