Azure Synapse

Sifflet monitors the health and quality of the data in your Azure Synapse dedicated SQL pools, from table updates down to individual field values and business metrics. Sifflet catalogs your Synapse tables and views so you can monitor them, and links them to the Power BI reports built on top of them, so you can see which dashboards an incident affects. For the full list of imported objects, see Azure Synapse Collected Data.

Permissions Required

Sifflet connects to your dedicated SQL pool with read-only access, using a Microsoft Entra ID application (service principal) mapped to a database user.

Sifflet doesn't need any write permission.

Cost and load impact: Sifflet runs its metadata and monitor queries on your dedicated SQL pool. These queries use the pool's compute resources and concurrency slots, alongside your other workloads. Monitor queries only run when the pool is online: Sifflet can't query a paused pool.

Requirements

Required Roles for Setup

• In Azure: the rights to create an application and a client secret in Microsoft Entra ID (for example the Application Administrator role).
• In Synapse: the rights to create users and grant roles in the dedicated SQL pool (for example the Microsoft Entra admin of the Synapse workspace).
• In Sifflet: the Admin role, to create credentials. Users with the System Editor role can create the source with an existing credential. See Access Control.

Supported Versions and Editions

• Supported: Azure Synapse Analytics dedicated SQL pools.
• Not supported: Synapse serverless SQL pools and Apache Spark pools.

Network Access

• Default: Sifflet connects to the dedicated SQL endpoint of your Synapse workspace (<WORKSPACE_NAME>.sql.azuresynapse.net, port 1433) from the internet, so this endpoint must be reachable from the public internet.
• IP allowlisting: if you restrict access with Synapse workspace IP firewall rules, add a rule allowing the IP addresses of your Sifflet instance, listed in Settings > Integration Preferences.

Other Prerequisites

• The dedicated SQL pool you want to monitor exists and is online.

Connect Sifflet to Azure Synapse

Step 1: Create a Service Principal in Microsoft Entra ID

Sifflet authenticates with a Microsoft Entra ID application (service principal) and a client secret.

Create the Application

1. In the Azure portal, go to Microsoft Entra ID > Enterprise applications.

2. Click New application, then Create your own application.

3. Enter a name for the application (for example sifflet-synapse), select Integrate any other application you don't find in the gallery (Non-gallery), and click Create.

   

4. Note the application name and its Application ID: you need them in the next steps.

Create a Client Secret

1. In the Azure portal, go to Microsoft Entra ID > App registrations > All applications.

2. Click the application you've just created.

   

3. Go to Certificates & secrets, click New client secret, choose an expiry, and click Add.

4. Copy the secret Value.

⚠️ Azure shows the secret value only once, right after you create it. The secret expires at the date you chose: before it expires, create a new secret and update the Sifflet credential with it.

Grant Access to the Dedicated SQL Pool

In Synapse Studio, connect to the dedicated SQL pool you want to monitor and run the following script. Replace <APPLICATION_NAME> with the name of the application you created.

CREATE USER [<APPLICATION_NAME>] FROM EXTERNAL PROVIDER;
EXEC sp_addrolemember 'db_datareader', '<APPLICATION_NAME>';

Repeat the script in each dedicated SQL pool you want to monitor.

Keep the following values for step 2:

• the Application ID (also called client ID) of the application;
• the client secret Value.

Step 2: Add the Azure Synapse Source in Sifflet

1. Create the credential: in Integrations > Credentials, create a new credential and paste the following JSON in the Credential field. Replace <APPLICATION_ID> and <CLIENT_SECRET_VALUE> with the values from step 1.

   JSON

   {
     "user": "<APPLICATION_ID>",
     "password": "<CLIENT_SECRET_VALUE>"
   }

2. Create the source: in Integrations > Sources, click New source, choose Synapse, and fill in the following fields:

   Field	Description	Example
   Source name	The name of the source in Sifflet	Synapse Production
   Host	The dedicated SQL endpoint of your Synapse workspace, without https:// or port. You find it in the Azure portal, on the Overview page of the Synapse workspace.	my-workspace.sql.azuresynapse.net
   Port	The port of the dedicated SQL endpoint	1433 (default)
   Database	The name of the dedicated SQL pool	sales_pool
   Credentials	The credential you created above	synapse-credential

3. Select the scope: click Load assets, then select the databases and schemas Sifflet catalogs. Enable Automatically include new schemas so that Sifflet also catalogs schemas created later. Create a single source per Synapse workspace: see Integrations Management for the one-source-per-environment model and refresh scheduling.

4. Test and save: click Test Connection, then save the source. Once the first metadata refresh completes, your tables and views appear in the Data Catalog. You can follow the status and logs of each refresh in the source details.

Troubleshooting

Schemas of the master Database Are Missing

Symptom: when you select the scope of the source, the schemas of the master database don't appear.

Cause: the Sifflet database user exists only in the dedicated SQL pool, not in the master database. Sifflet skips the master database when it can't read it. For every other database of the workspace, the Sifflet user must exist in the database: otherwise, loading the assets of the source fails.

Fix:

1. Select the schemas of your dedicated SQL pool database instead: they contain the tables and views to monitor, and Sifflet doesn't need access to master.
2. If the schemas of your dedicated SQL pool are missing too, check that you ran the script of step 1 in this pool, and that the Database field of the source contains the pool name.
3. If the issue persists, contact Sifflet support.