System-managed MPE 'synapse-ws-sqlOnDemand--<workspace>' stuck in Rejected state

Environment

• Azure Synapse Analytics workspace (serverless SQL pool only — no dedicated SQL pool)
• Managed Virtual Network: Enabled
• Data Exfiltration Protection (DEP): Enabled
• Public network access: Disabled
• Region: Central US

Problem

The system-managed Managed Private Endpoint named:

synapse-ws-sqlOnDemand--<workspace_name>

with target sub-resource SqlOnDemand is showing Approval state = Rejected in Synapse Studio → Manage → Managed private endpoints.

A second system MPE synapse-ws-sql--<workspace_name> is also Rejected (lower priority because no dedicated SQL pool exists).

Because DEP is enabled, any server-side workload (pipeline Copy activity, Spark job, Script activity) needs this MPE in Approved state to reach the workspace's own serverless SQL endpoint (<workspace>-ondemand.sql.azuresynapse.net) from inside the Managed VNet. Currently every pipeline attempt fails with TCP 10060 / SqlFailedToConnect.

Interactive SQL Script queries (via Dev endpoint) still work — confirming the issue is scoped to MVNet outbound to the workspace's own serverless endpoint.

What I've tried (all failed)

1. Deleted the MPE in Synapse Studio → workspace platform auto-recreates it (this is documented "system-only" use per the description shown in the detail pane) → state returns as Rejected (not Pending).
2. Approve via Azure Portal: workspace → Networking → Private endpoint connections → the system MPE does not surface in this list. Only external customer-inbound PEs are visible.
3. PowerShell: Get-AzPrivateEndpointConnection -PrivateLinkResourceId <workspaceId> returns only the customer-inbound PEs. The system MPE's underlying PE resource lives in a Microsoft-managed subscription (visible in the MPE detail pane), inaccessible to me.
4. Approve-AzPrivateEndpointConnection — not applicable; resource isn't returned by the API.
5. Create a parallel user-named MPE to the same target (same workspace + same SqlOnDemand sub-resource) → blocked with:

   
      Managed private endpoint
   
      ('synapse-ws-sqlOnDemand--<workspace>')
   
      has already been created for the selected resource.
   
   

   So no parallel route is allowed — 1:1 enforcement per (target workspace, sub-resource) from the MVNet.

What I know

• Other Synapse workspaces in the same tenant with the same Managed VNet + DEP configuration have this MPE in Approved state and working — so this is an anomaly, not a design choice.
• The Approval state appears to be persisted on the Microsoft-managed side, so delete/recreate from the customer side doesn't reset it.

My question

1. Is there any customer-accessible API or REST endpoint that can flip the approval state of a system-managed Synapse MPE? (REST, ARM template, az CLI undocumented flag, anything?)
2. If not, is there a workspace-level reset that's safe to run (e.g., toggle a setting that triggers full MPE reconciliation with re-approval)?
3. Has anyone successfully resolved this without Microsoft Support?
4. As a workaround pattern, what production-grade alternatives have others used? (CETAS from interactive sessions doesn't scale; Spark pool requires net new compute provisioning.)

Any pointers appreciated — thanks!