Mirror Azure SQL with Workspace Identity in Microsoft Fabric
Using Workspace Identity to secure Azure SQL connectivity in Microsoft Fabric Mirroring
Prelude
Data source connections are a fundamental building block of Analytics projects and, while designing architectures, the authentication method is crucial to guarantee access to the required data and make the whole process reliable over time.
Service Accounts or Service Principals have been pivotal in this regard, allowing connections to be established without relying on a personal (maybe MFA-enabled?) account that may fail because of token expiration, password changes, account deactivation, etc.
One of the most appreciated Microsoft Fabric features is Mirroring, which automatically replicates data from supported sources into Delta tables hosted in Microsoft Fabric’s OneLake in near real time. The setup is pretty straightforward and, like many other artifacts in Fabric, it relies on a connection that defines both the data source and how the connection is established.
Fabric Mirroring with Workspace Identity over Azure SQL
Mirroring in Fabric supports many sources natively (and thanks to Open Mirroring, it lets you mirror nearly everything). Among the supported sources, there’s Azure SQL.
While setting up the connection to Azure SQL to be used by Fabric Mirroring, you’re asked to specify the authentication method, choosing from the following options:
- Basic
- OAuth2
- Service Principal
- Workspace Identity
Service Principal should generally be preferred over Basic and OAuth2, but Fabric offers another interesting option: Workspace Identity.
Like many Azure resources, you can attach an identity to a Fabric Workspace and use it for authentication. Behind the scenes, Fabric registers an application in Entra that represents your workspace and then allows you to use it when configuring authentication to data sources.
Get Riccardo Perico’s stories in your inbox
Join Medium for free to get updates from this writer.
From an Entra perspective, the Workspace Identity is fully managed behind the scenes and is very similar to a system-assigned managed identity for Azure resources.
If you want to leverage Workspace Identity to mirror Azure SQL in Microsoft Fabric, you first need to create it from the Workspace UI.
Once the identity is created, you’ll get its representation in Entra, including:
- App Name
- Object ID
- App ID
To make Mirroring work with Workspace Identity, you need to grant it access to Azure SQL by creating a user (it could be a contained database user, if preferred) mapped to the Entra application and assigning only the permissions required to manage Mirroring.
You can then switch to the Connections and Gateways UI and create a new Azure SQL connection using Workspace Identity as the authentication method.
When prompted, you’ll be able to select this connection at the very beginning of the Mirroring setup and start it.
Conclusions
Authentication plays a key role in determining how reliable a platform will be over time.
With Workspace Identity, Microsoft Fabric extends the same identity approach already familiar across Azure, providing a way to authenticate without managing credentials or depending on personal accounts. When properly configured in Azure SQL, it becomes effective option for supporting Mirroring workloads while keeping security and governance requirements under control.
