Skip to main content
This page covers the identity, permissions, and network access Prizm needs for each part of a Synapse workspace, then walks through the connection wizard. You only need to set up the surfaces you plan to catalog. In the examples below, prizm-synapse-reader stands for the display name of your app registration or managed identity.

Prerequisites

Prizm is read-only on Synapse. None of the permissions below let it change data or objects, and you don’t need db_datawriter, db_owner, ALTER, CONTROL, Synapse Administrator, Contributor, or Owner.

Required Permissions

Run this in the pool database (not master) as the Microsoft Entra admin or a user with CONTROL:
Using SQL Authentication instead:
Optional: GRANT VIEW ANY SENSITIVITY CLASSIFICATION TO [prizm-synapse-reader]; lets Prizm read existing sensitivity labels.If you leave out db_datareader, Prizm can still catalog, track lineage, and read usage, but it can’t profile data or run quality checks.

Azure Roles

If the storage account has a firewall, add Prizm’s IP address, or allow the workspace through a resource instance rule.

Network Requirements

Prizm must reach these endpoints. Add Prizm’s public IP address to the workspace’s Networking firewall allow list, or use a private endpoint.

Connector Setup

1

Open the connector wizard

Navigate to Source and click the + icon next to the source list. Select Synapse from the connector grid.
2

Enter source details

The Synapse Source Details form with Service Principal (client secret) selected

Synapse source details. Service Principal (client secret) is the default

3

Provide credentials

Toggle Use Vault to retrieve credentials from a vault. For a vault, give the vault URL and secret name; the identity Prizm uses needs the Key Vault Secrets User role.
4

Choose the workspace and surfaces

Select your Workspace from the dropdown, which lists the workspaces the identity can see. Then turn on the surfaces to include:
The workspace and surface options of the Synapse form

Workspace and surface options. Dedicated SQL Pool, Serverless SQL Pool and Pipelines are on by default

5

Choose what to profile

Click Next to open the source configuration step, and use the include and exclude options to scope databases and schemas. System schemas are excluded automatically.
6

Save

Complete the configuration. The source then appears in the Source list, where the Valid column shows a green check for a working connection. Assets appear in the catalog once the first scan completes.

Troubleshooting Permissions

Next Steps

What We Collect

See what Prizm extracts from Synapse.

FAQ

Common questions about authentication, scoping, and permissions.

Troubleshooting

Diagnose connection failures, permission errors, and timeouts.