aleksander.wiszniowsk
06/26/2026, 3:20 PMkapa.ai
06/26/2026, 3:20 PMMauricio Cabezas
06/26/2026, 7:20 PMaleksander.wiszniowsk
06/29/2026, 8:22 AMaleksander.wiszniowsk
06/29/2026, 8:43 PMauthentication
• AADSecurePrincipalId
• AADSecurePrincipalSecret
We are trying to connect to a Microsoft Fabric SQL endpoint, which supports Microsoft Entra ID authentication.
One proposed approach was to use an Azure Service Principal and configure:
• authentication=ActiveDirectoryServicePrincipal
• AADSecurePrincipalId=<client-id>
• AADSecurePrincipalSecret=<client-secret>
with the Service Principal credentials supplied as the connection username and password.
Could you please clarify:
1. Does GoodData's MSSQL connector support Microsoft Entra ID (Azure AD) authentication methods, specifically ActiveDirectoryServicePrincipal?
2. Are the authentication, AADSecurePrincipalId, and AADSecurePrincipalSecret properties passed through to the underlying JDBC driver and actively used during connection establishment?Mauricio Cabezas
06/30/2026, 11:49 AMMauricio Cabezas
06/30/2026, 1:47 PMActiveDirectoryServicePrincipal authentication mode
2. Whether those additional properties (authentication, AADSecurePrincipalId, AADSecurePrincipalSecret) are genuinely passed through to the underlying JDBC driver
While we're looking into this, out of curiosity, were you previously connecting GoodData to Cosmos DB through a different setup (e.g. via Synapse SQL with views or OpenRowSet)? Understanding what you had before and why you're now exploring Fabric Mirroring would help us give you better context on the options available.
We'll come back to you once we have a confirmed answer.
Thanks for your patience!aleksander.wiszniowsk
06/30/2026, 2:03 PMaleksander.wiszniowsk
06/30/2026, 2:05 PMerror 400: Bad Request .
When I defined parameter block as follows:
"parameters":{
"authentication":"ActiveDirectoryServicePrincipal"
}
I got following error description:
"detail":"[Path '/data/attributes/parameters'] Instance type (object) does not match any allowed primitive type (allowed: 'array','null')"
After changing it to array, like this:
"parameters":[
{
"name": "authentication",
"value": "ActiveDirectoryServicePrincipal"
} ]
I got this error:
"detail":"Parameters value is not allowed for MSSQL. DataSource: 2137, Parameters: [Parameter(name=authentication, value=ActiveDirectoryServicePrincipal)]"
So it looks like that this parameter is not supported. This happened with every parameter I've testedBranislav Slávik
06/30/2026, 7:11 PMauthentication, AADSecurePrincipalId and AADSecurePrincipalSecret properties, and in my testing environment I was able to get a successful "Test connection" against an Azure SQL database using authentication=ActiveDirectoryServicePrincipal with a service principal. To be transparent: this is not an officially documented or guaranteed authentication method for the connector — it isn't exposed in the UI, so please treat it as best-effort rather than it being "supported" and something we can promise will behave the same in every setup.
2) Those properties are passed through to the underlying JDBC driver, but only when they are part of the connection URL — not when supplied as a separate parameters block. The parameters block is rejected for SQL data sources, which is almost certainly the
400 Bad Request you saw. The authentication=ActiveDirectoryServicePrincipal needs to go into the url.
What worked for me via the API:
type: AZURESQL
url: jdbc:sqlserver://<host>:1433;databaseName=<db>;encrypt=true;authentication=ActiveDirectoryServicePrincipal
username: <service-principal client ID>
password: <service-principal secret>
(Passing the service principal as username/password is Microsoft's current form; the AADSecurePrincipal* properties are the deprecated equivalents.)
A couple of prerequisites that showed up and will likely apply to you too:
• The service principal has to be granted access inside the target database/endpoint (at least read access) — it existing in Entra ID alone isn't enough.
• The service principal must live in the same Entra tenant the endpoint authenticates against.
Important caveats for your Fabric / Cosmos DB scenario:
• My test was against a plain Azure SQL database — not a Fabric SQL analytics endpoint backed by Cosmos DB mirroring. A green "Test connection" only confirms authentication + reachability; it does not guarantee that all functionality, e.g. model scanning, data loading, and querying the mirrored Cosmos DB data will all behave the same way through that endpoint. I haven't validated that end-to-end.
• On Fabric you'd typically grant the service principal access via the Fabric workspace / item permissions, rather than the CREATE USER ... FROM EXTERNAL PROVIDER route used for a standalone Azure SQL database.
• If you hit limitations with the Fabric endpoint, FlexConnect remains the more flexible fallback — it lets you implement the connection (including Entra ID auth) in custom Python.
If you try this against your Fabric endpoint, please let us how it goes —both whether the connection succeeds and whether data loading works against the mirrored data.
In addition, I would gladly help you if you get to any other, unexpected issues.aleksander.wiszniowsk
07/01/2026, 10:18 AMcom.microsoft.sqlserver.jdbc.SQLServerException:
'FOR' clause is not supported in this version of Synapse SQL.
But changing that connector to SYNAPSE SQL solved that issue and I'm able to fetch tables from mirrored CosmosDB instance:Branislav Slávik
07/01/2026, 12:58 PMaleksander.wiszniowsk
07/01/2026, 1:01 PMBranislav Slávik
07/01/2026, 1:03 PM