Creating Synapses Workspace through ARM Template using SPN Failing during provisioning "storageRoleDeploymentResource" with BAD Request

[jayendranarumugam]

Is there any Specific permissions needed to include while deploying a Synapses workspace through ARM with SPN Authentication?

ARM will getting failed at `storageRoleDeploymentResource' Resource provisioning state with BAD request

Also the sql admin was randomly assigned with a GUID. Do we need any special permission to include in the doc to cover the SPN Deployment ?

Doc Link: https://docs.microsoft.com/en-us/azure/synapse-analytics/security/how-to-set-up-access-control

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 1149f92f-5b95-7b27-5525-db4f792d7937
• Version Independent ID: 60242818-539c-6e91-7dc8-222ccc383574
• Content: Secure your Synapse workspace (preview) - Azure Synapse Analytics
• Content Source: articles/synapse-analytics/security/how-to-set-up-access-control.md
• Service: synapse-analytics
• Sub-service: security
• GitHub Login: @matt1883
• Microsoft Alias: mahi

[mike-urnun-msft]

@jayendranarumugam Thank you for your feedback! We will review and update as appropriate.

[jayendranarumugam]

Hi @mike-urnun-msft / @himanshusinha-msft , I just found the workaround but not exactly sure this is correct solution, currently my SPN have contributor access to RG. I've changed the access to owner and it got worked. Is owner access really needed to a SPN for creating Synapses workspace ?

[CHEEKATLAPRADEEP-MSFT-zz]

@jayendranarumugam Glad to know that your issue has resolved. And thanks for sharing the solution, which might be beneficial to other community members reading this thread.

Yes, owner permission is required to a SPN for creating Synapse workspace.

We will now proceed to close this thread. If there are further questions regarding this matter, please comment and we will gladly continue the discussion.

[jayendranarumugam]

Thanks @CHEEKATLAPRADEEP-MSFT for the response actually there are some conditions and the condition is depends on the way the storage acc gen 2 creation. This actually needs some clarity. I'll soon create a Dev Post and share here for other to get understand it :)

[jayendranarumugam]

For anyone who needs to understand the access. Here is the blog which I wrote. Hope this help some one

https://dev.to/jayendran/azure-synapse-analytics-workspaces-deploy-and-debug-part-1-1fap