Azure Synapse Link for Dataverse: Create Link to Data lake

Change the storage account from Public network access: Disabled to Enabled from selected virtual networks and IP addresses, then enable Allow Azure services on the trusted services list to access this storage account; private-endpoint-only access does not match the documented managed-identity configuration for Azure Synapse Link for Dataverse. ^1^

Correct the storage network configuration

The private endpoint can remain, but it is not sufficient by itself because it is reachable only from connected VNets, whereas the Dataverse service accesses storage using the enterprise-policy managed identity and trusted-service context.

1. In Azure portal, open the ADLS Gen2 storage account.
2. Select Networking → Firewalls and virtual networks.
3. Set Public network access to Enabled from selected virtual networks and IP addresses.
4. Under Resource instances/Exceptions, select Allow Azure services on the trusted services list to access this storage account.
5. Select Save.
6. Allow the network and role changes to propagate, then submit the link again from Power Apps → Link data → Other Links.

Microsoft’s profile-creation troubleshooting guidance lists disabled public network access as a cause of “Unable to access storage account.” For restricted access, it directs managed-identity deployments to use the selected-networks configuration rather than leaving public network access fully disabled. ^2^

Verify the managed-identity setup

If the same message remains, check these items in order:

1. Enterprise policy connection
   • Power Platform admin center → Manage → Environments → open the environment.
   • Under Recent operations, select Full history and verify that connecting the identity completed successfully.
   • From PowerShell, confirm which policy is linked:

Import-Module Microsoft.PowerPlatform.EnterprisePolicies

Get-IdentityEnterprisePolicy `
    -EnvironmentId "<dataverse-environment-id>"

Only one enterprise policy can be connected to a Dataverse environment at a time. If multiple managed-identity links are needed, their linked Azure resources must be in the same resource group. ^1^

2. Storage and creator permissions
   • The link creator must have:
     • Dataverse System Administrator in the selected environment.
     • Reader on the subscription/resource group so the resources can be selected.
     • Owner on the ADLS Gen2 account, or a custom role containing the documented storage-read and role-assignment read/write actions.
   • Confirm the storage account is in the same Microsoft Entra tenant as Power Apps. ^3^
3. Storage prerequisites
   • Hierarchical namespace is enabled.
   • Allow storage account key access is enabled for initial setup.
   • Permitted scope for copy operations is set to From any storage account.
   • Selected Dataverse tables have Track changes enabled. ^3^
4. Existing Dataverse container
   • In Storage account → Storage browser → Blob containers, check whether a container named like dataverse-environmentName-organizationUniqueName already exists from an earlier link attempt for this environment.
   • The managed-identity troubleshooting procedure identifies an existing container for the same environment as a possible cause during link creation. Preserve any required data before deleting it, because container deletion is destructive. ^1^

DNS or private-endpoint recreation should not be the first troubleshooting path here: the failing operation is Dataverse creating the link, and the documented MSI design requires trusted-service access in addition to any private endpoint.

References

1. Use managed identities for Azure with your Azure data lake storage ...
2. Troubleshoot Azure Synapse Link profile creation issues
3. Create an Azure Synapse Link for Dataverse with Azure Data Lake