Error 401 when trying to access a Private Endpoint

Question

Error 401 when trying to access a Private Endpoint

Charly Gerald 20

A private endpoint request from Microsoft Fabric to an Azure SQL DB is displaying the following message:

{

"sessionId":"62903e40ca1f4055b7f7fe24e30d261b"

,"subscriptionId":"171c93d8-7864-4c53-842b-36ff98e977b8"

,"resourceGroup":"vnet-171c93d8-EastUS-189-rg"

,"errorCode":"401"

,"resourceId":"/subscriptions/171c93d8-7864-4c53-842b-36ff98e977b8/resourceGroups/vnet-171c93d8-EastUS-189-rg/providers/Microsoft.Network/privateEndpoints/553f0c4f-bacf-45ee-8afb-4973685c896b.mpe_azuredb_fabric",

"resourceName":"553f0c4f-bacf-45ee-8afb-4973685c896b.mpe_azuredb_fabric"

,"details":

	"The access token is from the wrong issuer 'https://sts.windows.net/6a6131c7-ecda-42b0-bf16-ec3dbd397f92/'. 

	It must match the tenant 'https://sts.windows.net/33e01921-4d64-4f8c-a055-5bdaffd5e33d/' associated with this subscription. 

	Please use the authority (URL) 'https://login.windows.net/33e01921-4d64-4f8c-a055-5bdaffd5e33d' to get the token. 


	

	Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant 

	could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later."
```}

I have noticed that the Azure DB's Resource ID does not match my Tenant ID.  
  
I need help

Charly Gerald 20 Reputation points

2026-02-20T20:11:18.0233333+00:00

The resource I'm trying to access is associated with my tenant, but for some reason, the Resource ID property is displaying the wrong tenant id. That's precisely the problem. How can I update the Resource ID property of my Azure SQL Server?
Erland Sommarskog 137.5K Reputation points MVP Volunteer Moderator

2026-02-21T11:38:37.27+00:00

I note that Microsoft External Staff member changed the tag of the post to Community Center | Not monitored with no further comment.

To some extent I can understand this, since Fabric is not covered by Microsoft Q&A, but for questions on Fabric the place to go is https://community.fabric.microsoft.com/. But, clearly, your question also involves Azure SQL Database, so I have restored the original tag. It may be that the resolution for this problem is on the Fabric side of things, but my own knowledge is not good enough to tell.
Charly Gerald 20 Reputation points

2026-02-21T13:02:37.5933333+00:00

Thank you very much @Erland Sommarskog . I will re-post the same question in the Microsoft Fabric Channel

1 answer

Your answer

Charly Gerald 20 Reputation points

2026-02-20T20:11:18.0233333+00:00

The resource I'm trying to access is associated with my tenant, but for some reason, the Resource ID property is displaying the wrong tenant id. That's precisely the problem. How can I update the Resource ID property of my Azure SQL Server?
Erland Sommarskog 137.5K Reputation points MVP Volunteer Moderator

2026-02-21T11:38:37.27+00:00

I note that Microsoft External Staff member changed the tag of the post to Community Center | Not monitored with no further comment.

To some extent I can understand this, since Fabric is not covered by Microsoft Q&A, but for questions on Fabric the place to go is https://community.fabric.microsoft.com/. But, clearly, your question also involves Azure SQL Database, so I have restored the original tag. It may be that the resolution for this problem is on the Fabric side of things, but my own knowledge is not good enough to tell.
Charly Gerald 20 Reputation points

2026-02-21T13:02:37.5933333+00:00

Thank you very much @Erland Sommarskog . I will re-post the same question in the Microsoft Fabric Channel

Answer 1

The error you are encountering (401 Unauthorized) indicates that the access token being used is from the wrong issuer. Specifically, it mentions that the token must match the tenant associated with your subscription. Here are some steps you can take to resolve this issue:

Check Tenant ID: Ensure that you are using the correct tenant ID when requesting the access token. The error message specifies that you should use the authority URL https://login.windows.net/33e01921-4d64-4f8c-a055-5bdaffd5e33d to obtain the token.
Token Acquisition: When acquiring the token, make sure that the request is made to the correct tenant. This typically involves specifying the tenant ID in your authentication request.
Subscription Transfer: If you have recently transferred your subscription to a different tenant, it may take some time for the changes to propagate. If this is the case, you might need to wait for up to an hour and try again.
Verify Resource ID: As you noted, the Azure DB's Resource ID should align with your Tenant ID. Ensure that the resource you are trying to access is indeed associated with the tenant you are using to authenticate.
Permissions: Ensure that the account you are using has the necessary permissions to access the Azure SQL Database through the private endpoint.

By following these steps, you should be able to resolve the 401 error and successfully connect to your Azure SQL Database through the private endpoint.