We have a data lake (Azure Data Lake Gen 2) that contains single folders with data for specific use cases in the 'gold' container, e.g. for a financial dashboard (folder 1) or a production dashboard (folder 2).

For each use case, I want to create a Synapse SQL Serverless database and grant access to the respective folder in the Data Lake via a Database Scoped Credential. For this I want to make sure that database 1 also has access to folder 1 and database 2 also only has access to folder 2. I should control this via ACLs in the Data Lake.

For the authentication I first thought of 2 service principals. However, these are probably not supported if the Data Lake was protected by a firewall.


Can I solve my problem e.g. via User Assigned Managed Identities? Are User Assigned Managed Identities supported for creating Database Scoped Credentials? Or is there a completely different idea?

1 Answer 1


found the answer: User assigned system identity is indeed not supported with storage firewall, there will be two options in this scenario:

  1. Create AAD group and grant ACL through AAD group. Then, when using aad pass through to login serverless, they could then control the access to different folders.
  2. Use different workspace instead of different database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.