Access data in Azure Storage Account Gen2 from Synapse initated by Data Factory with Firewall setup.

Question

Hi,

I have a setup as following: Data factory starts a Stored Procedure in Synapse to read data from a delta table like this:

With allowing all networks on the storage account, this works without any problem. But when we only allow selected networks (our VNET + the Synapse and ADF workspace). This fails to work.

The weird thing is:

• When I start the stored procedure from within Synapse it works. (I had to setup a private endpoint).
• When I want to read data from the storage account immediatly with Data Factory, it works. (I had to setup a private endpoint).

Combining both together do not work.

Is there anywone that can help us with securing our data lake?

Thanks!

Answer 1

Hi, in the end we found the issue: we use the Azure Key Vault to provide the credentials towards the Synapse workspace. With this you cannot select "Managed Identity" as an authentication method. Which is needed because we provided the ADF with enough rights on the synapse and underlying storage account.

When you use the "SQL Authentication", that user is used (in our case the admin), that has not enough rights on the storage account.

I hope this also enables others to secure their data lake.