Got error code 403 when try to access my Synapse workspace created within a virtual network

Question

I got a 403 error when access my Synapse Workspace created in a managed virtual network within a jumphost inside my virtual network.

 

This is the network settings of my Synapse Analytics workspace

My bicep files have help me set up some private endpoints

I have already added my Synapse Workspace as Contributor in my data lake storage account

I also got error when accessing my blob from within the jumphost

My goal is to allow all the Azure Services inside the same virtual network able to access the Synapse workspace and my Synapse workspace able to access the data lake storage account.

 

Does anyone know which part I have set up wrongly?

Answer 1

Based on this old thread :

When encountering a 403 Forbidden error while trying to access the Synapse web UI, it typically indicates an issue with permissions or network configurations. To some extent it might have many reasons beyond normal.

To get the root of the incident, check the diagnostic logs in Azure Synapse and any related logs in your Azure environment for more detailed error messages and use Azure Monitor to gather more insights about the connection attempts and potential issues for specific solution.

However, I will provide you with possibility diagnosis that can solve the issue in a normal scenario:

1. Ensure that the private endpoints for your Synapse workspace are correctly set up.
2. Check that the DNS configuration is correctly resolving the private endpoint.
3. Verify that the Network Security Groups (NSGs) associated with your private endpoints allow inbound traffic from your IP address or subnet.
4. Ensure that the firewall settings on your Synapse workspace are correctly configured to allow access from your private endpoints.
5. Ensure that the user account you are using has the necessary permissions to access the Synapse workspace.
6. Check role assignments in Azure Synapse and ensure the user has at least the Synapse Administrator or Synapse Contributor role.
7. Ensure that your DNS is correctly configured to resolve the private link FQDN to the private IP address of the private endpoint.
8. If you are accessing the Synapse workspace from a VNet, ensure that the VNet integration is correctly configured.
9. Check the VNet peering settings if your Synapse workspace and the accessing resources are in different VNets.
10. Verify that the private link service has been approved and is in a Connected state.

If you could check through these lists, the problem should be solved and if not get back with more log report for best solution.