Could you please explain step by step guide for below question.

Kumarswami Mahantinamath 0 Reputation points
2026-07-15T12:53:38.8566667+00:00

Transition your Azure Synapse Analytics workspaces to private links before 1 August 2026

You're receiving this email because you're using one or more Azure products with a managed identity and firewall exception for trusted services.

As part of a security update, the trusted services function allowing Azure Synapse Analytics to access Azure Storage accounts and Azure Key Vault using a managed identity and firewall exception will be retired on 1 August 2026.

Before that date, you'll need to transition your Azure Synapse Analytics workspaces to private links if you're using them to access either:

An Azure Storage account with a system-assigned managed identity and storage firewall exception.

An Azure Key Vault with a system- or user-assigned managed identity and key vault firewall exception.

Private links allow you to access your Azure Storage accounts and Azure Key Vault from a managed virtual network using private endpoints.

If you don't transition to private links, you won't be able to use workspaces to gain access.

If you've already transitioned, no further action is required.

Required action

To avoid service disruptions, transition your Azure Synapse Analytics workspaces to private links before 1 August 2026.

Help and support

If you have questions, get answers from community experts in Microsoft Q&A. If you have a support plan and you need technical help, open the Azure portal and select the question mark icon at the top of the page.

Azure Synapse Analytics
Azure Synapse Analytics

An Azure analytics service that brings together data integration, enterprise data warehousing, and big data analytics. Previously known as Azure SQL Data Warehouse.

0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pilladi Padma Sai Manisha 11,605 Reputation points Microsoft External Staff Moderator
    2026-07-15T21:15:25.0766667+00:00

    Hi @Kumarswami Mahantinamath

    The email is notifying you of a security change in Azure Synapse Analytics.

    Starting August 1, 2026, Azure Synapse will no longer be able to access Azure Storage or Azure Key Vault by relying on Managed Identity together with the "Allow trusted Microsoft services" firewall exception. Instead, connectivity must use Managed Virtual Network (Managed VNet) and Managed Private Endpoints (Private Link).

    Step 1 – Determine whether you're affected

    Your workspace is affected if it uses a Managed Identity to access an Azure Storage account or Azure Key Vault that has firewall restrictions enabled and currently relies on the "Allow trusted Microsoft services" firewall exception. If your workspace already uses Managed Private Endpoints, no further action is required.

    Step 2 – Verify whether your workspace uses a Managed Virtual Network

    Open the Azure portal and navigate to your Synapse workspace. Check whether Managed Virtual Network is enabled.

    Important: Managed Virtual Network is selected when the workspace is created and cannot be enabled later. If your existing workspace was created without Managed VNet, you'll need to create a new Synapse workspace with Managed VNet enabled and migrate your Synapse artifacts.

    Step 3 – Create Managed Private Endpoints

    Open Synapse Studio, go to Manage > Managed private endpoints, and select + New. Create Managed Private Endpoints for your Azure Storage account (Blob/Data Lake Gen2) and Azure Key Vault, then wait for the endpoint requests to be created.

    Step 4 – Approve the Private Endpoint connections

    Open each Azure Storage account and Azure Key Vault in the Azure portal, navigate to Networking > Private endpoint connections, locate the pending connection request from the Synapse workspace, and approve it.

    Step 5 – Validate connectivity

    After the connections are approved, test your linked services and run a pipeline or notebook to verify that Synapse can successfully access Azure Storage and retrieve secrets from Azure Key Vault. Once validation is complete, the workspace no longer depends on the Trusted Microsoft Services firewall exception.

    If your workspace doesn't use Managed VNet

    If your workspace was created without Managed VNet, create a new Synapse workspace with Managed Virtual Network enabled, migrate your Synapse artifacts (such as pipelines, notebooks, SQL scripts, and linked services), recreate the Managed Private Endpoints, and validate the new workspace before the retirement date.

    For more information, refer to the Azure Synapse documentation on Managed Virtual Networks and Managed Private Endpoints.

    Was this answer helpful?

  2. Jose Benjamin Solis Nolasco 9,891 Reputation points Volunteer Moderator
    2026-07-15T14:52:21.83+00:00

    Welcome to Microsoft Q&A

    Hello @Kumarswami Mahantinamath I hope you are doing well.

    The email is informing you about an upcoming security change. Starting August 1, 2026, Azure Synapse Analytics will no longer be able to access Azure Storage Accounts or Azure Key Vault using only a managed identity together with the "Allow trusted Microsoft services" firewall exception.

    If your Synapse workspace currently relies on this configuration, you'll need to migrate to Managed Virtual Network (Managed VNet) with Managed Private Endpoints (Private Link).

    References

    If your answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions

    Was this answer helpful?

  3. AI answer

    2026-07-15T12:54:26.36+00:00

    Use this path if the workspace is affected by the retirement of the trusted services firewall exception.

    1. Confirm the workspace is in scope The change mainly affects Synapse workspaces that access Azure Storage or Azure Key Vault by using a managed identity together with the trusted-services/firewall-exception model. Check:
      • Whether the Synapse workspace uses managed identity
      • Storage account networking settings
      • Key Vault networking settings
      • Whether trusted Microsoft services access is enabled
      • Whether private endpoints are already configured
      If private endpoints are already implemented between Synapse and the dependent resources, no additional migration is typically required.
    2. Check whether the current workspace can use managed private endpoints Managed private endpoints are supported only in Azure Synapse workspaces that use a Managed workspace Virtual Network. If the workspace was created without a managed virtual network, it can't be enabled or changed later. In that case, create a new Synapse workspace with a managed virtual network and plan to migrate workloads to it.
    3. Create a Synapse workspace with a managed virtual network A managed virtual network is required to use managed private endpoints.
    4. Create managed private endpoints from Synapse to dependent resources Create a managed private endpoint for the storage account (ADLS Gen2). This replaces the trusted services firewall exception with a private connection. Managed private endpoints:
      • Are created inside the Managed Virtual Network associated with the Synapse workspace
      • Send traffic over the Microsoft backbone network
      • Are created in a Pending state first
      • Must be approved by the owner of the target private link resource before traffic can flow
      After creation, make sure the private endpoint connection is approved.
    5. Enable the required network settings For Azure Synapse Link for Dataverse, both of these settings must be enabled for successful connection:
      • On the storage account: Networking > Firewalls and virtual networks > enable Allow Azure services and resources to access this storage account
      • On the Synapse workspace: Networking > enable Allow Azure services and resources to access this workspace
    6. If creating a private endpoint to the Synapse workspace itself, follow the portal flow In Azure portal:
      • Open the subscription and make sure the Microsoft.Network resource provider is registered
      • If the private endpoint is created from a different subscription, also register Microsoft.Synapse in the subscription hosting the private endpoint
      • Open the Synapse workspace
      • Go to Security > Private endpoint connections
      • Select + Private endpoint
      • On Basics, choose Subscription, Resource Group, Name, and Region
      • On Resource, select Connect to an Azure resource in my directory
      • Select the subscription containing the Synapse workspace
      • Select resource type Microsoft.Synapse/workspaces
      • Select the workspace resource
      • Choose the target sub-resource:
        • Sql for dedicated SQL pools
        • SqlOnDemand for built-in serverless SQL pool
        • Dev for other Synapse workspace access
      • On Configuration, select the Virtual network and Subnet
      • Select Yes for Integrate with private DNS zone
      • Complete Review + create
      • After deployment, verify the new connection under Private endpoint connections
    7. If access to Synapse Studio is needed from a restricted network, use a private link hub For Synapse Studio, create:
      • An Azure Synapse private link hub
      • A private endpoint from the virtual network to that hub
      This is specifically for securely loading Synapse Studio content. Separate private endpoints are still required for workspace resources such as SQL pools or Spark pools.
    8. If the environment is on a restricted network, add required outbound rules Add outbound security rules for these service tags:
      • AzureResourceManager
      • AzureFrontDoor.Frontend
      • AzureActiveDirectory
      • AzureMonitor (optional, only when sharing data with Microsoft)
    9. Validate the final state Confirm that:
      • The workspace uses a Managed Virtual Network
      • Managed private endpoints exist for required resources
      • Private endpoint connections are approved
      • Required DNS integration is configured where applicable
      • The old trusted-services dependency is no longer the access path
    10. Scope clarification Based on the available guidance:
    • The retirement is focused on Synapse access to Azure Storage and Azure Key Vault through managed identity plus trusted-services firewall exception
    • Environments where Storage or Key Vault are fully open to public network access are not the primary scenarios impacted
    • Azure SQL Database isn't covered by this specific retirement

    Important: Changing firewall or network settings can remove access for legitimate clients if the private-link path is not fully ready. Approve private endpoint connections and validate connectivity before tightening public access.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.