Connect Microsoft Fabric and Azure SQL

Set up a connection to a Fabric warehouse or lakehouse, or an Azure SQL database, and pick the sign-in method that fits how your team will use it.

6 min readUpdated October 1, 2026

Golden connects to Microsoft Fabric (Lakehouse SQL analytics endpoints and Warehouses) and Azure SQL Database (including Managed Instance). Both speak the same SQL, so the setup looks alike: you tell Golden where the data lives, then how to sign in.

The Authentication Method drop-down at the top of the connection dialog decides which fields you see. Pick based on who will use the connection.

Method	Available for	Best for	What you need
Sign in with Microsoft	Fabric, Azure SQL	Getting started fast, or a connection one person owns	Your Microsoft work account. No app registration.
Service principal	Fabric, Azure SQL	A shared, long-lived connection your whole team relies on	A Tenant ID, App (Client) ID and Client Secret from an Entra app registration
SQL username & password	Azure SQL only	Databases that use SQL logins	A SQL login and its password

Note: A connection runs as whoever signed it in. With Sign in with Microsoft, every teammate who uses the connection sees what your account can see. If that person leaves or loses access, the connection stops working. For a connection the whole team depends on, use a service principal.

Connect Microsoft Fabric

Find your SQL endpoint

In Fabric, open the warehouse or lakehouse you want to connect.
Open its settings and copy the SQL connection string (for a lakehouse, it's on the SQL analytics endpoint). It looks like abc123xyz.datawarehouse.fabric.microsoft.com.
Note the name of the warehouse or lakehouse, for example Sales.

Fill in the dialog

In Golden, add a new connection and choose Microsoft Fabric.
Pick an Authentication Method.
Paste the endpoint into SQL Endpoint.
Enter the warehouse or lakehouse name in Database.
For a service principal, fill in Azure Tenant ID, App (Client) ID and Client Secret.
Click Test Connection, then Save Connection. With Sign in with Microsoft, click Sign in with Microsoft instead and finish signing in with your work account.

Tip: One SQL endpoint serves every warehouse and lakehouse in a workspace. You only change the Database name to point at a different one.

Don't have the endpoint?

Open More options and enter a Workspace ID instead of a SQL endpoint. Golden finds the endpoint for you. To point at a specific item, add a Warehouse ID or a Lakehouse Name. Without either, Golden picks a lakehouse in that workspace, so naming one is safer.

Let a service principal into Fabric

Fabric refuses a service principal until 2 things are true:

A Fabric admin has turned on "Service principals can use Fabric APIs" in the Fabric admin portal's tenant settings.
The service principal has been added to the workspace. Open the workspace, choose Manage access, and add the app registration with at least a Viewer role. A personal My workspace can't be shared, so the data has to live in a regular workspace.

Connect Azure SQL Database

In Golden, add a new connection and choose Azure SQL Database.
Pick an Authentication Method.
Enter the Server, for example your-server.database.windows.net. You'll find it on the database's Overview page in the Azure portal.
Enter the Database name.
Fill in the sign-in fields for your method (username and password, or tenant, client ID and secret).
Click Test Connection, then Save Connection, or Sign in with Microsoft.

Tip: The port defaults to 1433. For a Managed Instance public endpoint, open More options and set Port to 3342.

Give the identity access to the database

Signing in to Microsoft and being allowed into a database are 2 separate steps. Whoever connects (your account, or the service principal) also needs a user in the database. A database admin can run this in the database you're connecting:

sql

CREATE USER [name-of-app-or-user@yourcompany.com] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [name-of-app-or-user@yourcompany.com];

For a service principal, use the app registration's display name. db_datareader gives read-only access, which is all Golden needs. Sign-in with a Microsoft account also requires the server to have a Microsoft Entra admin set.

Open the firewall

Azure SQL blocks every address that isn't on the server's firewall list, so a correct password against the right server still fails until Golden is allowed in. In the Azure portal, open the server's Networking settings and either:

add Golden's outbound IP addresses to the firewall rules (contact Golden support for the current list), or
turn on Allow Azure services and resources to access this server.

If the firewall is the problem, Golden tells you so: "The Azure SQL firewall blocked this connection."

Set up a service principal

If you're going the service principal route, here's where each value comes from in the Azure portal:

Open Microsoft Entra ID → App registrations → New registration. Give it a name like Golden Analytics and register it.
From the app's Overview, copy the Application (client) ID into App (Client) ID, and the Directory (tenant) ID into Azure Tenant ID.
Open Certificates & secrets → New client secret. Copy the secret's Value into Client Secret right away; Azure only shows it once.
Give the app access: add it to the Fabric workspace, or create it as a database user in Azure SQL (both covered above).

Heads up: Copy the secret's Value, not its Secret ID. They look alike, and the Secret ID is the most common reason a service principal is refused. Secrets also expire, so put the expiry date on someone's calendar. When it lapses, create a new secret and paste it into the connection.

Tip: The Tenant ID and the App (Client) ID are both long IDs that sit side by side in Azure. If you paste the same one into both fields, Golden catches it before you save.

Signing in from another organization

With Sign in with Microsoft, Golden signs you in to your own organization's tenant by default. If the database belongs to a different organization and you're a guest there, enter that organization's tenant in Azure Tenant ID (optional). Otherwise Microsoft hands Golden a sign-in the database won't accept. For Fabric, this field is under More options.

Fix common errors

What Golden says	What to check
"Microsoft rejected the client secret."	You pasted the Secret ID, or the secret expired. Paste the secret's Value.
"The client secret has expired."	Create a new secret on the app registration and update the connection.
"Microsoft couldn't find this App (Client) ID in the tenant."	The client ID is wrong, or it belongs to a different tenant than the Tenant ID.
"Microsoft couldn't find this tenant."	Check the Azure Tenant ID.
"Fabric refused the service principal."	Add it to the workspace under Manage access, and check that the Fabric admin setting is on.
"Fabric didn't recognize this SQL endpoint."	Copy the endpoint again from the warehouse or lakehouse settings. A single typo looks like a dropped connection.
"Sign-in succeeded but the database could not be opened."	Check the Database name, and that the identity has a user in that database.
"The Azure SQL firewall blocked this connection."	See Open the firewall above.
"The database is starting up."	A paused serverless database wakes on the first connection. Wait a minute and try again.
"This connection's port is not one Azure SQL or Fabric serves."	Use 1433, or 3342 for a Managed Instance.

What to know before you connect

Only Microsoft's public cloud. Azure SQL servers must end in .database.windows.net. Government and sovereign clouds aren't supported yet.
No Private Link yet. Your server or endpoint must be reachable over the public internet (behind its firewall).
Connections are always encrypted. Golden requires TLS and verifies the server's certificate.
A few data prep steps aren't available. Steps that parse JSON, split text into parts, or use regular expressions don't run on these sources. Golden tells you when a step can't run.
Medians on Azure SQL are approximate. Azure SQL calculates them with APPROX_PERCENTILE_CONT, and Golden marks them as approximate. Fabric medians are exact.

Choose how to sign in