Invalid user assigned managed identycredential

Question

Invalid user assigned managed identycredential

Atul kumar 20

Hi All,

I am creating linked service connecting to dataverse using user managed identity via credentials and it is working fine while doing test connections but I got issue while publishing Linked Service & Credential.

Error code: OK

Inner error code: InvalidUserAssignedMiCredential

Message: The referenced user assigned managed identity in the credential is not associated with the factory. Credential name: XXXXXX, Managed identity resource id: @{parameters('XXXXXXX')}

I just created Linked service using credentials as User assigned managed identity and provided UAMI name using parameters so that it can be working in all the environments.

I can test in Azure Portal and Linked Service is connecting successfully but while publishing in main branch it is failing publish and giving above error.

I am using Azure synapse for this. any help will be helpful !!

Script for Credential:

{

Copy

"name": "Name",

"properties": {

	"type": "ManagedIdentity",

	"typeProperties": {

		"resourceId": "@{parameters('parameterName')}"

	}

},

"parameters": {

	"parameterName": {

	"type": "string",

	"defaultValue": "/subscriptions/../resourcegroups/../providers/Microsoft.ManagedIdentity/userAssignedIdentities/.."
}
}
}

Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-08T08:28:50.0766667+00:00

Hi @Atul kumar ,

Welcome to the Microsoft Q&A Platform.

Test succeeds under your user, but publish validates with the Synapse/ADF identity, so the UAMI in the Credential must be attached to the workspace/factory.

Go to Synapse/ADF → Identity → User assigned → Add the exact UAMI, then ensure the Credential’s typeProperties.resourceId exactly matches that ARM ID.

Give that UAMI the required RBAC/permissions on the target (e.g., Dataverse/Key Vault), Save and Publish again.

If you have any further questions, feel free to respond in this same thread.
Atul kumar 20 Reputation points

2025-09-08T10:41:19.0533333+00:00
Hi Team,

First of all thanks for your quick reply !!

Now, I would like to provide more information on my scenario,

I have created Linked Service and json is as below:

{ "name": "xxxxx", "properties": { "parameters": { "dataverseUri": { "type": "string", "defaultValue": "https://xxxxxxxxx.com/" } }, "annotations": [], "type": "CommonDataServiceForApps", "typeProperties": { "deploymentType": "Online", "serviceUri": "@{linkedService().dataverseUri}", // This is to make serviceUrl parametrized so that it can change based on environment. "authenticationType": "ManagedIdentity", "credential": { "referenceName": "abcCredential", "type": "CredentialReference" } }, "connectVia": { "referenceName": "AutoResolveIntegrationRuntime", "type": "IntegrationRuntimeReference" } } }

This is working fine and able to publish synapse workspace.

Question here - When I published and checked workspace_publish branch (templateforworkspace.json) I don't see Parameter created. I can see my past Linked service Parameters created by its own in template.json by own or after publish for example SQL Server user name, db name etc but for Dataverse linked service I don't see parameter is creating.

I have checked other solutions using ADF or Factory, these parameters auto generate in ARM templat.json after publishing but why this is not happening for Synapse workspace.

Is this functionality not available in Azure Synapse for Dataverse Linked Service?

Next Question - When I create Credential I have provided credential details hard code which is from DEV and able to publish synapse workspace without any error that means UAMI name is properly added in Synapse workspace & RBAC are also maintained. but when I use Parameter in Credential as Credential Name will same across environment but inside the Ids will be different then while publishing it is giving the error as :

Error code: OK

Inner error code: InvalidUserAssignedMiCredential

Message: The referenced user assigned managed identity in the credential is not associated with the factory. Credential name: abcCredential, Managed identity resource id: @{parameters('DataverseCredentialResourceId')}

Credential Json:

{ "name": "D365CredentialNew", "properties": { "type": "ManagedIdentity", "typeProperties": { "resourceId": "@{parameters('DataverseCredentialResourceId')}" } }, "parameters": { " DataverseCredentialResourceId ": { "type": "string", "defaultValue": "/subscriptions/xxx/resourcegroups/xxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/xxxxxx" } } }

For making Credential successfully publish is above syntax or script is causing problem?

Looking forward for your suggestions and again would like to thanks for your help & support !!

Kindly inform in case more information is required.

Thanks

Atul Kumar
Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-08T14:35:11.9933333+00:00
Hi Atul kumar,

Yes, you're right azure synapse does not auto-generate parameters for Dataverse Linked Services in json like ADF does.

You need to manually define parameters in your templates or use variables to handle environment-specific values.

The error occurs because the parameterized resourceId is not resolving to a valid UAMI attached to the Synapse workspace.

Ensure the UAMI is explicitly attached to the workspace.

Ensure credential referenceName matches the credential name exactly.

Provide correct per-environment values for resourceId (e.g., DEV, TEST, PROD).

if needed do clean up the parameter key, remove spaces, newlines, or comments from "DataverseCredentialResourceId".
Atul kumar 20 Reputation points

2025-09-08T15:09:25.63+00:00
Hi Team,

Thanks for your response !!

May I ask few questions on below:

Yes, you're right azure synapse does not auto-generate parameters for Dataverse Linked Services in json like ADF does. My Comments: Thanks !!

You need to manually define parameters in your templates or use variables to handle environment-specific values. My Comments: When you say manually define parameters in template then which template you are referring? I have updated workspace_publish branch templates (TemplateForWorkspace.Json & TemplatesForParameters.Json) but whenever I am publishing all the parameters I created manually vanishing or re-setting. I am trying your suggestion of using variables and share the progress.

The error occurs because the parameterized resourceId is not resolving to a valid UAMI attached to the Synapse workspace. My Comments: I am using complete id in format as "/subscriptions/xxx/resourcegroups/xxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/xxxxxx" } in Credential Json as a default value of parameter but still it is asking for Error Code - InvalidUserAssignedMiCredential.

Ensure the UAMI is explicitly attached to the workspace. My Comments: Sure !!

Ensure credential referenceName matches the credential name exactly. My Comments: Sure !!

Provide correct per-environment values for resourceId (e.g., DEV, TEST, PROD). My Comments: Sure !!

if needed do clean up the parameter key, remove spaces, newlines, or comments from "DataverseCredentialResourceId".My Comments: Sure !!

Once again thanks for your help & support !!

Regards

Atul Kumar
Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-08T17:22:53.3566667+00:00
Hi Atul kumar,

"Which template should I edit? My manual params vanish on publish.”

Don’t edit anything inside workspace_publish/*; those files are regenerated.

Synapse regenerates these on every publish and will overwrite your changes.

Keep per-environment parameter files outside workspace_publish (e.g., cicd/params/dev.parameters.json, test.parameters.json, prod.parameters.json) and reference them at deploy time.
TemplateFile: workspace_publish/TemplateForWorkspace.json
ParametersFile: your custom params file (per env)
Or
use an inline override: -DataverseCredentialResourceId "<ARM ID>"

now params won’t “vanish,” because we are not editing the generated files

for more info, please refer to this.

“I used the full ARM ID but still get InvalidUserAssignedMiCredential”

Even with the correct ARM ID, Publish can still fail with InvalidUserAssignedMiCredential if the resolved UAMI isn’t attached to the target workspace or there’s a parameter/name mismatch. Attach that UAMI and ensure per-environment values are supplied at deploy (via your params file or overrides).

Atul kumar 20

Hi Team,

Thanks for your response !!

Please find steps that I followed and current status:

Step 1 - I have created template.json file in new folder in my feature branch of synapse named infra and it looks like infra/template.json and included Linked Service & Credential details.

{
	"$schema": "http://schema.management.azure.com/schemas/2015-01-
01/deploymentTemplate.json#",
	"contentVersion": "1.0.0.0",
	"parameters": {
		"workspaceName": {
			"type": "string",
			"metadata": "Workspace name",
			"defaultValue": "abc"
		},
		"DataverseUrl_connectionString": {
			"type": "String",
			"metadata": "String for serviceUri for Dataverse",
			"defaultValue": "https://abc.com/"
		},
		"DataverseCredentialResourceId_connectionString": {
			"type": "String",
			"metadata": "String for resource Id required for UAMI",
			"defaultValue": "/subscriptions/../resourcegroups/../providers/Microsoft.ManagedIdentity/userAssignedIdentities/..."
		}
        },
        "variables": {
		"workspaceId": "[concat('Microsoft.Synapse/workspaces/', parameters('workspaceName'))]"
	    },

        "resources": [
		{
            "name": "[concat(parameters('workspaceName'), '/abcCredential')]",
			"type": "Microsoft.Synapse/workspaces/credentials",
			"apiVersion": "2019-06-01-preview",
            "dependsOn": [],
			"properties": {
				"description": "This is created to connect with data verse systems.",
				"type": "ManagedIdentity",
				"typeProperties": {
					"resourceId": "[parameters('DataverseCredentialResourceId_connectionString')"
				}
			}
        },
        {
        "name": "[concat(parameters('workspaceName'), '/Dataverse')]",
			"type": "Microsoft.Synapse/workspaces/linkedServices",
			"apiVersion": "2019-06-01-preview",
            "dependsOn": [
				"[concat(variables('workspaceId'), '/integrationRuntimes/AutoResolveIntegrationRuntime')]",
				"[concat(variables('workspaceId'), '/credentials/abcCredential')]"
			],
			"properties": {
				"description": "This is for building connection between Dataverse and EDAP.",
				"annotations": [],
				"type": "CommonDataServiceForApps",
				"typeProperties": {
					"deploymentType": "Online",
					"serviceUri": "[parameters('DataverseUrl_connectionString')",
					"authenticationType": "ManagedIdentity",
					"credential": {
						"referenceName": "abcCredential",
						"type": "CredentialReference"
					}
				},
				"connectVia": {
					"referenceName": "AutoResolveIntegrationRuntime",
					"type": "IntegrationRuntimeReference"
				}
			}
        }
        ]
    
}

Step 2 - Then I added into cd.yml parameters (serviceUri, Credential Name) based on stage (Test/UAT/Prod)

Step 3 - Then I have added deploy-stage.yml for calling template I have created for LS + Credential	as below:


# Deploy Dataverse LS & Credential
- task: AzureResourceManagerTemplateDeployment@3
  displayName: 'Deploy Dataverse LinkedService + Credential'
  inputs:
    deploymentScope: 'Resource Group'
    ArtifactsFolder: '$(Pipeline.Workspace)/drop_synapse'
    azureSubscription: '${{ parameters.serviceConnectionName }}'
    ResourceGroupName: '${{ parameters.DeploymentResourceGroupName }}'
    TargetWorkspaceName: '${{ parameters.TargetWorkspaceName }}'
    templateLocation: 'Linked artifact'
    csmFile: '$(Pipeline.TargetWorkspaceName)/drop_synapse/infra/template.json'
    deploymentMode: Incremental
    OverrideArmParameters: |
      workspaceName: '${{ parameters.TargetWorkspaceName }}'
      DataverseUrl_connectionString: '${{ parameters.dataverseUri }}'
      DataverseCredentialResourceId_connectionString: '${{ parameters.DataverseCredentialResourceId }}'										


But when I do the deployment, before this task Synapse workspace deployment starts which have workspace_publish >> TemplatesForWorkspace.json that have LS + Credential details hard coded coming from synapse studio and failing the deployment with same error as:
The referenced user assigned managed identity in the credential is not associated with the factory.

Question 1 - When I publish in Main branch infra/template.json doesnt updated Workspace_publish>>TemplateforWorkspace.Json with Parameter format for LS + Credential.

Question 2 - If I can skip Credential + LS in synapse workspace deployment so that it will not try to create using hard code value and next task which is calling custom template will work?
If so, could you help me with Skip command that I can use.

Or, kindly guide me if I am missing some element here !!

Once again thanks for your help & support !!

Regards
Atul Kumar

Atul kumar 20

Hi Team,

Thanks for your response !!

Please find steps that I followed and current status:

Step 1 - I have created template.json file in new folder in my feature branch of synapse named infra and it looks like infra/template.json and included Linked Service & Credential details.

JSONCopy

{
	"$schema": "http://schema.management.azure.com/schemas/2015-01-
01/deploymentTemplate.json#",
	"contentVersion": "1.0.0.0",
	"parameters": {
		"workspaceName": {
			"type": "string",
			"metadata": "Workspace name",
			"defaultValue": "abc"
		},
		"DataverseUrl_connectionString": {
			"type": "String",
			"metadata": "String for serviceUri for Dataverse",
			"defaultValue": "https://abc.com/"
		},
		"DataverseCredentialResourceId_connectionString": {
			"type": "String",
			"metadata": "String for resource Id required for UAMI",
			"defaultValue": "/subscriptions/../resourcegroups/../providers/Microsoft.ManagedIdentity/userAssignedIdentities/..."
		}
        },
        "variables": {
		"workspaceId": "[concat('Microsoft.Synapse/workspaces/', parameters('workspaceName'))]"
	    },

        "resources": [
		{
            "name": "[concat(parameters('workspaceName'), '/abcCredential')]",
			"type": "Microsoft.Synapse/workspaces/credentials",
			"apiVersion": "2019-06-01-preview",
            "dependsOn": [],
			"properties": {
				"description": "This is created to connect with data verse systems.",
				"type": "ManagedIdentity",
				"typeProperties": {
					"resourceId": "[parameters('DataverseCredentialResourceId_connectionString')"
				}
			}
        },
        {
        "name": "[concat(parameters('workspaceName'), '/Dataverse')]",
			"type": "Microsoft.Synapse/workspaces/linkedServices",
			"apiVersion": "2019-06-01-preview",
            "dependsOn": [
				"[concat(variables('workspaceId'), '/integrationRuntimes/AutoResolveIntegrationRuntime')]",
				"[concat(variables('workspaceId'), '/credentials/D365Credential')]"
			],
			"properties": {
				"description": "This is for building connection between Dataverse and EDAP.",
				"annotations": [],
				"type": "CommonDataServiceForApps",
				"typeProperties": {
					"deploymentType": "Online",
					"serviceUri": "[parameters('DataverseUrl_connectionString')",
					"authenticationType": "ManagedIdentity",
					"credential": {
						"referenceName": "abcCredential",
						"type": "CredentialReference"
					}
				},
				"connectVia": {
					"referenceName": "AutoResolveIntegrationRuntime",
					"type": "IntegrationRuntimeReference"
				}
			}
        }
        ]
    
}

Copy

Step 2 - Then I added into cd.yml parameters (serviceUri, Credential Name) based on stage (Test/UAT/Prod)

Step 3 - Then I have added deploy-stage.yml for calling template I have created for LS + Credential	as below:

YAMLCopy


# Deploy Dataverse LS & Credential
- task: AzureResourceManagerTemplateDeployment@3
  displayName: 'Deploy Dataverse LinkedService + Credential'
  inputs:
    deploymentScope: 'Resource Group'
    ArtifactsFolder: '$(Pipeline.Workspace)/drop_synapse'
    azureSubscription: '${{ parameters.serviceConnectionName }}'
    ResourceGroupName: '${{ parameters.DeploymentResourceGroupName }}'
    TargetWorkspaceName: '${{ parameters.TargetWorkspaceName }}'
    templateLocation: 'Linked artifact'
    csmFile: '$(Pipeline.TargetWorkspaceName)/drop_synapse/infra/template.json'
    deploymentMode: Incremental
    OverrideArmParameters: |
      workspaceName: '${{ parameters.TargetWorkspaceName }}'
      DataverseUrl_connectionString: '${{ parameters.dataverseUri }}'
      DataverseCredentialResourceId_connectionString: '${{ parameters.DataverseCredentialResourceId }}'										


But when I do the deployment, before this task Synapse workspace deployment starts which have workspace_publish >> TemplatesForWorkspace.json that have LS + Credential details hard coded coming from synapse studio and failing the deployment with same error as:
The referenced user assigned managed identity in the credential is not associated with the factory.

Question 1 - When I publish in Main branch infra/template.json doesnt updated Workspace_publish>>TemplateforWorkspace.Json with Parameter format for LS + Credential.

Question 2 - If I can skip Credential + LS in synapse workspace deployment so that it will not try to create using hard code value and next task which is calling custom template will work?
If so, could you help me with Skip command that I can use.

Or, kindly guide me if I am missing some element here !!

Once again thanks for your help & support !!

Regards
Atul Kumar

Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-10T08:03:28.71+00:00

Thank you for providing additional details. I’ll get back to you with updates as soon as possible.
Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-12T07:31:46.86+00:00
Hi Atul kumar,
From what I’ve gathered, here’s what we’ve completed so far

Created a custom ARM template (infra/template.json) containing Linked Service and Credential definitions.

Added environment-specific parameters in cd.yml.

Created a deployment task in deploy-stage.yml to deploy LS + Credential using that template.

Encountered deployment failure because the Synapse workspace deployment (using workspace_publish/TemplateForWorkspace.json) includes hardcoded LS + Credential values from Synapse Studio.

Error Message

InvalidUserAssignedMiCredential — The referenced user assigned managed identity in the credential is not associated with the factory.

Question 1: Why infra/template.json Doesn’t Update TemplateForWorkspace.json

Synapse does not read or merge your custom infra/template.json during publish. It only uses:

Artifacts defined in Synapse Studio.

A special file called template-parameters-definition.json (if present at repo root).

So, even if your custom template has correct parameterization, it will not affect the generated TemplateForWorkspace.json.

To make Synapse generate parameterized LS + Credential entries:

Create a file at the root of your repo named template-parameters-definition.json.

Add this content:

{ "linkedService": { "Dataverse": { "properties": { "typeProperties": { "serviceUri": { "type": "String", "defaultValue": "" } } } } }, "credential": { "abcCredential": { "properties": { "typeProperties": { "resourceId": { "type": "String", "defaultValue": "" } } } } } }

Replace "Dataverse" and "abcCredential" with your actual artifact names.

Republish from Synapse Studio — this will regenerate TemplateForWorkspace.json with parameter placeholders.

Question 2: Can You Skip LS + Credential in Synapse Workspace Deployment?

Yes, you can skip deploying LS + Credential in the Synapse workspace deployment by removing them from Synapse Studio before publishing.

Delete LS + Credential from Synapse Studio in your dev workspace.

Republish — this ensures TemplateForWorkspace.json no longer includes them.

In your pipeline, DeleteArtifactsNotInTemplate: false

if you still facing issue, please provide detail in private message or If you have any further questions, feel free to respond in this same thread.
Atul kumar 20 Reputation points

2025-09-19T08:06:25.78+00:00

Hi Team,

This solution doesn't work and I didn't get parameters for Dataverse linked service & credentials parameters.

Kindly provide solution in more details or let me know in case I missed something.

Thanks
Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-29T20:33:43.3566667+00:00
Hi Atul kumar,

Thanks for the information you've shared so far. To help narrow things down without revisiting the basics, could you please provide more detailed input if possible? Also, it would be helpful if you could pinpoint the specific issue. Kindly check your private message as well.

Where exactly it fails

Is this Synapse or ADF? Is Git mode on (repo/branch)?

Does Test connection pass but Publish fails? If so, please share the full error text and an approximate timestamp (with timezone).

Deployment flow (CI/CD)

Can you share the part of your pipeline/YAML that deploys Synapse/ADF assets? I’m mainly looking for the order of deployments (what runs first) and any filters/conditions that skip certain resources.

A short log snippet showing which template (workspace_publish vs custom ARM/Bicep) runs first would be perfect.

Templates & resource details

Please paste only the key bits of your Credential and Linked Service templates:

type, apiVersion, name

dependsOn

For the Credential, the typeProperties.resourceId expression

Which resource types/api versions are you using for:

Microsoft.Synapse/workspaces/credentials

Microsoft.Synapse/workspaces/linkedServices

Parameter hygiene

What is the final resolved value for the UAMI ARM ID at deploy time (you can mask the middle; I just need to see the start/end)?

Is that parameter declared as string or secureString? Any chance of trailing spaces or a newline?

Identity consistency (not just “is it attached”)

Has the UAMI ever been deleted and recreated with the same name? If possible, please share:

UAMI id (ARM ID), principalId, and clientId

Creation time of the UAMI

The Synapse/ADF system-assigned MI principalId (or objectId)

Is the UAMI in the same tenant and subscription as the workspace/factory?

Workspace/identity evidence (CLI)

Output of: az synapse workspace show -n <ws> -g <rg> --query identity

Output of: az identity show -n <uami> -g <rg>

Policy / RBAC checks

Are there any Azure Policies or Deny assignments on the subscription/RG that could block updates to credentials or attaching user-assigned identities?

Which identity (service connection/SPN) actually performs the deployment, and what role does it have on the workspace/resource group?

Quick JSON sanity

Could you share a small, linted snippet of the Credential typeProperties? I want to rule out hidden line breaks or quotes around the parameter name/value.

1 answer

Your answer

Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-08T08:28:50.0766667+00:00

Hi @Atul kumar ,

Welcome to the Microsoft Q&A Platform.

Test succeeds under your user, but publish validates with the Synapse/ADF identity, so the UAMI in the Credential must be attached to the workspace/factory.

Go to Synapse/ADF → Identity → User assigned → Add the exact UAMI, then ensure the Credential’s typeProperties.resourceId exactly matches that ARM ID.

Give that UAMI the required RBAC/permissions on the target (e.g., Dataverse/Key Vault), Save and Publish again.

If you have any further questions, feel free to respond in this same thread.
Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-08T14:35:11.9933333+00:00

Hi Atul kumar,

Yes, you're right azure synapse does not auto-generate parameters for Dataverse Linked Services in json like ADF does.

You need to manually define parameters in your templates or use variables to handle environment-specific values.

The error occurs because the parameterized resourceId is not resolving to a valid UAMI attached to the Synapse workspace.

Ensure the UAMI is explicitly attached to the workspace.

Ensure credential referenceName matches the credential name exactly.

Provide correct per-environment values for resourceId (e.g., DEV, TEST, PROD).

if needed do clean up the parameter key, remove spaces, newlines, or comments from "DataverseCredentialResourceId".
Atul kumar 20 Reputation points

2025-09-08T15:09:25.63+00:00

Hi Team,

Thanks for your response !!

May I ask few questions on below:

Yes, you're right azure synapse does not auto-generate parameters for Dataverse Linked Services in json like ADF does. My Comments: Thanks !!

You need to manually define parameters in your templates or use variables to handle environment-specific values. My Comments: When you say manually define parameters in template then which template you are referring? I have updated workspace_publish branch templates (TemplateForWorkspace.Json & TemplatesForParameters.Json) but whenever I am publishing all the parameters I created manually vanishing or re-setting. I am trying your suggestion of using variables and share the progress.

The error occurs because the parameterized resourceId is not resolving to a valid UAMI attached to the Synapse workspace. My Comments: I am using complete id in format as "/subscriptions/xxx/resourcegroups/xxx/providers/Microsoft.ManagedIdentity/userAssignedIdentities/xxxxxx" } in Credential Json as a default value of parameter but still it is asking for Error Code - InvalidUserAssignedMiCredential.

Ensure the UAMI is explicitly attached to the workspace. My Comments: Sure !!

Ensure credential referenceName matches the credential name exactly. My Comments: Sure !!

Provide correct per-environment values for resourceId (e.g., DEV, TEST, PROD). My Comments: Sure !!

if needed do clean up the parameter key, remove spaces, newlines, or comments from "DataverseCredentialResourceId".My Comments: Sure !!

Once again thanks for your help & support !!

Regards

Atul Kumar
Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-08T17:22:53.3566667+00:00

Hi Atul kumar,

"Which template should I edit? My manual params vanish on publish.”

Don’t edit anything inside workspace_publish/*; those files are regenerated.

Synapse regenerates these on every publish and will overwrite your changes.

Keep per-environment parameter files outside workspace_publish (e.g., cicd/params/dev.parameters.json, test.parameters.json, prod.parameters.json) and reference them at deploy time.
TemplateFile: workspace_publish/TemplateForWorkspace.json
ParametersFile: your custom params file (per env)
Or
use an inline override: -DataverseCredentialResourceId "<ARM ID>"

now params won’t “vanish,” because we are not editing the generated files

for more info, please refer to this.

“I used the full ARM ID but still get InvalidUserAssignedMiCredential”

Even with the correct ARM ID, Publish can still fail with InvalidUserAssignedMiCredential if the resolved UAMI isn’t attached to the target workspace or there’s a parameter/name mismatch. Attach that UAMI and ensure per-environment values are supplied at deploy (via your params file or overrides).
Swapnesh Panchal 1,540 Reputation points Microsoft External Staff Moderator

2025-09-10T08:03:28.71+00:00

Thank you for providing additional details. I’ll get back to you with updates as soon as possible.
Atul kumar 20 Reputation points

2025-09-19T08:06:25.78+00:00

Hi Team,

This solution doesn't work and I didn't get parameters for Dataverse linked service & credentials parameters.

Kindly provide solution in more details or let me know in case I missed something.

Thanks

Answer 1

Hi Team,

I would like to inform that my issue is resolved.

Please find summary:

Issue - Linked Service (Dataverse) using Credential with User Assigned Managed identity is not getting parametrized in Azure Synapse Analytics.

Summary - When we create Linked service in Azure Synapse workspace and publish main branch then Workspace_publish branch gets 2 files a)TemplateForPrameter.json b) TemplateForWorkspace.json and using Override Parameters its values gets changed environment wise environment.

But for me in Azure Synapse Analytics, I couldn't see these attributes in Parameters (like serviceUri in Linked Service & resourceId in Credential).

I would like to thank for your suggestion to create custom template file in root folder named templates-parameters-definition.json.

But when I followed the suggested code as below:

{ "linkedService":

{ "Dataverse":

{ "properties":

{ "typeProperties":

{ "serviceUri":

{ "type": "String", "defaultValue": "" }

}

},

"credential": { "abcCredential":

{ "properties":

{ "typeProperties":

{ "resourceId":

{ "type": "String", "defaultValue": "" } }

}

This has removed my existing parameters.

Then, I have used below code:

"Microsoft.Synapse/workspaces/linkedServices": { "": { "properties": { "typeProperties": { "accountName": "=", "username": "=", "connectionString": "|:-connectionString:secureString", "secretAccessKey": "|" } } }, "AzureDataLakeStore": { "properties": { "typeProperties": { "dataLakeStoreUri": "=" } } }, "AzureKeyVault": { "properties": { "typeProperties": { "baseUrl": "|:baseUrl:secureString" }, "parameters": { "KeyVaultURL": { "type": "=", "defaultValue": "|:defaultValue:secureString" } } } } }, "Microsoft.Synapse/workspaces/datasets": { "": { "properties": { "typeProperties": { "folderPath": "=", "fileName": "=" } } } }, "Microsoft.Synapse/workspaces/credentials" : { "properties": { "typeProperties": { "resourceId": "=" } } } }

Reference: https://dori-uw-1.kuma-moon.com/en-us/azure/synapse-analytics/cicd/continuous-integration-delivery

And, I am able to get parameters for serviceUri & resourceId.

I am really thankful for your help & support through out the journey and adding my knowledge in custom arm template implementation in Azure Synapse Analytics.

Thanks

Atul Kumar

Share via

Invalid user assigned managed identycredential

1 answer

Your answer