User gets "Login failed for user '<token-identified principal>'" when creating a DB in Synapse serverless SQL pool, despite having admin roles

Question

User gets "Login failed for user '<token-identified principal>'" when creating a DB in Synapse serverless SQL pool, despite having admin roles

Priyesh Shrestha 0

Hi everyone,

I have an Azure Synapse Analytics workspace, and I’m trying to give another user access to create a database in the Built-in serverless SQL pool.

Here’s what I’ve done so far:

In the Synapse workspace, under Manage → Security → Access Control (IAM), I’ve assigned the user the following roles:

Synapse SQL Administrator
Synapse Administrator

I’ve also tried giving the user Owner permissions at the subscription level in the Azure portal, but the issue persists.

When the user tries to create a database in the Built-in (serverless) SQL pool, they get the following error:

Login failed for user '<token-identified principal>'.
You don’t have access to the serverless SQL pool, Built-in.
To be granted access, contact a Synapse Admin for this workspace.

I’ve verified that the user can access the workspace itself but cannot run SQL commands or create a database in the built-in pool.

Could anyone help me understand what might be missing or what additional configuration is required to allow the user to access and create databases in the serverless SQL pool?

Thanks in advance!

Abhisek Mishra 1,020 Reputation points Microsoft External Staff Moderator

2025-10-23T16:21:31.0866667+00:00

Hi Priyesh Shrestha,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

Please review the response provided by Vinodh247, If you still have questions, or you come across issues, please let us know what is needed in the comments here so this question can be answered.

Thanks,

Abhisek
Abhisek Mishra 1,020 Reputation points Microsoft External Staff Moderator

2025-10-24T09:09:09.7366667+00:00

Hi Priyesh Shrestha,

I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Thanks,

Abhisek
VRISHABHANATH PATIL 2,540 Reputation points Microsoft External Staff Moderator

2025-10-28T08:27:29.23+00:00

Hi Priyesh Shrestha,

We hope the given steps were helpful. If you have any other questions, please feel free to contact us.

Thanks,
Vrishabh
Abhisek Mishra 1,020 Reputation points Microsoft External Staff Moderator

2025-10-30T11:22:34.93+00:00

Hi Priyesh Shrestha,

I understand that your question is yet to be answered, it will be a great help if you can share the snippets of error encountered along with some additional details over the private message.
Abhisek Mishra 1,020 Reputation points Microsoft External Staff Moderator

2025-11-03T15:00:04.7633333+00:00

Hi Priyesh Shrestha,

I hope you are doing good. I came across a Microsoft learn document which describes in detail the process and steps to follow.
https://dori-uw-1.kuma-moon.com/en-us/azure/synapse-analytics/security/how-to-set-up-access-control#step-7a-serverless-sql-pool-built-in

Please take a look and let me know if this helps, if you need further information, please let us know what is needed in the comments so the question can be answered.
Priyesh Shrestha 0 Reputation points

2025-11-04T11:28:19.0233333+00:00
unfortunately, the problem still has not been solved. I tried with the commands provided

CREATE LOGIN [@domain.com] FROM EXTERNAL PROVIDER; CREATE USER [@domain.com] FROM LOGIN [@domain.com]; EXEC sp_addrolemember 'db_owner', [@domain.com];

I also ensured they connect via ADD authentication, but the problem still presists.

The user that is getting the error is Maja
Manoj Kumar Boyini 1,890 Reputation points Microsoft External Staff Moderator

2025-11-23T12:21:38.6233333+00:00
Hi Priyesh Shrestha,

Thank you for sharing the error details and screenshots they are very helpful.

The error Login failed for user <token-identified principal> in Azure Synapse serverless SQL pool indicates that the SQL engine is unable to resolve the Azure AD identity during login. Even with appropriate Synapse Administrator roles, the serverless SQL pool requires its managed identity to have Azure AD directory permissions in order to look up users for authentication.

1.Assign Directory Readers Role: Ask your Azure AD administrator to grant the “Directory Readers” directory role to the Synapse workspace’s managed identity. This allows Synapse to check Azure AD profiles for SQL authentication.

2.Clean Up and Recreate Login/User: After the Directory Readers role is assigned (allow a few minutes for Azure permission propagation), log in to the built-in serverless SQL pool as an admin. Remove any existing login for the affected user:

DROP LOGIN [******@domain.com];

Then, recreate the SQL login and user:

CREATE LOGIN [******@domain.com] FROM EXTERNAL PROVIDER;

CREATE USER [******@domain.com] FROM LOGIN [******@domain.com];

EXEC sp_addrolemember 'db_owner', [******@domain.com];

3.Connect Using Azure AD Authentication: Ensure the connection to the built-in serverless SQL pool uses Azure AD (Integrated) authentication, not SQL authentication.

Helpful references:

https://techcommunity.microsoft.com/blog/azuredbsupport/aad-auth-error---login-failed-for-user-/1417535

https://docs.azure.cn/en-us/azure-sql/database/authentication-aad-directory-readers-role

https://dori-uw-1.kuma-moon.com/en-us/azure/synapse-analytics/security/how-to-set-up-access-control#step-7a-serverless-sql-pool-built-in

https://dori-uw-1.kuma-moon.com/en-us/azure/data-factory/connector-troubleshoot-synapse-sql

https://stackoverflow.com/questions/64911872/azure-synapse-analytics-login-failed-for-user-token-identified-principal

Once these steps are complete, the login should be recognized and access granted in the serverless SQL pool. Hope this helps. Do let us know if you have any further queries.
VRISHABHANATH PATIL 2,540 Reputation points Microsoft External Staff Moderator

2025-11-24T09:28:58.39+00:00

Hi Priyesh Shrestha,

I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

2 answers

Your answer

Abhisek Mishra 1,020 Reputation points Microsoft External Staff Moderator

2025-10-23T16:21:31.0866667+00:00

Hi Priyesh Shrestha,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

Please review the response provided by Vinodh247, If you still have questions, or you come across issues, please let us know what is needed in the comments here so this question can be answered.

Thanks,

Abhisek
Abhisek Mishra 1,020 Reputation points Microsoft External Staff Moderator

2025-10-24T09:09:09.7366667+00:00

Hi Priyesh Shrestha,

I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Thanks,

Abhisek
VRISHABHANATH PATIL 2,540 Reputation points Microsoft External Staff Moderator

2025-10-28T08:27:29.23+00:00

Hi Priyesh Shrestha,

We hope the given steps were helpful. If you have any other questions, please feel free to contact us.

Thanks,
Vrishabh
Abhisek Mishra 1,020 Reputation points Microsoft External Staff Moderator

2025-10-30T11:22:34.93+00:00

Hi Priyesh Shrestha,

I understand that your question is yet to be answered, it will be a great help if you can share the snippets of error encountered along with some additional details over the private message.
Abhisek Mishra 1,020 Reputation points Microsoft External Staff Moderator

2025-11-03T15:00:04.7633333+00:00

Hi Priyesh Shrestha,

I hope you are doing good. I came across a Microsoft learn document which describes in detail the process and steps to follow.
https://dori-uw-1.kuma-moon.com/en-us/azure/synapse-analytics/security/how-to-set-up-access-control#step-7a-serverless-sql-pool-built-in

Please take a look and let me know if this helps, if you need further information, please let us know what is needed in the comments so the question can be answered.
Priyesh Shrestha 0 Reputation points

2025-11-04T11:28:19.0233333+00:00

unfortunately, the problem still has not been solved. I tried with the commands provided

CREATE LOGIN [@domain.com] FROM EXTERNAL PROVIDER; CREATE USER [@domain.com] FROM LOGIN [@domain.com]; EXEC sp_addrolemember 'db_owner', [@domain.com];

I also ensured they connect via ADD authentication, but the problem still presists.

The user that is getting the error is Maja
VRISHABHANATH PATIL 2,540 Reputation points Microsoft External Staff Moderator

2025-11-24T09:28:58.39+00:00

Hi Priyesh Shrestha,

I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Answer 1

Hi ,

Thanks for reaching out to Microsoft Q&A.

In synapse serverless SQL, Azure RBAC roles (like synapse administrator/owner) do not automatically grant db level access to the built in SQL pool. Access must be explicitly granted inside the SQL pool itself using AAD authentication.

To fix this, try the below:

Log in to the builtin SQL pool using an account that already has access (for ex, the workspace creator).
Run these commands in the built-in pool:

CREATE LOGIN [@domain.com] FROM EXTERNAL PROVIDER; CREATE USER [@domain.com] FROM LOGIN [@domain.com]; EXEC sp_addrolemember 'db_owner', [@domain.com];
If the user still gets the <token-identified principal> error, ensure they connect via AAD (Integrated) authentication from synapse studio/azure data studio SQL auth is not supported for serverless.

Please 'Upvote'(Thumbs-up) and 'Accept' as answer if the reply was helpful. This will be benefitting other community members who face the same issue.

Answer 2

Hi Priyesh Shrestha,

The main reason for this error is that even though the user has workspace-level roles, they still need specific permission setup inside the serverless SQL pool itself.

Workspace Managed Identity Permission: The Synapse workspace uses a special identity to access user info in Azure Active Directory. This identity must have Directory Readers permission in Azure AD. Without this, the serverless SQL pool won’t recognize users properly, causing the login error.

Login Conflicts in SQL Pool: Sometimes, a login for the user exists but not correctly linked to their email. This can prevent the system from creating or recognizing them. You need to check and, if necessary, delete any conflicting login and then recreate it with the commands you tried.

Correct Authentication Method: Ensure the user “Maja” is connecting using Azure Active Directory authentication (not SQL authentication). This is essential for serverless pools.

Could you please check on below and confirm:

Ask your Azure AD admin to give Directory Readers permission to the Synapse workspace managed identity.
Run a check in the serverless pool to find and remove any conflicting logins for Maja.
Re-run the login and role assignment commands.
Confirm with User that they are connecting via Azure AD authentication.

Pilladi Padma Sai Manisha 590 Reputation points Microsoft External Staff Moderator

2025-11-18T06:01:04.8+00:00

Hi Priyesh Shrestha,

Did you get any chance to review the above response. Thank you!

Share via

User gets "Login failed for user '<token-identified principal>'" when creating a DB in Synapse serverless SQL pool, despite having admin roles

2 answers

Your answer