Configure a Connection Profile

From the CData ribbon, click Get Data and select From Azure Synapse connection/s to launch the CData Query window. To setup a new connection, you will have to click the New Azure Synapse Connection button. Here you can set the connection settings, test the connection, and save the connection profile.

Connecting to Azure Synapse

In addition to providing authentication (see below), set the following properties to connect to a Azure Synapse database:

• Server: The server running Azure Synapse. To find this:
  1. Log into the Azure portal.
  2. Navigate to Azure Synapse Analytics
  3. Navigate to Select your database > Overview > Server name.
• Database: The name of the database, as seen in the Azure portal on the Azure Synapse Analytics page.

Authenticating to Azure Synapse

Azure Synapse supports authentication using Entra ID (AzureAD), Azure Service Principal, Managed Service Identity (MSI), Password (default), and Azure Password.

Authenticate to Azure Synapse as described in the following sections.

Entra ID (Azure AD)

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Microsoft Entra ID is a multi-tenant, cloud-based identity and access management platform. It supports OAuth-based authentication flows that enable the driver to access Azure Synapse endpoints securely.

Authentication to Entra ID via a web application always requires that you first create and register a custom OAuth application. This enables your application to define its own redirect URI, manage credential scope, and comply with organization-specific security policies.

For full instructions on how to create and register a custom OAuth application, see Creating an Entra ID (Azure AD) Application.

After setting AuthScheme to AzureAD, the steps to authenticate vary, depending on the environment. For details on how to connect from desktop applications, web-based workflows, or headless systems, see the following sections..

Desktop Applications

You can authenticate from a desktop application using a custom OAuth application registered in Microsoft Entra ID (formerly Azure AD), as described in Creating an Entra ID (Azure AD) Application.

During registration, record the following values:

• OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
• OAuthClientSecret: The client secret that was that was generated when you registered your custom OAuth application.
• CallbackURL: A redirect URI you defined during application registration.

When you are ready to connect, set the following connection properties:

• AuthScheme: AzureAD
• InitiateOAuth:
  • GETANDREFRESH – Use for the initial login. Launches the login page and saves tokens.
  • REFRESH – Use this setting when you have already obtained valid access and refresh tokens. Reuses stored tokens without prompting the user again.
• OAuthClientId: The client Id that was generated when you registered your custom OAuth application.
• OAuthClientSecret: The client secret that was generated when you registered your custom OAuth application.
• CallbackURL: A redirect URI you defined during application registration.

After authentication, tokens are saved to OAuthSettingsLocation. These values persist across sessions and are used to automatically refresh the access token when it expires, so you don't need to log in again on future connections.

Azure Service Principal

Note: Microsoft has rebranded Azure AD as Entra ID. In topics that require the user to interact with the Entra ID Admin site, we use the same names Microsoft does. However, there are still CData connection properties whose names or values reference "Azure AD".

Service principals are security objects within a Microsoft Entra ID (Azure AD) application that define what that application can do within a specific tenant. Service principals are created in the Entra admin center, also accessible through the Azure portal. As part of the creation process we also specify whether the service principal will access Entra resources via a client secret or a certificate.

Depending on the service you are connecting to, a tenant administrator may need to enable Service Principal authentication or assign the Service Principal to the appropriate roles or security groups.

Instead of being tied to a particular user, service principal permissions are based on the roles assigned to them. These roles determine which resources the application can access and which operations it can perform.

When authenticating using a service principal, you must register an application with an Entra tenant, as described in Creating a Service Principal App in Entra ID (Azure AD).

This subsection describes properties you must set before you can connect. These vary, depending on whether you will authenticate via a client secret or a certificate.

Authentication with Client Secret

• AuthScheme: AzureServicePrincipal.
• AzureTenant: The Azure AD tenant to which you will connect.
• OAuthClientId: The client ID in your application settings.
• OAuthClientSecret: The client secret in your application settings.
• InitiateOAuth: GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.

Authentication with Certificate

• AuthScheme: AzureServicePrincipalCert.
• AzureTenant: The Azure AD tenant to which you will connect.
• OAuthClientId: The client Id in your application settings.
• OAuthJWTCert: The JWT Certificate store.
• OAuthJWTCertType: The JWT Certificate store type.
• InitiateOAuth: GETANDREFRESH. You can use InitiateOAuth to avoid repeating the OAuth exchange and manually setting the OAuthAccessToken.

Managed Service Identity (MSI)

If you are running Azure Synapse on an Azure VM and want to automatically obtain Managed Service Identity (MSI) credentials to connect, set AuthScheme to AzureMSI.

User-Managed Identities

To obtain a token for a managed identity, use the OAuthClientId property to specify the managed identity's client_id.

If your VM has multiple user-assigned managed identities, you must also specify OAuthClientId.

Password

To authenticate directly to Azure Synapse, set these properties:

• AuthScheme: Password
• User: The authenticating Azure Synapse user.
• Password: The authenticating Azure Synapse user's password.

Azure Password

To authenticate directly to Azure Active Directory using your Azure credentials, specify the following connection properties:

• AuthScheme: AzurePassword.
• User: The account for the authenticating Azure user.
• Password: The authenticating Azure user's password.
• AzureTenant: The Directory (tenant) ID of the custom Azure AD application used to authenticate to Azure Synapse on Azure. To find this, go to the custom application's Overview page.

Connection Properties

The Connection properties describe the various options that can be used to establish a connection.

Managing Connections

After successfully authenticating to Azure Synapse you will be able to customize the data you are importing. To learn more about this, see Managing Connections.

See Also

• Querying Data: Use the data selection wizard to pull data into a spreadsheet. You can also configure scheduled data refresh here.
• Using the Excel Add-In: Find other ways to interact with Azure Synapse data, such as using the available CData Excel Functions.