Azure Synapse Managed Private Endpoints

Warnings

• breaking Enabling a Managed Virtual Network (VNet) or Managed Private Endpoints cannot be done on an existing Azure Synapse workspace. This is a critical design choice at workspace creation. If you need these features and your workspace wasn't initially configured with them, you must create a new Synapse workspace and migrate your artifacts.
  Fix: Plan your Synapse workspace network configuration carefully during creation. If Managed VNet is required for managed private endpoints, enable it from the outset. For existing workspaces without it, recreation and migration are necessary.
• breaking A critical transition is required for Azure Synapse Analytics workspaces to private links before August 1, 2026. Failure to do so may result in the loss of connectivity to Azure Storage and Key Vault. This transition necessitates that your workspace uses a Managed Virtual Network, which might require recreating your workspace if not initially configured.
  Fix: Review your Synapse workspace configurations and plan for migration to a Managed Virtual Network with managed private endpoints for all critical linked services before the deadline.
• gotcha When creating a managed private endpoint, it will initially be in a 'Pending' approval state. The owner of the target Azure resource (e.g., Storage Account, Azure SQL Database) must explicitly approve the private endpoint connection for the private link to be established and functional.
  Fix: Always coordinate with the owner of the target resource to approve pending private endpoint connections in the Azure portal or via appropriate Azure CLI/PowerShell commands.
• gotcha When using Azure Synapse Spark utilities (e.g., `mssparkutils.fs.mount`) with Data Exfiltration Protection enabled, and connecting to Azure Data Lake Storage Gen2, ensure that you create a Managed Private Endpoint specifically for the *blob* endpoint of the storage account, not just the *dfs* endpoint. Otherwise, DNS resolution issues may occur.
  Fix: For ADLS Gen2 with Data Exfiltration Protection, configure a Managed Private Endpoint targeting the blob endpoint (e.g., `accountname.blob.core.windows.net`) in addition to any dfs endpoint MPEs.
• deprecated The general `azure-synapse` meta-package is officially deprecated and will no longer be maintained after 2020-04-13 (receiving only security fixes until then). Users are advised to install service-specific packages, such as `azure-synapse-managedprivateendpoints`, directly.
  Fix: Directly install the `azure-synapse-managedprivateendpoints` package and other specific Synapse service packages as needed, rather than the `azure-synapse` meta-package.

Install

• pip install azure-synapse-managedprivateendpoints azure-identity Install with pip

Imports

• VnetClient

  from azure.synapse.managedprivateendpoints import VnetClient

  This is the primary client for interacting with Synapse Managed Private Endpoints.
• DefaultAzureCredential

  from azure.identity import DefaultAzureCredential

  Standard authentication method for Azure SDKs, supporting various credential types.

Quickstart

This quickstart demonstrates how to authenticate with Azure using `DefaultAzureCredential` and then initialize the `VnetClient` for Azure Synapse Managed Private Endpoints to list existing private endpoints in your workspace. Ensure `SYNAPSE_WORKSPACE_ENDPOINT` is set to your Synapse workspace's development endpoint.

import os
from azure.identity import DefaultAzureCredential
from azure.synapse.managedprivateendpoints import VnetClient

# Your Azure Synapse workspace development endpoint, e.g., "https://<your-workspace-name>.dev.azuresynapse.net"
SYNAPSE_WORKSPACE_ENDPOINT = os.environ.get("SYNAPSE_WORKSPACE_ENDPOINT", "https://your_synapse_workspace.dev.azuresynapse.net")

# Create a credential using DefaultAzureCredential.
# DefaultAzureCredential will attempt to authenticate through multiple mechanisms,
# including environment variables, managed identity, and development tools.
credential = DefaultAzureCredential()

# Create a VnetClient
# The default API version is '2020-12-01'.
vnet_client = VnetClient(credential, SYNAPSE_WORKSPACE_ENDPOINT)

print("Listing managed private endpoints...")
# The .list() method is paginated, so iterate through the results.
managed_private_endpoints = vnet_client.managed_private_endpoints.list()
for mpe in managed_private_endpoints:
    print(f"  - Name: {mpe.name}, Status: {mpe.properties.provisioning_state}, Approval: {mpe.properties.private_link_connection_state.status}")