Azure synapse access over Private link and VPN

Question

Azure synapse access over Private link and VPN

Vasanthakumar Sekar 1

Hi,

I am trying to establish a secure connection to Azure synapse studio using private endpoint through private hub link. I want this to work over VPN i.e. connect to company's network from home. The gateway and the subnets are already established and works well with Dedicated pool SQL server over VPN.

But I see this error in my synapse studio. It says "Unable to connect to serverless SQL pool because of a network/firewall issue."

I followed all the steps given here

https://learn.microsoft.com/en-us/azure/synapse-analytics/security/how-to-connect-to-workspace-from-restricted-network

KranthiPakala-MSFT 46,747 Reputation points Microsoft Employee Moderator

2022-05-20T21:44:24.767+00:00

Hello @Vasanthakumar Sekar ,

Thanks for the question and using MS Q&A platform.

From your statement my understanding is that you were able to work with Dedicated SQL Pool server over VPN from Synapse studio but the issue you are experiencing is
Could you please confirm if you have completed the below highlighted (creation of private link endpoints with Target sub-resource - Sql and another endpoint with Target sub-resource -SqlOnDemand ) steps from this document?

If not, could you please try creating those endpoints and let us know how it goes.

Thank you
KranthiPakala-MSFT 46,747 Reputation points Microsoft Employee Moderator

2022-05-26T00:12:21.66+00:00

Hello @Vasanthakumar Sekar ,

Just checking in to see if the above information was helpful. And, if you have any further query do let us know.
Vasanthakumar Sekar 1 Reputation point

2022-05-26T13:11:02.61+00:00

Hi Kranthi,

Thanks for the detailed response. Appreciate it.

Sorry if I was not clear.

To your first point- No, we don't use Synapse studio for dedicated pool. We use SSMS. The database is connected via private endpoint connection and SQL authentication method. We don't use FQDN but private IP address. Reason for SQL authentication method - because dedicate pool has not been integrated with AAD yet.

But when it comes to Azure synapse server less. I've created an AAD group and linked to the database login/ role so that all members in that group have a same level of access. i.e. read or write. I am trying to make thing simple for user management.

To give you a little bit of background,

We use VPN to connect to client backbone from home and access the dedicated pool using a SQL authentication. This works fine.

II am trying to setup a secure connection to Azure synapse studio using private link hub and private endpoint as mentioned in the below doc,

https://learn.microsoft.com/en-us/azure/synapse-analytics/security/how-to-connect-to-workspace-from-restricted-network
Vasanthakumar Sekar 1 Reputation point

2022-05-26T13:11:24.357+00:00
The private endpoint and link hub are mounted on the same subnet as the one we use for dedicated pool. So, I don't think there is any problem with allowing certain ports for serverless pool. Please correct me.

There are two issues here

Azure synapse studio is not accessible when I replaced the firewall setting with Private end point.

Access to serverless pool DB using private IP in SSMS AAD authentication. This works with SQL authentication though.

In my case, our team has created the workspace without Managed VNET. So this option is disabled in the workspace. However, I'd like to secure the workspace by bringing it under the existing VNET/ Subnet so that it can be accessed only through company VPN and not over public IP.

Your answer

KranthiPakala-MSFT 46,747 Reputation points Microsoft Employee Moderator

2022-05-20T21:44:24.767+00:00

Hello @Vasanthakumar Sekar ,

Thanks for the question and using MS Q&A platform.

From your statement my understanding is that you were able to work with Dedicated SQL Pool server over VPN from Synapse studio but the issue you are experiencing is
Could you please confirm if you have completed the below highlighted (creation of private link endpoints with Target sub-resource - Sql and another endpoint with Target sub-resource -SqlOnDemand ) steps from this document?

If not, could you please try creating those endpoints and let us know how it goes.

Thank you
KranthiPakala-MSFT 46,747 Reputation points Microsoft Employee Moderator

2022-05-26T00:12:21.66+00:00

Hello @Vasanthakumar Sekar ,

Just checking in to see if the above information was helpful. And, if you have any further query do let us know.
Vasanthakumar Sekar 1 Reputation point

2022-05-26T13:11:02.61+00:00

Hi Kranthi,

Thanks for the detailed response. Appreciate it.

Sorry if I was not clear.

To your first point- No, we don't use Synapse studio for dedicated pool. We use SSMS. The database is connected via private endpoint connection and SQL authentication method. We don't use FQDN but private IP address. Reason for SQL authentication method - because dedicate pool has not been integrated with AAD yet.

But when it comes to Azure synapse server less. I've created an AAD group and linked to the database login/ role so that all members in that group have a same level of access. i.e. read or write. I am trying to make thing simple for user management.

To give you a little bit of background,

We use VPN to connect to client backbone from home and access the dedicated pool using a SQL authentication. This works fine.

II am trying to setup a secure connection to Azure synapse studio using private link hub and private endpoint as mentioned in the below doc,

https://learn.microsoft.com/en-us/azure/synapse-analytics/security/how-to-connect-to-workspace-from-restricted-network
Vasanthakumar Sekar 1 Reputation point

2022-05-26T13:11:24.357+00:00

The private endpoint and link hub are mounted on the same subnet as the one we use for dedicated pool. So, I don't think there is any problem with allowing certain ports for serverless pool. Please correct me.

There are two issues here

Azure synapse studio is not accessible when I replaced the firewall setting with Private end point.

Access to serverless pool DB using private IP in SSMS AAD authentication. This works with SQL authentication though.

In my case, our team has created the workspace without Managed VNET. So this option is disabled in the workspace. However, I'd like to secure the workspace by bringing it under the existing VNET/ Subnet so that it can be accessed only through company VPN and not over public IP.

Share via

Azure synapse access over Private link and VPN

Your answer