Can I access an Azure SQL database in another tenant/subscription when creating a mirrored Azure SQL database?

Andrew HB 341 Reputation points
2025-08-04T11:03:39.7833333+00:00

Is it possible for our customer to mirror an Azure SQL database located within our Azure Tenant when their Microsoft Fabric is in their own Azure tenant?

Azure SQL Database
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Marcin Policht 53,675 Reputation points MVP Volunteer Moderator
    2025-08-04T11:37:57.1633333+00:00

    Yep, Microsoft Fabric supports mirroring Azure SQL databases, even if the source database resides in a different Entra ID tenant — as long as:

    • The customer has appropriate delegated or service principal-based access to your Azure SQL database.
    • Cross-tenant data access and authentication are correctly configured.
    • Private endpoints, firewall, and networking configurations allow the communication.
    • The Mirroring feature in Microsoft Fabric supports cross-tenant sources.

    For this to work, you'd need to set up:

    1. Cross-tenant access configuration
    • Your Entra ID tenant must allow external identities (from the customer's tenant) to access the Azure SQL DB.
    • This usually involves:
      • Adding the customer’s Microsoft Entra ID tenant as a guest.
      • Granting appropriate RBAC roles to the service principal or user they will use.
      • Or giving the customer a dedicated user/service principal in your tenant for least privilege access.
    1. Authentication support

    Microsoft Fabric currently supports:

    • Entra ID interactive authentication
    • Service principal authentication

    Your customer can configure a service principal in their own tenant and have it granted access to your Azure SQL DB.

    Note that fabric mirroring requires OAuth-based authentication. SQL authentication (user/password) is not supported.

    1. Networking
    • Your Azure SQL Server must allow Azure services or the customer's specific IP ranges.
    • If private endpoints are used, extra configuration is needed, such as:
      • Private DNS zone peering
      • Allowing traffic from the customer’s tenant via VNet peering or VPN.
    1. Mirroring in Fabric

    Once access is configured:

    • In Fabric, the customer would configure Data Factory mirroring, and select Azure SQL Database as the source.
    • Provide the connection information and authentication details.
    • Initiate the mirroring setup and ingestion process.

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.