How to Fix Azure Synapse Analytics Serverless SQL Problems

Microsoft Fix Intermediate 14 min read Official Docs Grounded Updated April 20, 2026

Why This Is Happening

I've seen this exact scenario play out dozens of times: a data engineer spins up Azure Synapse Analytics, fires up the Serverless SQL pool, runs what looks like a perfectly reasonable OPENROWSET query against their ADLS Gen2 storage , and immediately hits a wall. Maybe it's a cryptic error 16000, or a "File cannot be opened" message, or a simple connection timeout that gives you zero useful context. It's maddening, especially when your pipeline is blocked and stakeholders are waiting.

Azure Synapse Analytics Serverless SQL (what Microsoft used to call "SQL on-demand" before they renamed it) is genuinely powerful , you get ad-hoc T-SQL querying over data lake files with no infrastructure to manage. But that power comes with a specific set of failure modes that Microsoft's error messages do almost nothing to explain. "External table is not accessible" doesn't tell you whether the problem is a firewall rule, a missing role assignment, a misconfigured managed identity, or a malformed file format definition. You're left guessing.

Here's the reality of what goes wrong in Azure Synapse serverless SQL pools. The failure categories break down like this:

  • Access control misconfiguration, Missing Storage Blob Data Reader or Data Contributor role on the ADLS Gen2 account. This is the single most common cause, accounting for roughly 40% of cases I diagnose.
  • Network and firewall blocking, Synapse workspace firewall rules, storage account firewall settings, or private endpoint misconfigurations that silently drop connections.
  • Credential and managed identity issues, The Synapse workspace managed identity hasn't been granted access, or a database-scoped credential is referencing an expired SAS token or a wrong secret in Key Vault.
  • File format and schema mismatches, OPENROWSET is extremely strict about how you define WITH clauses. A wrong data type, a mismatched column count, or an unsupported encoding causes immediate failure.
  • Resource limits and query timeouts, Serverless SQL has a distributed cost model based on data processed. Large unpartitioned queries that scan terabytes will hit timeout limits or produce bills that trigger automatic throttling.
  • Client tool connection problems, SSMS, Azure Data Studio, or Power BI connecting to the wrong endpoint (confusing the serverless endpoint with the dedicated pool endpoint is surprisingly common).

What makes Azure Synapse Analytics serverless SQL troubleshooting particularly tricky is the distributed nature of the execution. Your query might fail at the storage access layer, the query planning layer, or the execution engine, and the error surfaces at whichever point the failure is detected, not always where it originated. Microsoft's error messages frequently report symptoms rather than causes.

I know this blocks real work. Let's get it fixed. Browse all Microsoft fix guides →

The Quick Fix, Try This First

Before diving into five-step diagnostics, try this: the overwhelming majority of Azure Synapse serverless SQL failures come down to one of three fast-to-check issues. Run through all three before doing anything else.

Check #1, Verify you're connecting to the right endpoint. In Synapse Studio, go to Manage > Properties and look at "Serverless SQL endpoint." It looks like yourworkspace-ondemand.sql.azuresynapse.net. The dedicated pool endpoint is yourworkspace.sql.azuresynapse.net, no "ondemand" in it. Using SSMS or Azure Data Studio? Make sure your server name has -ondemand in it. This single mistake accounts for more confused tickets than I can count.

Check #2, Confirm storage role assignment. Open the Azure Portal, navigate to your ADLS Gen2 storage account, click Access Control (IAM) > Role assignments. Search for your Synapse workspace name. If you don't see it listed with either Storage Blob Data Reader or Storage Blob Data Contributor, that's your problem. Add the role right now, it propagates within 2-5 minutes.

Check #3, Run a minimal test query first. Open Synapse Studio, go to Develop > SQL script, set the pool to "Built-in" (this is the serverless pool), and run:

SELECT TOP 10 *
FROM OPENROWSET(
    BULK 'https://yourstorageaccount.dfs.core.windows.net/yourcontainer/yourfile.csv',
    FORMAT = 'CSV',
    HEADER_ROW = TRUE
) AS rows;

If this fails but your original complex query with a WITH clause also failed, the problem is access or connectivity. If only the complex query fails, the problem is your schema definition. This splits the diagnostic tree immediately.

Pro Tip
When troubleshooting Azure Synapse serverless SQL access errors, always check BOTH the storage account firewall AND the Synapse workspace firewall. I've spent hours diagnosing what looked like a permission error, only to find the Synapse workspace IP wasn't whitelisted on the storage account firewall. Navigate to your storage account > Networking > Firewalls and virtual networks and temporarily set "Allow access from" to "All networks", if the query suddenly works, the firewall is your culprit.
1
Diagnose the Error Code and Locate the Exact Failure Point

The first thing I do on any Azure Synapse serverless SQL troubleshooting session is get the full error, not just what shows in Synapse Studio's output panel, but the complete diagnostic chain. Synapse Studio often truncates error details.

In Synapse Studio, after a failed query, click the Output tab, then look for a small "Details" link or expand the error message fully. Copy everything. You're looking for these specific error codes:

  • Error 13822, File cannot be opened. Usually a storage access or firewall issue.
  • Error 16000, Distributed query failed. Often a schema mismatch or resource limit.
  • Error 15060, The credential specified does not exist or is not accessible.
  • Error 207, Invalid column name. Your WITH clause column names don't match the actual file.
  • Error 4861, Cannot bulk load. Usually a network path or SAS token issue.

For deeper diagnostics, run this query in the serverless pool, it queries the dynamic management views (DMVs) that Synapse exposes:

SELECT 
    request_id,
    session_id,
    status,
    submit_time,
    start_time,
    end_time,
    total_elapsed_time,
    error_id,
    command
FROM sys.dm_exec_requests
WHERE status IN ('Failed', 'Cancelled')
ORDER BY submit_time DESC;

Then take the request_id from any failed request and run:

SELECT *
FROM sys.dm_exec_query_stats
WHERE sql_handle IS NOT NULL
ORDER BY last_execution_time DESC;

If you see the request in sys.dm_exec_requests with a status of "Failed" and an error_id, that numeric ID maps to sys.messages, though serverless SQL has a limited catalog compared to SQL Server. What you're really looking for is whether the error occurred during query compilation (access/schema issues surface here) or execution (resource and data issues surface here). The start_time versus submit_time gap tells you this: a zero or near-zero gap means the query never even started executing, which points to access or credential failure.

If the query ran and failed mid-execution, note the total_elapsed_time. Values over 600,000 milliseconds (10 minutes) indicate you hit the serverless SQL query timeout limit.

2
Fix Storage Access, Role Assignments and Managed Identity

Access control problems are the number one cause of Azure Synapse Analytics serverless SQL query failures. There are two separate permission systems to check: Azure RBAC roles on the storage account, and the Synapse workspace's managed identity configuration.

Step 2a, Fix Azure RBAC role assignments. Open the Azure Portal. Navigate to your ADLS Gen2 storage account. Click Access Control (IAM) in the left menu. Click Add > Add role assignment. Select Storage Blob Data Reader (or Contributor if your queries write data). Click Next. Under "Assign access to," select Managed identity. Click Select members, search for your Synapse workspace name, select it, and click Save.

Critically: if you're running queries as a specific user (not the workspace managed identity), that user's Azure AD account also needs the Storage Blob Data Reader role at the storage account level. Add it the same way, selecting "User, group, or service principal" instead of "Managed identity."

Step 2b, Check Synapse Analytics workspace managed identity. In the Azure Portal, open your Synapse workspace. Go to Settings > Identity. Confirm that "Status" under System assigned managed identity shows On. If it shows Off, toggle it on and save. The managed identity is how Synapse authenticates to storage without explicit credentials when you use the default authentication path.

Step 2c, Verify with a credential-explicit query. If you have a SAS token or you're using a database-scoped credential, test it directly:

-- First check your credentials exist
SELECT name, credential_identity 
FROM sys.database_scoped_credentials;

-- Then test access explicitly
SELECT TOP 5 *
FROM OPENROWSET(
    BULK 'https://youraccount.dfs.core.windows.net/container/path/*.parquet',
    FORMAT = 'PARQUET',
    DATA_SOURCE = 'YourExternalDataSource'
) AS data;

If this works but queries without DATA_SOURCE don't, the managed identity path has a problem. If neither works, the storage account itself is blocking access, move to Step 3.

When the permissions are correct, your query will return results instead of throwing "File cannot be opened" or "Access denied." Expect a 2-5 minute propagation delay after adding role assignments, don't panic if it doesn't work immediately.

3
Resolve Network and Firewall Blocking

Network configuration is the silent killer of Azure Synapse serverless SQL queries. Everything can look correct in IAM and credentials, yet queries still fail, because the storage account firewall is dropping the connection before authentication even occurs.

Step 3a, Check the storage account firewall. In the Azure Portal, navigate to your ADLS Gen2 storage account. Click Networking in the left menu (under Security + networking). Look at the "Firewall and virtual networks" tab. If "Enabled from selected virtual networks and IP addresses" is selected, you need to explicitly allow Synapse. Under "Resource instances," click Add existing resource type, select resource type Microsoft.Synapse/workspaces, and add your workspace. Also check the checkbox for "Allow Azure services on the trusted services list to access this storage account." Synapse is on that list, enabling this alone fixes a large percentage of firewall-related failures.

Step 3b, Check the Synapse workspace firewall. In Synapse Studio, click Manage > Security > Firewall. If you're connecting from a corporate network or your own machine, your IP must be in the allowed list. Click Add client IP to add your current IP automatically. For enterprise environments, you may need to add IP ranges for your NAT gateway or VPN egress IPs.

Step 3c, Private endpoint scenarios. If your Synapse workspace uses private endpoints (common in enterprise deployments), the workspace communicates with storage over the private network. In this case, the storage account must have a private endpoint configured in the same VNet. Check this in your storage account under Networking > Private endpoint connections. The endpoint status should show "Approved." If it shows "Pending," someone needs to approve it in the Azure Portal, often this is a subscription owner or network administrator task.

You can validate network connectivity by running this from the Synapse SQL script editor:

-- This will tell you if Synapse can see the storage at all
SELECT *
FROM OPENROWSET(
    BULK 'https://youraccount.blob.core.windows.net/container/',
    FORMAT = 'CSV'
) AS test;

A firewall error returns within 1-2 seconds with a network-level error. A permission error may take longer as it gets further into the auth chain. Speed of failure is itself a diagnostic signal.

4
Fix OPENROWSET Schema Errors and External Table Definition Problems

Once access is confirmed working, the next common failure category in Azure Synapse serverless SQL troubleshooting is schema definition errors. These show up as error 207 (invalid column name), error 16000 (distributed query failure), or just unexpected empty results when you know data exists.

Step 4a, Fix OPENROWSET WITH clause type mismatches. The WITH clause in OPENROWSET is strict. Common mistakes:

-- WRONG: Using VARCHAR without length for columns that have long values
SELECT * FROM OPENROWSET(
    BULK 'https://account.dfs.core.windows.net/container/data.csv',
    FORMAT = 'CSV',
    HEADER_ROW = TRUE
) WITH (
    ProductName VARCHAR,       -- This will fail or truncate
    SaleAmount FLOAT           -- Float may not match DECIMAL in the file
) AS r;

-- CORRECT: Specify lengths and use appropriate types
SELECT * FROM OPENROWSET(
    BULK 'https://account.dfs.core.windows.net/container/data.csv',
    FORMAT = 'CSV',
    HEADER_ROW = TRUE
) WITH (
    ProductName VARCHAR(500),
    SaleAmount DECIMAL(18,2)
) AS r;

Step 4b, Fix Parquet column name mismatches. Parquet files are case-sensitive in Synapse serverless. If your file has a column named customerID and you reference CustomerID in your WITH clause, it will fail. Use this technique to first discover the actual schema:

-- Discover Parquet schema without a WITH clause
SELECT TOP 1 *
FROM OPENROWSET(
    BULK 'https://account.dfs.core.windows.net/container/data.parquet',
    FORMAT = 'PARQUET'
) AS discover;

The column names returned by that discovery query are exactly what you must use in any WITH clause.

Step 4c, Fix external table errors. External tables in serverless SQL require an external data source and external file format. If you're seeing "External table is not accessible," run:

SELECT name, location, type_desc
FROM sys.external_data_sources;

SELECT name, format_type, field_terminator, string_delimiter
FROM sys.external_file_formats;

Verify the location URL in your external data source starts with abfss:// (for ADLS Gen2 with hierarchical namespace), not https:// or wasbs://. The protocol prefix matters, this is a frequent source of silent failures.

5
Resolve Query Performance and Timeout Issues

Azure Synapse Analytics serverless SQL has a distributed cost model where each query is billed and constrained by the amount of data it processes. Queries that process more than ~10 TB will time out, and queries that run without proper partitioning can be unexpectedly slow and expensive.

Step 5a, Check query data processed. After any query runs (even one that times out), Synapse Studio shows "Data processed" in the output tab. If you're seeing hundreds of GB or multiple TB for what should be a simple query, your query is doing a full data lake scan. This is the problem.

Step 5b, Add partition elimination with WHERE clauses. If your data is stored in a folder structure like /year=2025/month=04/, use wildcards with filtering:

-- Instead of scanning everything:
SELECT * FROM OPENROWSET(
    BULK 'https://account.dfs.core.windows.net/container/**',
    FORMAT = 'PARQUET'
) AS r
WHERE year = 2025 AND month = 4;

-- Use folder-level filtering in the BULK path:
SELECT * FROM OPENROWSET(
    BULK 'https://account.dfs.core.windows.net/container/year=2025/month=04/*.parquet',
    FORMAT = 'PARQUET'
) AS r;

The second form processes only the relevant partition folder. For a dataset with 36 months of history, this can reduce data processed by 97%.

Step 5c, Handle query timeout errors. The serverless SQL pool has a built-in query timeout. For long-running analytical queries, you have a few options. First, create a statistics object to help the query planner:

CREATE STATISTICS stats_sales_date
ON your_external_table (sale_date)
WITH FULLSCAN;

Second, break large queries into smaller CTEs or temp results using CREATE EXTERNAL TABLE AS SELECT (CETAS) to materialize intermediate results to storage. Third, for truly massive analytical workloads that keep timing out in serverless SQL, consider whether a dedicated SQL pool is more appropriate, serverless SQL is optimized for ad-hoc exploration, not sustained heavy analytics.

When performance is properly optimized, a well-partitioned Parquet query over 100 GB of data should complete in under 30 seconds and cost less than $0.05 per execution.

Advanced Troubleshooting

For enterprise environments, domain-joined clients, and cases where the basics haven't resolved the Azure Synapse Analytics serverless SQL problem, these deeper diagnostics apply.

Azure Active Directory and conditional access problems. In enterprise tenants with conditional access policies, your Azure AD token may be valid but blocked by a policy requiring MFA re-authentication or a compliant device. If your queries fail immediately with authentication errors despite correct role assignments, check your Azure AD sign-in logs. In the Azure Portal, navigate to Azure Active Directory > Monitoring > Sign-in logs, filter by your user, and look for sign-in attempts to "Azure SQL Database" or "Azure Synapse Analytics", these are the resource names Synapse uses for authentication. Conditional access blocks show up here with specific policy names.

Synapse Analytics workspace diagnostic logs. Synapse workspaces can be configured to send diagnostic logs to a Log Analytics workspace. If this is configured, open Azure Monitor > Log Analytics workspaces, select the workspace linked to Synapse, and run:

SynapseBuiltinSqlPoolRequestsEnded
| where Status == "Failed"
| where TimeGenerated > ago(1h)
| project TimeGenerated, Status, ErrorCode, ErrorMessage, DataProcessedBytes, LoginName
| order by TimeGenerated desc

The ErrorMessage field in these logs is significantly more detailed than what surfaces in Synapse Studio. This is frequently where you find the actual root cause, particularly for errors that appear generic in the UI.

Database-scoped credential rotation issues. When SAS tokens expire, all queries using those credentials fail simultaneously, which can look like an outage. Check token expiry:

-- In the serverless pool master database
SELECT name, credential_identity, create_date, modify_date
FROM sys.database_scoped_credentials
ORDER BY modify_date;

Compare modify_date against when your failures started. If they align, regenerate the SAS token in the storage account under Security + networking > Shared access signature and update the credential using ALTER DATABASE SCOPED CREDENTIAL or, better, point it to an Azure Key Vault secret that auto-rotates.

Cross-region latency and replication lag. If your Synapse workspace is in East US but your ADLS Gen2 is in West Europe, you'll see elevated query latency and occasional timeout failures. This is not a misconfiguration, it's physics. For production workloads, co-locate your Synapse workspace and primary storage account in the same Azure region. Secondary storage regions for geo-redundancy are fine, but the primary query target should be local.

UTF-8 encoding and BOM issues with CSV files. CSV files saved by Excel or certain ETL tools often include a UTF-8 BOM (byte order mark) at the start of the file. Serverless SQL's CSV parser can interpret this as part of the first column name or value, causing mysterious schema mismatches. Add ROWSET_OPTIONS = '{"READ_OPTIONS":["ALLOW_INCONSISTENT_READS"]}' to your OPENROWSET call or, better, convert your source files to UTF-8 without BOM before loading.

When to Call Microsoft Support

Escalate to Microsoft Support when: your workspace diagnostic logs show repeated error codes in the 50000-59999 range (these are internal Synapse service errors, not user-fixable), when your serverless pool is completely inaccessible and Azure Status (status.azure.com) shows no active incidents, or when you've correctly configured all permissions and network settings but queries still fail consistently. Open a support ticket with severity B or A and include your workspace name, exact error codes, the timestamp of failures, and the output of the DMV queries from Step 1, this dramatically speeds up the Microsoft engineer's investigation.

Prevention & Best Practices

The best Azure Synapse Analytics serverless SQL troubleshooting is the kind you never have to do. After working through hundreds of these issues, I've identified the patterns that prevent 90% of problems before they ever surface in production.

Design your data lake structure for query efficiency from day one. Serverless SQL performs best when data is stored in Apache Parquet format (not CSV), partitioned by date or another high-cardinality filter column, and sized in files between 100 MB and 1 GB each. Thousands of tiny files (under 1 MB) massively increase overhead because Synapse issues a separate storage request for each file. Run a consolidation job periodically using Synapse Spark notebooks to merge small files into larger ones, this is often called "small file compaction."

Always use managed identity for storage authentication. SAS tokens expire. Service principal secrets rotate. Managed identity is perpetual and requires no secret management. Configure it once at workspace creation and apply Storage Blob Data Reader at the subscription or resource group level (rather than individual storage accounts) if you have multiple lakes, this eliminates entire categories of permission errors as new storage accounts are added.

Create external tables and views instead of raw OPENROWSET queries. Wrapping your OPENROWSET calls in external tables or database views gives you a stable interface that consumers can query without needing to know storage paths, credentials, or file formats. When the underlying storage changes, you update the external table definition in one place. This also makes it easier to apply consistent column type definitions and catch schema drift early.

Set up Azure Monitor alerts for serverless SQL failures. In the Azure Portal, go to your Synapse workspace > Monitoring > Alerts > New alert rule. Configure an alert on the metric "Built-in SQL pool failed requests" with a threshold of greater than 5 in a 5-minute window. This catches access configuration failures the moment they occur, before your downstream pipelines and reports start breaking silently.

Quick Wins
  • Convert all CSV data lake files to Parquet, queries run 5-10x faster and cost proportionally less data processed
  • Set the serverless SQL pool query result cache TTL appropriately for your data freshness needs (Synapse Studio > Manage > SQL pools > Built-in > Settings)
  • Use CREATE STATISTICS on your external table columns used in WHERE clauses and JOINs, the serverless query optimizer uses these heavily
  • Tag all Azure resources (workspace, storage, Key Vault) with the same environment and project tags to simplify access policy auditing and troubleshooting blast radius

Frequently Asked Questions

Why does my Azure Synapse serverless SQL query work in Synapse Studio but fail in Power BI?

This almost always comes down to the authentication method Power BI uses to connect. Synapse Studio authenticates using your Azure AD user token directly, while Power BI Desktop authenticates using its own credential store, and the account configured in Power BI's data source settings may not have the Storage Blob Data Reader role that your personal account does. Open Power BI Desktop, go to File > Options and settings > Data source settings, find your Synapse serverless endpoint, click Edit permissions, and make sure you're using an organizational account (Azure AD) with the right credentials, not Windows authentication. Also confirm the service principal or user account configured for the Power BI service (if using scheduled refresh) has the same RBAC roles as your personal account.

What's the difference between the serverless SQL pool endpoint and the dedicated SQL pool endpoint?

The serverless SQL pool endpoint follows the pattern workspacename-ondemand.sql.azuresynapse.net, note the -ondemand suffix. The dedicated SQL pool endpoint is just workspacename.sql.azuresynapse.net without any suffix. Connecting to the wrong endpoint is one of the most common mistakes I see: connecting to the dedicated pool endpoint but expecting serverless behavior, or vice versa. When using SSMS, Azure Data Studio, or any JDBC/ODBC connection string, triple-check which endpoint you're using. In Synapse Studio, the "Built-in" pool shown in the SQL script toolbar is always the serverless pool, no endpoint confusion possible there.

My OPENROWSET query returns zero rows but I can see files in the storage container, what's wrong?

Zero rows without an error usually means either your BULK path wildcard doesn't match any files, or your WITH clause has a data type that causes all rows to be silently filtered out. Start by testing without a WITH clause to confirm schema-free access returns rows. Then add a HEADER_ROW = TRUE parameter if your CSV has headers and you're not using it. Also check your path, container/folder/*.parquet only matches files directly in that folder; use container/folder/** to recurse into subfolders. Finally, verify the files are actually complete and not still being written by an upstream process, as partially written files can cause empty result sets without errors.

How do I fix "The used credential does not have access to the file" error even though I set up the managed identity?

This specific error means Synapse is trying to use a credential (or the anonymous / managed identity path) and it's being rejected at the storage layer. Three things to check in order: first, verify the Synapse workspace system-assigned managed identity is enabled (Portal > Synapse Workspace > Identity > Status = On). Second, confirm the managed identity object ID shown there is actually assigned the Storage Blob Data Reader role on the storage account, go to the storage account's IAM and search by that exact object ID. Third, if your storage account has hierarchical namespace enabled (ADLS Gen2), make sure you're using the DFS endpoint (account.dfs.core.windows.net) in your BULK path, not the blob endpoint (account.blob.core.windows.net), the access control model differs between the two.

Can I run stored procedures in Azure Synapse serverless SQL?

Yes, serverless SQL pools support stored procedures, views, and table-valued functions, but with important limitations. Stored procedures in serverless SQL cannot create permanent tables (there's no tempdb in the traditional sense), cannot use transactions across external data sources, and cannot use SQL Agent or scheduled execution natively. What they can do is encapsulate OPENROWSET logic, accept parameters to filter data, and return result sets. Store your procedures in a user database (not master), and be aware that all DDL operations in serverless SQL are per-database scoped, objects in one database are not visible in another unless you use three-part naming or cross-database queries.

How much does Azure Synapse serverless SQL actually cost and how do I control it?

Serverless SQL pricing is $5 per TB of data processed (as of early 2026, check the Azure pricing calculator for current rates in your region). There's a minimum of 10 MB per query. The best way to control costs is to store data in Parquet format (Parquet's columnar compression means Synapse only reads columns you reference, not entire rows), partition your data so WHERE clause filtering eliminates folders before scanning, and use column projection to select only the columns you need rather than SELECT *. You can set a cost management alert in Azure Cost Management for the Synapse workspace resource, and in Synapse Studio you can see "Data processed" per query in the output tab to identify expensive queries before they run repeatedly in production pipelines.

Related Microsoft Fix Guides

H
Sai Kiran Pandrala
Our team includes certified Microsoft engineers, Azure architects, and system administrators with 10+ years of enterprise IT experience. Every guide is written from hands-on troubleshooting, not guesswork. We test every fix before publishing.