> ## Documentation Index > Fetch the complete documentation index at: https://docs.dqlabs.ai/llms.txt > Use this file to discover all available pages before exploring further. # Azure Synapse Setup > Permissions, network requirements, and step-by-step instructions for connecting an Azure Synapse workspace to Prizm. This page covers the identity, permissions, and network access Prizm needs for each part of a Synapse workspace, then walks through the connection wizard. You only need to set up the surfaces you plan to catalog. In the examples below, `prizm-synapse-reader` stands for the display name of your app registration or managed identity. ## Prerequisites | Requirement | Required | Notes | | :- | :- | :- | | Azure Synapse Analytics workspace | Yes | With the Dedicated pool, Serverless endpoint, or Pipelines you want to catalog | | An identity for Prizm | Yes | A Microsoft Entra app registration (client secret or certificate), a managed identity, or a SQL login for a Dedicated pool | | Network access to the workspace | Yes | See [Network requirements](#network-requirements) | | Dedicated pool online | For Dedicated | The pool must be running (not paused) while Prizm runs | > [!NOTE] > > Prizm is read-only on Synapse. None of the permissions below let it change data or objects, and you don't need `db_datawriter`, `db_owner`, `ALTER`, `CONTROL`, Synapse Administrator, Contributor, or Owner. ## Required Permissions **Dedicated SQL pool** Run this in the pool database (not `master`) as the Microsoft Entra admin or a user with `CONTROL`: ```sql theme={null} CREATE USER [prizm-synapse-reader] FROM EXTERNAL PROVIDER; EXEC sp_addrolemember 'db_datareader', 'prizm-synapse-reader'; GRANT VIEW DEFINITION TO [prizm-synapse-reader]; GRANT VIEW DATABASE STATE TO [prizm-synapse-reader]; ``` **Using SQL Authentication instead:** ```sql theme={null} -- in master CREATE LOGIN prizm_reader WITH PASSWORD = ''; CREATE USER prizm_reader FOR LOGIN prizm_reader; -- in the dedicated pool database CREATE USER prizm_reader FOR LOGIN prizm_reader; EXEC sp_addrolemember 'db_datareader', 'prizm_reader'; GRANT VIEW DEFINITION TO prizm_reader; GRANT VIEW DATABASE STATE TO prizm_reader; ``` **Optional:** `GRANT VIEW ANY SENSITIVITY CLASSIFICATION TO [prizm-synapse-reader];` lets Prizm read existing sensitivity labels. If you leave out `db_datareader`, Prizm can still catalog, track lineage, and read usage, but it can't profile data or run quality checks. **Serverless SQL pool** Serverless uses Microsoft Entra authentication only, with no SQL logins. In `master` on the `-ondemand` endpoint: ```sql theme={null} CREATE LOGIN [prizm-synapse-reader] FROM EXTERNAL PROVIDER; GRANT VIEW ANY DATABASE TO [prizm-synapse-reader]; ``` Then, in each serverless database: ```sql theme={null} CREATE USER [prizm-synapse-reader] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [prizm-synapse-reader]; GRANT VIEW DEFINITION TO [prizm-synapse-reader]; ``` If your external tables use a database-scoped credential, also grant: ```sql theme={null} GRANT REFERENCES ON DATABASE SCOPED CREDENTIAL:: TO [prizm-synapse-reader]; ``` **Pipelines** Pipeline permissions are Synapse RBAC roles, assigned in Synapse Studio under **Manage → Access control → Add**, at workspace scope. The Azure portal doesn't assign them, and Azure Owner or Contributor doesn't grant them. | Role | Purpose | | :- | :- | | Synapse Artifact User | Read pipelines, activities, data flows, triggers, and linked services | | Synapse Monitoring Operator | Read pipeline, activity, and trigger runs | ```bash theme={null} az synapse role assignment create --workspace-name \ --role "Synapse Artifact User" --assignee az synapse role assignment create --workspace-name \ --role "Synapse Monitoring Operator" --assignee ``` Don't assign Synapse Administrator, Contributor, or Synapse Artifact Publisher. ### Azure Roles | Role | Scope | Purpose | | :- | :- | :- | | **Reader** | The Synapse workspace, or its resource group or subscription to browse several workspaces | Discover workspaces and read pool state | | **Storage Blob Data Reader** | Each Azure Data Lake Storage Gen2 account or container that your external tables or Delta tables use | Read external table and Delta metadata | ```bash theme={null} az role assignment create --assignee --role "Reader" \ --scope /subscriptions//resourceGroups//providers/Microsoft.Synapse/workspaces/ ``` If the storage account has a firewall, add Prizm's IP address, or allow the workspace through a resource instance rule. ## Network Requirements Prizm must reach these endpoints. Add Prizm's public IP address to the workspace's **Networking** firewall allow list, or use a private endpoint. | Endpoint | Port | | :- | :- | | `login.microsoftonline.com` | 443 | | `management.azure.com` | 443 | | `.sql.azuresynapse.net` (Dedicated pools) | 1433 | | `-ondemand.sql.azuresynapse.net` (Serverless) | 1433 | | `.dev.azuresynapse.net` (Pipelines) | 443 | | `.dfs.core.windows.net` (Delta or external table storage) | 443 | ## Connector Setup **1. Open the connector wizard** Navigate to **Source** and click the **+** icon next to the source list. Select **Synapse** from the connector grid. **2. Enter source details** | Field | Description | | :- | :- | | Connection Name | A label for this connection (for example, `synapse-prod`) | | Description | Optional notes about what this connection covers | | Authentication Type | **Service Principal (client secret)**, **Service Principal (certificate)**, **Managed Identity**, or **SQL Authentication (Dedicated pool only)** | ![The Synapse Source Details form with Service Principal (client secret) selected](https://mintcdn.com/dqlabs/-llXdpktU4fg82jU/images/sources/synapse/form-top.png?fit=max\&auto=format\&n=-llXdpktU4fg82jU\&q=85\&s=5e25bdedab72b087427f959c202d508f) **3. Provide credentials** Toggle **Use Vault** to retrieve credentials from a vault. For a vault, give the vault URL and secret name; the identity Prizm uses needs the Key Vault Secrets User role. **Service Principal (client secret)** | Field | Description | | :- | :- | | Tenant ID | Your Microsoft Entra tenant (directory) ID | | Client ID | Application (client) ID of the app registration | | Client Secret | The app registration's client secret | **Service Principal (certificate)** Provide the Tenant ID, Client ID, and the PEM file containing the certificate and private key, with its passphrase if the key is encrypted. **Managed Identity** No secret is needed. For a user-assigned identity, provide its Client ID. Managed Identity works only when Prizm runs on Azure. **SQL Authentication** Provide the SQL username and password you created for the Dedicated pool. This type doesn't support Serverless, Pipelines, or Azure resource discovery. **4. Choose the workspace and surfaces** Select your **Workspace** from the dropdown, which lists the workspaces the identity can see. Then turn on the surfaces to include: | Surface | Notes | | :- | :- | | Dedicated SQL Pool | Choose one or more **Dedicated SQL Pools** | | Serverless SQL Pool | Uses the workspace's `-ondemand` endpoint. **Serverless Endpoint** is an optional override (`-ondemand.sql.azuresynapse.net`) | | Pipelines | Select the pipelines to observe on the next step | ![The workspace and surface options of the Synapse form](https://mintcdn.com/dqlabs/-llXdpktU4fg82jU/images/sources/synapse/form-bottom.png?fit=max\&auto=format\&n=-llXdpktU4fg82jU\&q=85\&s=3ad00d7bbdaf9c65093d7e4843db5c27) **5. Choose what to profile** Click **Next** to open the source configuration step, and use the include and exclude options to scope databases and schemas. System schemas are excluded automatically. **6. Save** Complete the configuration. The source then appears in the **Source** list, where the **Valid** column shows a green check for a working connection. Assets appear in the catalog once the first scan completes. ## Troubleshooting Permissions | Symptom | Likely cause | | :- | :- | | Login fails for the identity | The user wasn't created `FROM EXTERNAL PROVIDER` in the right database, or the firewall blocks Prizm | | Tables are missing from the catalog | `VIEW DEFINITION` wasn't granted, or the schema is excluded | | Pipelines aren't listed | **Synapse Artifact User** is missing, or was granted in Azure instead of Synapse Studio | | Pipeline runs are missing | **Synapse Monitoring Operator** is missing | | Dedicated pool skipped | The pool is paused. Prizm doesn't resume pools | ## Next Steps > **[What We Collect](/sources/synapse/what-we-collect)** > > See what Prizm extracts from Synapse. > **[FAQ](/sources/synapse/faq)** > > Common questions about authentication, scoping, and permissions. > **[Troubleshooting](/help/troubleshooting)** > > Diagnose connection failures, permission errors, and timeouts. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.