Which scope to use with OAuth to MS Fabric

Question

Question:

We are using OAuth authentication to a data source in MS Fabric

we have an application in our Entra ID tenant.

When using the scope https://sql.azuresynapse-dogfood.net/user_impersonation , authentication fails with error:

Internal Error SQLDriverConnect: [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Could not login because the authentication failed.

Note that this scope works OK for data source outside MS Fabric.

When using the scope https://database.windows.net/user_impersonation, authentication works OK.

Is that expected behavior? Are these two scopes interchangeable?

Answer 1

Hi AYX Dynamo,

Thank you for posting your query on Microsoft Q&A. I am Saiteja from Q&A will be assisting you with your query.

Based on your query, here is my understanding: You are trying to integrate the OAuth authentication with MS Fabric.

I would like to inform you the scope you are trying is to retrieve the access token for SQL database. This scope actually works to retrieve the token when you are using On-behalf-of flow authentication.

You can refer this document for the configuration of your application.

In short, this scope: https://database.windows.net/user_impersonation, used for Azure SQL database that too with Azure App service as documented here and this scope: https://sql.azuresynapse-dogfood.net/user_impersonationused for Azure Synapse and Azure SQL database if you are configuring with SPA client and Web API.

If the answer is helpful, please click "Accept Answer" and kindly "upvote it". If you have extra questions about this answer, please click "Comment".