Cannot use managed identity to connect to service bus

Question

I am trying to connect to Service Bus from Azure synapse using managed identity but it is not letting me to. I need this so that I can disable local auth in Service Bus. Is it possible to connect to service bus from Synapse with local auth disabled in service bus? Please advise on SFI compliant way to access SB from Synapse.

I tried system assigned MI, and assigned service bus data owner access, but the access failed in synapse.

DefaultAzureCredential failed to retrieve a token from the included credentials. Attempted credentials: EnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured. Visit https://aka.ms/azsdk/python/identity/environmentcredential/troubleshoot to troubleshoot this issue. ManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint. SharedTokenCacheCredential: SharedTokenCacheCredential authentication unavailable. No accounts were found in the cache. AzureCliCredential: Azure CLI not found on path AzurePowerShellCredential: PowerShell is not installed AzureDeveloperCliCredential: Azure Developer CLI could not be found. Please visit https://aka.ms/azure-dev for installation instructions and then,once installed, authenticate to your Azure account using 'azd auth login'. To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/python/identity/defaultazurecredential/troubleshoot. Unexpected error occurred (ClientAuthenticationError("DefaultAzureCredential failed to retrieve a token from the included credentials.\nAttempted credentials:\n\tEnvironmentCredential: EnvironmentCredential authentication unavailable. Environment variables are not fully configured.\nVisit https://aka.ms/azsdk/python/identity/environmentcredential/troubleshoot to troubleshoot this issue.\n\tManagedIdentityCredential: ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint.\n\tSharedTokenCacheCredential: SharedTokenCacheCredential authentication unavailable. No accounts were found in the cache.\n\tAzureCliCredential: Azure CLI not found on path\n\tAzurePowerShellCredential: PowerShell is not installed\n\tAzureDeveloperCliCredential: Azure Developer CLI could not be found. Please visit https://aka.ms/azure-dev for installation instructions and then,once installed, authenticate to your Azure account using 'azd auth login'.\nTo mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/python/identity/defaultazurecredential/troubleshoot.")).).) Handler shutting down. Traceback (most recent call last):

Answer 1

Hi Prajwal Pyakurel,
Thank you for reaching out to Microsoft QA!
Synapse cannot connect directly to Azure Service Bus using managed identity, because there is no native “Azure Service Bus” linked service in Synapse. The SFI‑compliant approach is to use another Azure service that supports Service Bus with managed identity (for example, Azure Functions or Azure Data Factory), grant it the required Service Bus RBAC roles, and then call that service from Synapse for any Service Bus operations.

DefaultAzureCredential fails in Synapse notebooks with that IMDS endpoint error because Spark pools do not expose the IMDS endpoint, even after assigning Data Owner to the workspace managed identity. The Spark runtime does not expose the standard IMDS endpoint, so ManagedIdentityCredential cannot obtain a token and has no valid fallbacks (no CLI/PowerShell/environment credentials in the runtime), and user‑assigned managed identities are also not supported in Synapse Spark notebooks

Answer 2

To connect Azure Synapse to Azure Service Bus using managed identity, you need to ensure that the managed identity has the appropriate permissions assigned in Azure Service Bus. You can use Microsoft Entra ID for authentication and authorization, which is recommended over local authentication methods.

1. Assign Permissions: Ensure that the managed identity used by Azure Synapse has been assigned one of the built-in roles for Azure Service Bus, such as Azure Service Bus Data Sender or Azure Service Bus Data Receiver. This can be done through the Azure portal by navigating to the Access control (IAM) page of your Service Bus namespace and assigning the role to the managed identity.
2. Disable Local Authentication: You can disable local authentication for your Service Bus namespace, allowing only Microsoft Entra authentication. This is a secure method and is recommended for production environments. You can follow the steps outlined in the documentation to disable local authentication.
3. Connection Code: When connecting to Service Bus from Azure Synapse, use the managed identity to authenticate. Here's a sample code snippet for connecting:

      string fullyQualifiedNamespace = "<your namespace>.servicebus.windows.net>";
      string userAssignedClientId = "<your managed identity client ID>";
      
      var credential = new DefaultAzureCredential(
          new DefaultAzureCredentialOptions
          {
              ManagedIdentityClientId = userAssignedClientId
          });
      
      var sbusClient = new ServiceBusClient(fullyQualifiedNamespace, credential);
   

By following these steps, you should be able to connect to Azure Service Bus from Azure Synapse with local authentication disabled, using a managed identity in a secure manner.