Using AME unable to create Linked Service for Azure SQL in Data Factory

Question

Using AME unable to create Linked Service for Azure SQL in Data Factory

Hemant 41 Microsoft External Staff

Using AME unable to create Linked Service for Azure SQL in Data Factory. Any help would be greatly appreciated.

Hemant 41 Reputation points Microsoft External Staff

2026-06-24T23:48:38.26+00:00
The exact error message or screenshot received while creating the Linked Service. Attached

Whether AME refers to Access Management for Enterprise or another service/tool being used for authentication. AME refers to AME domain

The authentication method being used (Managed Identity, Service Principal, SQL Authentication, etc.). As per attached screenshot it is Managed Identity

Whether you are creating the Linked Service from Azure Data Factory Studio or through ARM/Bicep/Terraform deployment. Azure Data Factory Studio

Whether the target Azure SQL Database is publicly accessible or configured with a private endpoint/firewall restriction. Please the attached screenshot

A screenshot of the Linked Service configuration page (excluding any sensitive information). Attached
Hemant 41 Reputation points Microsoft External Staff

2026-06-25T00:52:42.4533333+00:00

I am using Managed Identity authentication and as per below ADF was added. However, still ADF Linked Service is failing.
Hemant 41 Reputation points Microsoft External Staff

2026-06-25T05:26:47.11+00:00

after granting db_owner, connection succeeds. So, I think I should keep it.

4 answers

Your answer

Hemant 41 Reputation points Microsoft External Staff

2026-06-24T23:48:38.26+00:00

The exact error message or screenshot received while creating the Linked Service. Attached

Whether AME refers to Access Management for Enterprise or another service/tool being used for authentication. AME refers to AME domain

The authentication method being used (Managed Identity, Service Principal, SQL Authentication, etc.). As per attached screenshot it is Managed Identity

Whether you are creating the Linked Service from Azure Data Factory Studio or through ARM/Bicep/Terraform deployment. Azure Data Factory Studio

Whether the target Azure SQL Database is publicly accessible or configured with a private endpoint/firewall restriction. Please the attached screenshot

A screenshot of the Linked Service configuration page (excluding any sensitive information). Attached
Hemant 41 Reputation points Microsoft External Staff

2026-06-25T00:52:42.4533333+00:00

I am using Managed Identity authentication and as per below ADF was added. However, still ADF Linked Service is failing.
Hemant 41 Reputation points Microsoft External Staff

2026-06-25T05:26:47.11+00:00

after granting db_owner, connection succeeds. So, I think I should keep it.

Answer 1

Hi @Hemant
Thank you for confirming and for sharing the additional screenshots.

I can see that you have already:

Verified the System-assigned Managed Identity is enabled.
Recreated the database user using CREATE USER ... FROM EXTERNAL PROVIDER.
Granted the required database permissions.
Confirmed that the Managed Identity Object ID matches the database user.

Since the linked service is still failing with "Login failed for user '<token-identified principal>'", could you please verify the following:

Confirm that a Microsoft Entra ID administrator is configured on the Azure SQL logical server.
Verify that the database user has been created in WACAPAutomationDB (the target database) and not only in the master database.
As a test, temporarily add the managed identity to the db_owner role and retry creating the linked service. If the connection succeeds, it would indicate that the issue is permission-related.

Please let us know the results of these checks, and we'll continue to assist further.

Answer 2

Hemantkumar Prajapati (v-hepraj) 0

I am using Managed Identity authentication and as per below ADF was added. However, still ADF Linked Service is failing.
User's image

Ravi Kiran Pagidi 90 Reputation points

2026-06-25T00:50:06.3666667+00:00
Hi Hemant,

From the screenshot, the database user WACAP-ADF does exist in the target database as an EXTERNAL_USER, so the basic SQL user creation step looks completed.

If the linked service is still failing, I would check these next:

Make sure the linked service is using the same managed identity that was added in SQL.

If you selected system-assigned managed identity, the SQL user should be for the ADF resource name.

If you selected user-assigned managed identity / credential, the SQL user must be created for that user-assigned identity, not the ADF name.

Confirm the user was created in the same database used in the linked service test connection, not only in master.

Check the network path:

If Azure SQL public access is disabled, use Managed VNet + managed private endpoint.

Make sure the private endpoint is approved on the SQL Server side.

If public access is enabled, confirm firewall rules allow the Integration Runtime path.

Try granting explicit connect permission:

GRANT CONNECT TO [WACAP-ADF];

Please share the exact linked service test connection error. If the error says Login failed for user '<token-identified principal>', it is usually identity/database permission. If it says timeout or cannot reach server, it is usually networking/private endpoint/firewall.
Hemant 41 Reputation points Microsoft External Staff

2026-06-25T00:55:15.9+00:00

below is the error message.
Ravi Kiran Pagidi 90 Reputation points

2026-06-25T01:20:56.29+00:00
Hi Hemant,

Yes, please double-check the system-assigned managed identity mapping.

In the linked service screenshot, ADF is using System-assigned managed identity for WACAP-ADF. That means the database user must be created for the exact system-assigned identity object of that Data Factory.

A few things to verify:

Go to Data Factory > Managed identities and confirm the system-assigned identity is enabled.

Compare the ADF managed identity Object ID shown in ADF with the SQL user SID. If the Data Factory was deleted/recreated earlier, the name can remain the same but the managed identity object ID changes.

If there is any doubt, drop and recreate the database user in the target database:

DROP USER [WACAP-ADF]; GO CREATE USER [WACAP-ADF] FROM EXTERNAL PROVIDER; GO ALTER ROLE db_datareader ADD MEMBER [WACAP-ADF]; ALTER ROLE db_datawriter ADD MEMBER [WACAP-ADF]; GRANT CONNECT TO [WACAP-ADF]; GO

Make sure this is done in WACAPAutomationDB, not only in master.

Also confirm the Azure SQL logical server has a Microsoft Entra admin configured.

If you are using system-assigned managed identity, do not create the SQL user for a user-assigned managed identity or another service principal. The linked service and SQL database user must point to the same identity.

Yes, please double-check the system-assigned managed identity mapping.

In the linked service screenshot, ADF is using System-assigned managed identity for WACAP-ADF. That means the database user must be created for the exact system-assigned identity object of that Data Factory.

A few things to verify:

Go to Data Factory > Managed identities and confirm the system-assigned identity is enabled.

Compare the ADF managed identity Object ID shown in ADF with the SQL user SID. If the Data Factory was deleted/recreated earlier, the name can remain the same but the managed identity object ID changes.

If there is any doubt, drop and recreate the database user in the target database:

DROP USER [WACAP-ADF]; GO CREATE USER [WACAP-ADF] FROM EXTERNAL PROVIDER; GO ALTER ROLE db_datareader ADD MEMBER [WACAP-ADF]; ALTER ROLE db_datawriter ADD MEMBER [WACAP-ADF]; GRANT CONNECT TO [WACAP-ADF]; GO

Make sure this is done in WACAPAutomationDB, not only in master.

Also confirm the Azure SQL logical server has a Microsoft Entra admin configured.

If you are using system-assigned managed identity, do not create the SQL user for a user-assigned managed identity or another service principal. The linked service and SQL database user must point to the same identity.
Hemant 41 Reputation points Microsoft External Staff

2026-06-25T01:33:39.2633333+00:00

I

I am using System Assigned and dropped and re-created the user in SQL. Sill not working, Can you please ping in Teams chat to solve this?

Answer 3

Hi @Hemant

Thank you for reaching out. To investigate this further, could you please provide the following details:

The exact error message or screenshot received while creating the Linked Service.
Whether AME refers to Access Management for Enterprise or another service/tool being used for authentication.
The authentication method being used (Managed Identity, Service Principal, SQL Authentication, etc.).
Whether you are creating the Linked Service from Azure Data Factory Studio or through ARM/Bicep/Terraform deployment.
Whether the target Azure SQL Database is publicly accessible or configured with a private endpoint/firewall restrictions.
A screenshot of the Linked Service configuration page (excluding any sensitive information).

Additionally, please verify that:

The Data Factory managed identity or AME identity has the required permissions on the Azure SQL database.
Firewall settings on Azure SQL allow connections from Azure services (if applicable).
Any private endpoint, DNS, or network configuration is correctly configured.

Once you share the error details and configuration information, we can help narrow down the root cause.

Answer 4

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more