Database Scoped Credential with User-Assigned Managed Identity possible?

Question

We have a data lake (Azure Data Lake Gen 2) that contains single folders with data for specific use cases in the 'gold' container, e.g. for a financial dashboard (folder 1) or a production dashboard (folder 2).

For each use case, I want to create a Synapse SQL Serverless database and grant access to the respective folder in the Data Lake via a Database Scoped Credential. For this I want to make sure that database 1 also has access to folder 1 and database 2 also only has access to folder 2. I should control this via ACLs in the Data Lake.

For the authentication I first thought of 2 service principals. However, these are probably not supported if the Data Lake was protected by a firewall.

https://learn.microsoft.com/en-us/azure/synapse-analytics/sql/develop-storage-files-storage-access-control?tabs=service-principal#firewall-protected-storage

Can I solve my problem e.g. via User Assigned Managed Identities? Are User Assigned Managed Identities supported for creating Database Scoped Credentials? Or is there a completely different idea?

Answer 1

found the answer: User assigned system identity is indeed not supported with storage firewall, there will be two options in this scenario:

1. Create AAD group and grant ACL through AAD group. Then, when using aad pass through to login serverless, they could then control the access to different folders.
2. Use different workspace instead of different database.