Unable to create Synapse Administrator role access within Synapse Studio

Question

Unable to create Synapse Administrator role access within Synapse Studio

Martin Hansen 20

The entra user that previusly held the Synapse Administrator role access within Synapse Studio have left the company and the user have been been deleted.

I hold both the owner and the contributer access rights got the Synaps workspace - but I can't assign myself the Synapse Administrator role access within Synapse Studio.

What am I missing? There must be some way to grant Synapse Administrator role access within Synapse Studio without already being an Synapse Administrator.

best regards

Martin

0 comments

Answer accepted by question author

Jose Benjamin Solis Nolasco 12,036 Volunteer Moderator

Welcome to Microsoft Q&A,

Hello @Martin Hansen , I hope you are doing well,

You are correct that Azure Owner and Synapse Administrator are different roles. However, Microsoft provides a recovery mechanism for exactly this situation when the original Synapse Administrator is no longer available.

Since you have Owner access through the subscription, you should be able to manage Azure RBAC assignments on the Synapse workspace. If Synapse Studio returns "Failed to add the role assignment", I recommend trying the assignment through PowerShell instead of Synapse Studio.

For example:

New-AzSynapseRoleAssignment `
  -WorkspaceName "<workspace-name>" `
  -RoleDefinitionName "Synapse Administrator" `
  -ObjectId "<your-Entra-object-id>"

Microsoft also documents using the role definition ID directly when the user has Azure RBAC permissions but is not yet a Synapse Administrator:

New-AzSynapseRoleAssignment `
  -WorkspaceName "<workspace-name>" `
  -RoleDefinitionId "00001111-aaaa-2222-bbbb-3333cccc4444" `
  -ObjectId "<your-Entra-object-id>"

The second approach can be useful because resolving the role by name may itself require permissions that you don't yet have.Before running it, verify that your Owner assignment is effective at the Synapse workspace scope or above, and that you are working in the correct Microsoft Entra tenant.

Once the Synapse Administrator assignment is restored, you can manage the remaining Synapse RBAC assignments from Synapse Studio > Manage > Security > Access control.

References:

Manage Synapse RBAC role assignments

New-AzSynapseRoleAssignment PowerShell documentation

If the PowerShell assignment also fails despite the effective Owner permission, please provide the exact error returned by New-AzSynapseRoleAssignment (with tenant/subscription IDs redacted). That will help determine whether this is an Azure RBAC permission issue or a Synapse backend issue.

If my answer helped you, please consider marking it as accepted. This helps others in the community find similar solutions.

Martin Hansen 20 Reputation points

2026-08-07T14:28:09.1633333+00:00

Thank you very much for your help here @Jose Benjamin Solis Nolasco

I'm not shure what I'm missing here - but there must be something

When I execute the command below using Azure Cloud Shell

New-AzSynapseRoleAssignment -WorkspaceName "<workspace-name>"
-RoleDefinitionName "Synapse Administrator" `
-ObjectId "<myuser>@<myorg>.com"

I get the error message below:

New-AzSynapseRoleAssignment: The principal '<REMOVED>' does not have the required Synapse RBAC permission to perform this action.
Required permission: Action: Microsoft.Synapse/workspaces/read, Scope: workspaces/<REMOVED>/*.

Status: 403 (Forbidden)

ErrorCode: Unauthorized

Content:

{"error":{"code":"Unauthorized","message":"The principal '<REMOVED>' does not have the required Synapse RBAC permission to perform this action. Required permission: Action: Microsoft.Synapse/workspaces/read, Scope: workspaces/<REMOVED>/*."}}

It doesn't make sence as I have the owner permission :-(
What is the missing piece in the puzzle?
Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-07T15:42:10.72+00:00
The error actually points to the missing piece. Your Azure Owner role gives you Azure RBAC permissions, but it does not automatically grant you Synapse RBAC permissions. Microsoft documents a specific recovery path for this situation.

The important detail is that you are currently using:

-RoleDefinitionName "Synapse Administrator"

When New-AzSynapseRoleAssignment uses the role name, it first needs Microsoft.Synapse/workspaces/read. Because you are not currently a Synapse Administrator, that permission is missing, which explains the 403 error.

Since you are an Azure Owner, use the role definition ID directly instead of the role name:

$ws = Get-AzSynapseWorkspace -Name "<workspace-name>" $ws | New-AzSynapseRoleAssignment ` -RoleDefinitionId "00001111-aaaa-2222-bbbb-3333cccc4444" ` -ObjectId "<your-Entra-object-id>"

Microsoft specifically recommends this method for a user who can manage Azure RBAC assignments on the workspace but is not currently a Synapse Administrator.

Also, make sure <your-Entra-object-id> is the Object ID of your user, not your UPN/email address.

Once the assignment succeeds, you should have the Synapse Administrator role at workspace scope and can manage the remaining Synapse RBAC assignments from Synapse Studio.

If the command using -RoleDefinitionId also returns 403, please share that exact error. At that point we can determine whether your Owner assignment is not being recognized at the workspace scope or whether there is another authorization issue.
Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-07T17:10:20.2066667+00:00

@Martin Hansen Please review the execute comand New-AzSynapseRoleAssignment uses the role name, it first needs Microsoft.Synapse/workspaces/read. Because you are not currently a Synapse Administrator, that permission is missing, which explains the 403 error you are getting
Martin Hansen 20 Reputation points

2026-08-07T17:31:10.28+00:00

Hi @Jose Benjamin Solis Nolasco

First of all - thank you alot for taking the time for helping me out. It is really apreciated!!!

I believe that your answer is very close to solving this puzzle.

When I run the commands that you proposed

$ws = Get-AzSynapseWorkspace -Name <workspace-name>

$ws | New-AzSynapseRoleAssignment -RoleDefinitionId "00001111-aaaa-2222-bbbb-3333cccc4444" -ObjectId "xxxxxxxx-yyyy-yyyy-zzzz-zzzzzzzzzzzz"

I get the responce :

New-AzSynapseRoleAssignment: The principal 'xxxxxxxx-yyyy-yyyy-zzzz-zzzzzzzzzzzz' does not have the required Synapse RBAC permission 'Microsoft.Synapse/workspaces/roleAssignments/write' at scope 'workspaces/<workspace-name>' or Azure RBAC permission 'Microsoft.Authorization/roleAssignments/write' at scope 'subscriptions/<subscription_id>/resourceGroups/<resourcegroup_name>/providers/Microsoft.Synapse/workspaces/<workspace-name>' to perform this action.

Status: 403 (Forbidden)

ErrorCode: Unauthorized

Content:

{"error":{"code":"Unauthorized","message":"The principal 'xxxxxxxx-yyyy-yyyy-zzzz-zzzzzzzzzzzz' does not have the required Synapse RBAC permission 'Microsoft.Synapse/workspaces/roleAssignments/write' at scope 'workspaces/<workspace-name>' or Azure RBAC permission 'Microsoft.Authorization/roleAssignments/write' at scope 'subscriptions/<subscription_id>/resourceGroups/<resourcegroup_name>/providers/Microsoft.Synapse/workspaces/<workspace-name>' to perform this action."}}

So I get beyond the "read stuff" part of the role assignment - and into the "write stuff" part of the assignment.

I've stumpled upon this thing when I look at access rights to the Synaps workspace - where there are a condition attached with the owner access right

Looks like that I might not be that much of an owner after all ...

Because ...

So I think I need to talk with some one with more admin access than myself to lift those conditions (or have them run the command).

Or do you have any good ideas?
Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-07T17:58:23.31+00:00

@Martin Hansen Good troubleshooting, beside that definly you will need anyone with unconditioned Owner or User Access Administrator at the resource group (or workspace) scope can run your exact New-AzSynapseRoleAssignment command and it will succeed immediately, since they don't hit the condition.

thats why you couldn't get control because of that condition.

Let me know if you need futher help @Martin Hansen

Please do not forget to "Accept the answer” and upvote it wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.
Martin Hansen 20 Reputation points

2026-08-10T08:00:15.65+00:00
One small thing if some one elses end up reading this conversation :-)

The RoleDefinitionId in the documentation is wrong - the Synapse Administrator role don't have the RoleDefinitionId = "00001111-aaaa-2222-bbbb-3333cccc4444".

In order to get the correct RoleDefinitionId one must execute the command

Get-AzSynapseRoleDefinition -WorkspaceName <workspace-name>

and in the output find the Id of the Synapse Administrator - and use that Id for the RoleDefinitionId

2 additional answers

Your answer

Martin Hansen 20 Reputation points

2026-08-07T14:28:09.1633333+00:00

Thank you very much for your help here @Jose Benjamin Solis Nolasco

I'm not shure what I'm missing here - but there must be something

When I execute the command below using Azure Cloud Shell

New-AzSynapseRoleAssignment -WorkspaceName "<workspace-name>"
-RoleDefinitionName "Synapse Administrator" `
-ObjectId "<myuser>@<myorg>.com"

I get the error message below:

New-AzSynapseRoleAssignment: The principal '<REMOVED>' does not have the required Synapse RBAC permission to perform this action.
Required permission: Action: Microsoft.Synapse/workspaces/read, Scope: workspaces/<REMOVED>/*.

Status: 403 (Forbidden)

ErrorCode: Unauthorized

Content:

{"error":{"code":"Unauthorized","message":"The principal '<REMOVED>' does not have the required Synapse RBAC permission to perform this action. Required permission: Action: Microsoft.Synapse/workspaces/read, Scope: workspaces/<REMOVED>/*."}}

It doesn't make sence as I have the owner permission :-(
What is the missing piece in the puzzle?
Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-07T15:42:10.72+00:00

The error actually points to the missing piece. Your Azure Owner role gives you Azure RBAC permissions, but it does not automatically grant you Synapse RBAC permissions. Microsoft documents a specific recovery path for this situation.

The important detail is that you are currently using:

-RoleDefinitionName "Synapse Administrator"

When New-AzSynapseRoleAssignment uses the role name, it first needs Microsoft.Synapse/workspaces/read. Because you are not currently a Synapse Administrator, that permission is missing, which explains the 403 error.

Since you are an Azure Owner, use the role definition ID directly instead of the role name:

$ws = Get-AzSynapseWorkspace -Name "<workspace-name>" $ws | New-AzSynapseRoleAssignment ` -RoleDefinitionId "00001111-aaaa-2222-bbbb-3333cccc4444" ` -ObjectId "<your-Entra-object-id>"

Microsoft specifically recommends this method for a user who can manage Azure RBAC assignments on the workspace but is not currently a Synapse Administrator.

Also, make sure <your-Entra-object-id> is the Object ID of your user, not your UPN/email address.

Once the assignment succeeds, you should have the Synapse Administrator role at workspace scope and can manage the remaining Synapse RBAC assignments from Synapse Studio.

If the command using -RoleDefinitionId also returns 403, please share that exact error. At that point we can determine whether your Owner assignment is not being recognized at the workspace scope or whether there is another authorization issue.
Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-07T17:10:20.2066667+00:00

@Martin Hansen Please review the execute comand New-AzSynapseRoleAssignment uses the role name, it first needs Microsoft.Synapse/workspaces/read. Because you are not currently a Synapse Administrator, that permission is missing, which explains the 403 error you are getting
Jose Benjamin Solis Nolasco 12,036 Reputation points Volunteer Moderator

2026-08-07T17:58:23.31+00:00

@Martin Hansen Good troubleshooting, beside that definly you will need anyone with unconditioned Owner or User Access Administrator at the resource group (or workspace) scope can run your exact New-AzSynapseRoleAssignment command and it will succeed immediately, since they don't hit the condition.

thats why you couldn't get control because of that condition.

Let me know if you need futher help @Martin Hansen

Please do not forget to "Accept the answer” and upvote it wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.
Martin Hansen 20 Reputation points

2026-08-10T08:00:15.65+00:00

One small thing if some one elses end up reading this conversation :-)

The RoleDefinitionId in the documentation is wrong - the Synapse Administrator role don't have the RoleDefinitionId = "00001111-aaaa-2222-bbbb-3333cccc4444".

In order to get the correct RoleDefinitionId one must execute the command

Get-AzSynapseRoleDefinition -WorkspaceName <workspace-name>

and in the output find the Id of the Synapse Administrator - and use that Id for the RoleDefinitionId

Answer 1

Yes. A current Synapse Administrator is not required if there are no available Synapse Administrators.

A user who has permission to manage Azure RBAC role assignments on the Synapse workspace can also manage Synapse RBAC role assignments. That allows adding the Synapse Administrator role even when the previous Synapse Administrator has left.

What to do:

Open Synapse Studio for the workspace.
Go to Manage > Security > Access control.
Select + Add.
Set Scope to Workspace.
Select the Synapse Administrator role.
Select the required user or group.
Create the role assignment.

Important details:

Synapse RBAC is managed in Synapse Studio, not in Azure portal.
To manage Synapse RBAC role assignments normally, a user needs the Synapse Administrator role at the relevant scope.
However, to recover access when no Synapse Administrators are assigned or available, a user with permission to manage Azure RBAC role assignments on the workspace can still manage Synapse RBAC role assignments.
Changes to Synapse RBAC role assignments can take 2–5 minutes to take effect.
If access is granted through a Microsoft Entra group, group membership changes can take 10–15 minutes or longer to take effect.

What is likely missing:

Contributor is not enough for this recovery path.
The required capability is permission to manage Azure RBAC role assignments on the workspace. The documented example for adding an administrator assigns Owner on the workspace, then assigns Synapse Administrator in Synapse Studio.

If the Add option in Synapse Studio is unavailable or access is denied, check whether the current workspace role assignment is truly Owner on the Synapse workspace resource and not only Contributor.

Answer 2

Martin Hansen 20

I am assigned the owner role through the parrent subscription (as well as the contributer role)
User's image

So I should have the requred access rights

But I still get the "Failed to add the role assignment" in Synapse Studio when I try to add the Synapse Administrator role to my user

0 comments