Azure Synapse Studio - Browsing a VNet isolated Data Lake

Question

Azure Synapse Studio - Browsing a VNet isolated Data Lake

fmms 6

Hi,

I want to use Synapse Studio to access a data lake that is in a VNet. For this I have created a workspace with the Managed VNet option. For the pipelines within Synapse this works well. I can preview files on the data lake.

However, the file system browser that is integrated in the Synapse Studio does not leverage the Integration Runtime that is configured in its linked service.

As a result it is not working at all.

Are there any tricks to make that happen?

Thanks alot

Miguel Araújo 6 Reputation points

2021-03-24T16:40:59.117+00:00

I'm having EXACTLY the same issue, including the fact that the role assignment in the storage account and the private endpoints are already created.
It doesn't seem to work when the storage account is restricted to a specific vnet.

1 answer

Your answer

Miguel Araújo 6 Reputation points

2021-03-24T16:40:59.117+00:00

I'm having EXACTLY the same issue, including the fact that the role assignment in the storage account and the private endpoints are already created.
It doesn't seem to work when the storage account is restricted to a specific vnet.

Answer 1

PRADEEPCHEEKATLA 90,641 Moderator

Hello @fmms ,

Welcome to the Microsoft Q&A platform.

To resolve this issue, you need to have proper rights to access on the Storage Account.

Easiest way is to grant Storage Blob Data Contributor role to the Managed identity name fmsynwsp you're trying to access.

Go to storage account => Access Control (IAM) => Add => Add role assignment => Select Role Storage Blob Data Contributor => Select Managed identity name fmsynwsp and click on save.

For more details, refer:

Visit full guide on Azure Active Directory access control for storage for more information

Visit Control storage account access for serverless SQL pool in Azure Synapse Analytics.

Note: Before you create a linked service, click on Test connection button to verify the connection.

Once you had granted permission on the storage account, you will be able to access the storage account in synapse workspace.

Hope this helps. Do let us know if you any further queries.

------------

Please don’t forget to Accept Answer and Up-Vote wherever the information provided helps you, this can be beneficial to other community members.

fmms 6 Reputation points

2021-03-22T13:57:31.03+00:00

Hi,

thanks for the answer. @PRADEEPCHEEKATLA

Though I cannot reproduce this at the moment.

Can you please confirm that your storage account is just accessible from VNet:

I have validated with LogAnalytics, that this is an IP error, rather than the plain Azure Storage Contributor which i do have:

Moreover, could you please validate that your browser is not talking to the storage account client side, mine seems to be:

Thanks alot
PRADEEPCHEEKATLA 90,641 Reputation points Moderator

2021-03-23T07:18:31.803+00:00

Hello @fmms ,

Have you tried granting Storage Blob Data Contributor role to the Managed identity name fmsynwsp you're trying to access?
fmms 6 Reputation points

2021-03-23T21:33:10.56+00:00

For sure I did:

There is no problem with permissions on the blob.
My issue is that even though there is an interactive authoring runtime configured on the runtime of the linked service, it is still my browser sending a client side request.
PRADEEPCHEEKATLA 90,641 Reputation points Moderator

2021-03-25T06:38:44.677+00:00

Hello @fmms ,

This issue looks strange. For a deeper investigation and immediate assistance on this issue, if you have a support plan you may file a support ticket.
fmms 6 Reputation points

2021-03-26T18:50:01.143+00:00

Hi,

I got the confirmation that file browsing is client side and does not work with VNets -- if they are not peered so that client side requests work -- at the moment.

regards

Share via

Azure Synapse Studio - Browsing a VNet isolated Data Lake

1 answer

Your answer