Skip to content
Ed Freeman By Ed Freeman Software Engineer II
How to fix the "You need permission to access workspace..." error in Azure Synapse Analytics

If you've landed on this blog, you're probably seeing this error:

'You need permission to access this workspace' error in Synapse Studio.
Workspace Denial Error
The best hour you can spend to refine your own data strategy and leverage the latest capabilities on Azure to accelerate your road map.

That is, the error which states "You need permission to access workspace XYZ. Contact the workspace owner or administrators for access."

What is this error? Your first thought will probably be "It must be to do with permissions". Well, probably. Let's recap one what the permission model is for Azure Synapse Analytics.

As per this article on setting up access control in Synapse Studio, there are four different roles/permissions that must be applied to certain resources/object for things to work smoothly. They are (to quote the docs):

  • Azure roles (such as the built-in ones like Owner, Contributor, etc.)
  • Synapse roles – these roles are unique to Synapse and aren't based on Azure roles. There are three of these roles:
    • Synapse workspace admin
    • Synapse SQL admin
    • Apache Spark for Azure Synapse Analytics admin
  • Access control for data in Azure Data Lake Storage Gen 2 (ADLS Gen2).
  • Access control for Synapse SQL and Spark databases

If you're getting the error shown above, you're most likely missing a "Synapse role" - that is, either the Workspace Admin role, the SQL Admin role, or the Spark Admin role. Those are the only three roles for Synapse Studio (currently), and being assigned to one of those roles will give you access. Maybe there'll be more granular roles to come in the future - who knows.

Solution

There's actually an existing issue which seems to address the same "You need permission to access this workspace" error. The resolution in that case was to alter the firewall rules and ensure you give the Managed Identity of the Synapse workspace access to the Data Lake Store. Read the above post for more details on that.

What if you've checked and both those things are correctly configured? What if you're also assigned a role yourself on the ADLS Gen2 account/container, and you have contributor/owner access to the Synapse resource, but you still can't access Synapse Studio? What other permissions must you need? Well, as mentioned above, you're probably missing a role in Synapse Studio.

Azure Weekly is a summary of the week's top Microsoft Azure news from AI to Availability Zones. Keep on top of all the latest Azure developments!

The easiest fix here is to contact an existing Workspace Admin (probably the person who created the resource in the first place) and ask them to add you to one of the aforementioned roles (see this link describing the associated permissions with each Synapse Studio role for exactly which role fits your needs).

However, should the current Workspace Admin not be available - what can you do? Well, if you're an owner or a contributor on the Azure Synapse Analytics resource (which you can easily check through the portal), then you can actually use the Azure CLI to assign yourself to one of the Synapse Studio roles.

This is something I've written about in my blog How to use the Azure CLI to manage access to Synapse Studio, so I'll defer any further detail to that blog.

Hope this has helped!

Want to get started with Synapse but not sure where to start?

If you'd like to know more about Azure Synapse, we offer a free 1 hour, 1-2-1 Azure Data Strategy Briefing aimed at CxO's. Please book a call and then we'll confirm the time and send you a meeting invite.

We also have created number of talks about Azure Synapse:

Finally, if you are interested in more content about Azure Synapse, we have a dedicated editions page which collates all our blog posts.

FAQs

How do I fix the "You need permission to access workspace..." error in Azure Synapse Analytics? Your problem will either be to do with firewall rules, or you may not have a Synapse Studio role assigned for yourself. If firewall related, you need to check that your IP address falls within the allowed set of IPs defined for the workspace. If to do with Synapse Studio roles, you need to have a "Workspace Admin", "Spark Admin" or "Sql Admin" role assigned to yourself.

Ed Freeman

Software Engineer II

Ed Freeman

Ed is a Data Engineer helping to deliver projects for clients of all shapes and sizes, providing best of breed technology solutions to industry specific challenges. He focusses primarily on cloud technologies, data analytics and business intelligence, though his Mathematical background has also led to a distinct interest in Data Science, Artificial Intelligence, and other related fields.

He also curates a weekly newsletter, Power BI Weekly, where you can receive all the latest Power BI news, for free.

Ed won the Cloud Apprentice of the Year at the Computing Rising Star Awards 2019.