how to Restrict public network access to azure Data Lake with private endpoint?

Question

how to Restrict public network access to azure Data Lake with private endpoint?

Taniya Das (INFOSYS LIMITED) 0 Microsoft External Staff

AuthorizationFailure (403) when Synapse tries to access the storage account — both when browsing in Synapse Studio and when testing via Azure CLI using our own (Owner-level) identity, and even via a pipeline run

how do we implement it then for this issue can anyone suggest on this how to resolve this AuthorizationFailure(403) from synapse adls added the screenshot?

Note: Granted Storage Blob Data Contributor role to the Synapse managed identity on the storage account also having owner role.

0 comments

1 answer

Your answer

Answer 1

Taniya Das (INFOSYS LIMITED) hi, thx for sharing urs issue here at Q&A portal,

Owner won’t help for reading ADLS data. Owner is management-plane. For files/ blobs u still need data-plane RBAC like Storage Blob Data Contributor, plus the network path has to go thru the private endpoint. If public access is disabled and Synapse is outside the storage VNet path, u’ll get 403 even with roles. So this is usually either RBAC identity mismatch or private endpoint/DNS issue.

For Synapse, make sure the role is assigned to the exact identity doing the access: Synapse workspace managed identity for pipelines/linked services, or ur own Entra user if u browse from Studio. Sometimes ppl grant the MI but test with their own user, or the other way around. Classic Azure trap.

See if the storage private endpoints. For ADLS Gen2 u normally need private endpoint/DNS for dfs and often blob too

privatelink.dfs.core.windows.net

privatelink.blob.core.windows.net

From Synapse side, the storage account name must resolve to the private IP, not public. If u use Synapse managed VNet, create a managed private endpoint from Synapse to the storage account and approve it on the storage side.

https://learn.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-managed-private-endpoints

https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

Quick way to narrow it down is temporarily allow selected networks / trusted services and test again. If it starts working, RBAC is likely ok and the issue is private endpoint/DNS. If it still fails, look at RBAC/ACLs.

if hierarchical namespace is enabled, POSIX ACLs can still block access even when RBAC is right. Check folder /file ACLs on the container path too.

rgds,

Alex

&

If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal

Taniya Das (INFOSYS LIMITED) 0 Reputation points Microsoft External Staff

2026-06-25T12:31:09.3733333+00:00

Hi @Alex Burlachenko ,
Thank you for the guidance.
here what I have done till now
Created a Private Endpoint on storage account, sub-resource dfs and blob, connected to existing VNet — connection state: Approved

Disabled public network access on the storage account, with "Allow trusted Microsoft services" exception enabled

Granted Storage Blob Data Contributor role to the Synapse managed identity on the storage account

Added POSIX ACLs (Read + Execute) on the container for the same managed identity

Added storage account as a Resource Instance in the storage account's network rules (Trusted Workspace Access)

Verified the managed identity Object ID matches exactly between Synapse and the IAM role assignment

After doing all these still getting this

AuthorizationFailure (403) when Synapse tries to access the storage account — both when browsing in Synapse Studio and when testing via Azure CLI using our own (Owner-level) identity

Synapse workspace does not have Managed Virtual Network enabled, the workspace's Networking blade shows only Firewall rules, with no "Managed virtual network" section; "Managed private endpoints" is also greyed out in Synapse Studio)