linked service connectivity issues in Azure Synapse Studio

Question

linked service connectivity issues in Azure Synapse Studio

Surendra Yadav 45

Hi Team,

We are not able to test connection when Key vault link service checking that time gating error as mentions below.

User's image

SAI JAGADEESH KUDIPUDI 3,640 Reputation points Microsoft External Staff Moderator

2026-06-16T14:12:11.13+00:00
Hi @Surendra Yadav ,
Is the Synapse workspace Git-enabled, and are you deploying via ARM/Bicep/CI templates (or Synapse publish artifacts)?

When you deployed the workspace, did your template include Managed Virtual Network configuration?

What is the Authentication method used in the Key Vault linked service (system-assigned managed identity / service principal / key-based)?

Does your workspace have data exfiltration protection / private networking / managed private endpoints enabled?

Is this happening in a specific branch/environment only, or consistently in all environments?
SAI JAGADEESH KUDIPUDI 3,640 Reputation points Microsoft External Staff Moderator

2026-06-17T17:44:46.97+00:00

Hi @Surendra Yadav ,
Could you please let us know if you had a chance to review the earlier queries and share your inputs? This information will help us proceed further with the investigation.
Surendra Yadav 45 Reputation points

2026-06-18T05:25:15.1266667+00:00
Hi @SAI JAGADEESH KUDIPUDI ,

Please find the details below:

Synapse workspace is Git-enabled and deployed through CI/CD using published Synapse artifacts.

Managed Virtual Network and Managed Private Endpoints are enabled.

The Key Vault linked service uses the Synapse Workspace System-Assigned Managed Identity for authentication.

Private networking is enabled, and Key Vault access is configured through Private Endpoints.

The issue is occurring consistently in both QA and Production environments.

Additional observation: When Key Vault Public Network Access is temporarily enabled (with Trusted Microsoft Services allowed), the Linked Service Test Connection succeeds. When Public Access is disabled, the connection fails with Error 9054, indicating the issue is likely related to the private connectivity path (Private Endpoint, Managed Private Endpoint, DNS resolution, or network configuration).

we implemented our synapse as per below url but we are facing issue when connecting link service keyvaults

https://learn.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-managed-vnet
SAI JAGADEESH KUDIPUDI 3,640 Reputation points Microsoft External Staff Moderator

2026-06-26T05:19:39.06+00:00

Hi @Surendra Yadav ,
could you please submit the request using the link provided in private message?
This will help us with further investigation.

1 answer

Your answer

SAI JAGADEESH KUDIPUDI 3,640 Reputation points Microsoft External Staff Moderator

2026-06-16T14:12:11.13+00:00

Hi @Surendra Yadav ,
Is the Synapse workspace Git-enabled, and are you deploying via ARM/Bicep/CI templates (or Synapse publish artifacts)?

When you deployed the workspace, did your template include Managed Virtual Network configuration?

What is the Authentication method used in the Key Vault linked service (system-assigned managed identity / service principal / key-based)?

Does your workspace have data exfiltration protection / private networking / managed private endpoints enabled?

Is this happening in a specific branch/environment only, or consistently in all environments?
SAI JAGADEESH KUDIPUDI 3,640 Reputation points Microsoft External Staff Moderator

2026-06-17T17:44:46.97+00:00

Hi @Surendra Yadav ,
Could you please let us know if you had a chance to review the earlier queries and share your inputs? This information will help us proceed further with the investigation.
Surendra Yadav 45 Reputation points

2026-06-18T05:25:15.1266667+00:00

Hi @SAI JAGADEESH KUDIPUDI ,

Please find the details below:

Synapse workspace is Git-enabled and deployed through CI/CD using published Synapse artifacts.

Managed Virtual Network and Managed Private Endpoints are enabled.

The Key Vault linked service uses the Synapse Workspace System-Assigned Managed Identity for authentication.

Private networking is enabled, and Key Vault access is configured through Private Endpoints.

The issue is occurring consistently in both QA and Production environments.

Additional observation: When Key Vault Public Network Access is temporarily enabled (with Trusted Microsoft Services allowed), the Linked Service Test Connection succeeds. When Public Access is disabled, the connection fails with Error 9054, indicating the issue is likely related to the private connectivity path (Private Endpoint, Managed Private Endpoint, DNS resolution, or network configuration).

we implemented our synapse as per below url but we are facing issue when connecting link service keyvaults

https://learn.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-managed-vnet
SAI JAGADEESH KUDIPUDI 3,640 Reputation points Microsoft External Staff Moderator

2026-06-26T05:19:39.06+00:00

Hi @Surendra Yadav ,
could you please submit the request using the link provided in private message?
This will help us with further investigation.

Answer 1

hi Surendra Yadav & thx for sharing urs issue here at Q&A portal,

Error 9054 usually means Synapse can’t reach the Integration Runtime path used for the linked service test.

For an Azure Key Vault linked service, this is usually one of these: IR issue, Key Vault firewall/private endpoint/DNS, or missing managed identity permission. Since the dialog says Failed to connect to Integration Runtime or connection is broken unexpectedly, I’d check the IR first. If u use AutoResolve IR, try changing the region or create a dedicated Azure IR in the same region as Synapse/Key Vault. If u use self-hosted IR, make sure the node is online and can reach Key Vault over HTTPS. Then check Key Vault networking. If public access is disabled or selected networks is enabled, Synapse needs a valid network path. With Synapse managed VNet, create a managed private endpoint to Key Vault and approve it on the Key Vault side. DNS must resolve the vault to the private endpoint.

Don’t forget permissions. The Synapse workspace managed identity needs access to Key Vault secrets. Depending on ur Key Vault mode, grant either RBAC like Key Vault Secrets User, or access policy with Get and List secrets.

Key Vault RBAC https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide

For support, include the Activity ID from the error 5d91978f-48d7-4a99-9cdd-d1ba39cca24c

I guess its not a broken linked service definition. More likely Synapse IR can’t reach the vault because of firewall/private endpoint/DNS, or the workspace MI can reach it but lacks secret permissions.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

and at my blog https://ctrlaltdel.blog/