Transition your Azure Synapse Analytics workspaces to private links before 1 August 2026: SQL Database not affected?

Raphael Schmid 20 Reputation points
2026-05-12T09:20:33.2366667+00:00

We also received the email, mentioned in this question: Transition your Azure Synapse Analytics workspaces to private links before 1 August 2026

In the email only Azure Key Vault and Azure Blob Storage are mentioned. Are only those two affected by this security update? We are using an Azure SQL Database, in which only selected networks are enabled and this setting is enabled too: "Allow Azure services and resources to access this server". Will this not be affected by this security update?

Azure Synapse Analytics
Azure Synapse Analytics

An Azure analytics service that brings together data integration, enterprise data warehousing, and big data analytics. Previously known as Azure SQL Data Warehouse.

0 comments

Answer accepted by question author

Manoj Kumar Boyini 19,265 Reputation points Microsoft External Staff Moderator
2026-05-12T09:42:08.4666667+00:00

Hi @Raphael Schmid

You’re correct—this retirement notice only covers the “trusted services” firewall exception that Synapse uses to talk to Azure Storage (Blob/ADLS Gen2) and Azure Key Vault. It does not apply to Azure SQL Database or the generic “Allow Azure services and resources to access this server” toggle on your SQL server. You can keep using your SQL DB as-is after 1 August 2026.

If, however, you want to remove that broad “Allow Azure Services…” rule on your SQL server, you can switch to a SQL Private Endpoint for more locked-down access—but that’s purely optional and not required by this Synapse update.

Hope that clears it up! Please let us know if you have any questions or concerns.

References

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-05-12T09:20:53.5033333+00:00

    The email and the referenced FAQ describe retirement of the trusted services function that allows Azure Synapse Analytics to access Azure Storage (ADLS Gen2) and Azure Key Vault via managed identity plus a firewall exception. The documented mitigation is to move those integrations to private links/managed private endpoints.

    From the provided information, only:

    • Azure Storage accounts (ADLS Gen2) used by Synapse
    • Azure Key Vault used by Synapse

    are explicitly called out as being affected by this particular change.

    Azure SQL Database connectivity is documented separately under Azure Private Link for Azure SQL Database and Azure Synapse Analytics. That guidance covers:

    • Using Private Link/private endpoints for Azure SQL Database and dedicated SQL pools
    • Using the logical server FQDN (<server>.database.windows.net) in connection strings
    • Options for on-premises connectivity (VPN, ExpressRoute, peering)

    There is no statement in the provided material that this Synapse-specific trusted services retirement changes or removes the “Allow Azure services and resources to access this server” setting on Azure SQL Database, nor that Azure SQL Database firewall behavior is being altered by this Synapse update.

    Therefore, based on the available documentation:

    • The described transition requirement applies to Synapse’s use of Azure Storage and Azure Key Vault.
    • Azure SQL Database access using “selected networks” plus “Allow Azure services and resources to access this server” is not indicated as being impacted by this specific Synapse trusted-services retirement.

    For Synapse itself, if choosing to transition to private links, the required actions are:

    1. Create a Synapse workspace with a Managed Virtual Network.
    2. Create managed private endpoints from Synapse to the ADLS Gen2 storage account.
    3. Ensure both of these network settings are enabled:
      • On the storage account: Allow Azure services and resources to access this storage account.
      • On the Synapse workspace: Allow Azure services and resources to access this workspace.

    After this, Synapse connects to storage via private endpoints instead of the trusted-services firewall exception.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.