Synapse Initial Workspace Admin access

Question

Synapse Initial Workspace Admin access

Rajat Kumar 60

Nov 29, 2023, 11:28 AM

Hi There,

I am deploying Azure Synapse Analytics via Bicep and it deployed successfully.

But one issue is there, I am trying to give initial workspace admin access to a Service Principal, but it after deployment, it picks some default id rather than my Service Principal Id.

This is my synapse module part from where I am assigning Initial Workspace Admin access:

properties: {
    azureADOnlyAuthentication: true
    cspWorkspaceAdminProperties:{
      initialWorkspaceAdminObjectId: pInitialWsAdminObjId
    }

But in my what-if task, it shows the correct SPN id to be assigned as Initial Workspace Admin, but after deployment it doesn't.

Need your help here.

Thanks in advance.

Regards,
Rajat

ShaikMaheer-MSFT 38,521 Reputation points Microsoft Employee

Nov 30, 2023, 4:51 PM

Hi Rajat Kumar,

Thank you for posting query in Microsoft Q&A platform.

One possible reason for this issue is that the pInitialWsAdminObjId parameter is not being passed correctly to the Bicep deployment. You can check the value of this parameter in the Bicep file to ensure that it is being passed correctly.

If the service principal has not been assigned the "Workspace Admin" role, you can assign it by clicking the "Add" button and selecting "Add role assignment". From there, you can select the "Workspace Admin" role and search for the service principal to assign it.

Please let me know if that works. Thank you.
Rajat Kumar 60 Reputation points

Nov 30, 2023, 7:25 PM

Hi Shaik,

Thanks for the response.

I have verified the value of pInitialWsAdminObjId parameter in my what-if task. The value is proper SPN Object ID. But during deployment it didn't took that vaule.

Moreover, using clickops I am able t assign my SPN as initial WS admin.

But we need to achieve this via bicep.

Regards,

Rajat
Rajat Kumar 60 Reputation points

Dec 2, 2023, 7:03 PM

Hi,

I have sorted this out somehow.

But one more issue is there, I have synapse WS with Public access disabled and I ave created PE for SqlOnDemand and Sql sub Resource.

And I am trying to assign WS Rbac via powershell using azure devops (using self hosted agent VM in same vnet as pt Synapse vnet). But during deployment it throws error: Public access denied. I am able to do nslookp and it resolvs to Private IP.

Your answer

ShaikMaheer-MSFT 38,521 Reputation points Microsoft Employee

Nov 30, 2023, 4:51 PM

Hi Rajat Kumar,

Thank you for posting query in Microsoft Q&A platform.

One possible reason for this issue is that the pInitialWsAdminObjId parameter is not being passed correctly to the Bicep deployment. You can check the value of this parameter in the Bicep file to ensure that it is being passed correctly.

If the service principal has not been assigned the "Workspace Admin" role, you can assign it by clicking the "Add" button and selecting "Add role assignment". From there, you can select the "Workspace Admin" role and search for the service principal to assign it.

Please let me know if that works. Thank you.
Rajat Kumar 60 Reputation points

Nov 30, 2023, 7:25 PM

Hi Shaik,

Thanks for the response.

I have verified the value of pInitialWsAdminObjId parameter in my what-if task. The value is proper SPN Object ID. But during deployment it didn't took that vaule.

Moreover, using clickops I am able t assign my SPN as initial WS admin.

But we need to achieve this via bicep.

Regards,

Rajat
Rajat Kumar 60 Reputation points

Dec 2, 2023, 7:03 PM

Hi,

I have sorted this out somehow.

But one more issue is there, I have synapse WS with Public access disabled and I ave created PE for SqlOnDemand and Sql sub Resource.

And I am trying to assign WS Rbac via powershell using azure devops (using self hosted agent VM in same vnet as pt Synapse vnet). But during deployment it throws error: Public access denied. I am able to do nslookp and it resolvs to Private IP.

Share via

Synapse Initial Workspace Admin access

Your answer