Synapse Analytics: What is the default service principal used for?

Question

When creating a new Azure Synapse Analytics workspace, a service principal with the same name as the resource is automatically created with Synapse Administrator role on the workspace granted to it. This brings the following questions:

• What is this service principal used for?
• What would be the consequences of deleting this service principal?
• Can we prevent its creation?

Answer 1

Currently the identity is always created with the workspace- it is used for Synapse Pipelines, and without the identity this feature will not work. It is also an option when creating linked services and is often given permissions to SQL Pools, though neither is required.

Even if you are not planning on using the Pipelines feature, an alternative to deleting the user would be to limit it's permissions as there is no guarantee that the scope of its use won't expand in the future. The thing you will need to remember if you choose to limit or remove it will be that you could run into unexpected errors in the future that may require expanding the scope of its permissions or turn the managed identity back on.

Answer 2

Hi @Samara Soucy - MSFT ,

Thank you for the quick answer.

It is still not very clear to me though. In Data Factory, service principal is one possible option to authenticate to linked services. If other authentication methods are used (e.g. managed identity), then no service principal is needed to have pipelines work. Do you mean that in the case of Synapse, the Pipeline functionality wouldn't work at all if one decides to delete this service principal, even if it is not used in any linked service?