"UnauthorizedDataError: data set DataCache:2:3"

Hi **Jeanne Kacprzak,

**Please confirm if this is Azure sql database or Azure SQL VM.

If it is Azure SQL VM, The cause was because of the missing Reader role permissions on the NIC of the VM. Required permissions to enable Bastion connection:

Reader role on the Virtual Machine

Reader role on the NIC of the VM (with private IP)

Reader role on the Azure Bastion resource

Reader role on the Virtual Network of the target VM (if Bastion is deployed in a peered network)

Hi Jeanne Kacprzak,
Adding to the above response, if you are using Azure Machine Learning datastore or data assets, this error is commonly seen when the workspace managed identity or service principal does not have a corresponding user inside the Azure SQL Database.

In such cases, please ensure that the identity is created as a user in the database and granted appropriate permissions (for example, db_datareader). Also, verify that the identity has at least Reader access on the SQL server resource so it can retrieve metadata such as firewall rules.

You can refer to the following Microsoft documentation for more details on datastore authentication and identity-based access: https://learn.microsoft.com/en-us/azure/machine-learning/concept-data

The error "UnauthorizedDataError: data set DataCache:2:3" usually means the identity being used to connect to the database is not allowed to access it. In Azure, this can happen when the database or server no longer exists, the saved authentication details are wrong, or the service principal, managed identity, or user account does not have enough permissions on the SQL database.

It can also happen when Azure cannot get the access token it needs, or when it cannot read required information such as firewall or resource settings.

As steps to solve this issue, first confirm that the Azure SQL logical server and database still exist and that the connection is pointing to the correct resources. Then verify that the authentication method is valid and that the identity being used has the required permissions on both Azure and the database.

"UnauthorizedDataError: data set DataCache:2:3" indicates that the identity used to access the underlying database for that data set is not authorized.

For Azure SQL Database accessed through an Azure Machine Learning datastore or data asset, unauthorized or authentication-related errors typically occur when:

1. The database or server cannot be found or no longer exists.
2. The authentication method or credentials stored in the datastore are invalid.
3. The Azure identity (service principal, workspace managed identity, or user) does not have sufficient permissions on the SQL database.
4. The identity cannot obtain an access token or read required metadata (such as firewall settings).

To troubleshoot in an Azure Machine Learning + Azure SQL Database scenario:

1. Verify the database and server exist
   • In Azure portal, confirm that the SQL server and database referenced by the datastore or connection still exist.
   • If the server or database was recreated with the same name, ensure the datastore is re-enabled or recreated to point to the correct resource.
2. Check datastore authentication configuration
   • Open the datastore or data connection definition in Azure Machine Learning studio.
   • Confirm the configured authentication method (SQL auth, service principal, or identity-based access) is correct.
   • If SQL authentication is used, verify that the username/password are valid on the target Azure SQL Database.
3. Grant permissions to the identity
   • If using a service principal or workspace managed identity (MSI):
     • Ensure a corresponding SQL user exists in the Azure SQL Database for that identity.
     • Grant that user the necessary database permissions (for example, db_datareader or other classic database roles as required).
   • When previewing data in Azure Machine Learning studio with workspace MSI enabled, the workspace MSI is used for authentication, so that identity must also have a SQL user and appropriate permissions.
4. Check for related authentication sub-errors
   • If the underlying error includes codes such as:
     • ScriptExecution.DatabaseConnection.Authentication
     • ScriptExecution.DatabaseConnection.Authentication.AzureIdentityAccessTokenResolution.InvalidResource
     • ScriptExecution.DatabaseConnection.Authentication.AzureIdentityAccessTokenResolution.FirewallSettingsResolutionFailure
   • Then additionally:
     • Confirm the subscription ID and resource group configured in the datastore match those of the SQL server (not just the workspace).
     • Ensure the identity has at least Reader permission on the SQL server resource so it can read firewall settings.
5. Coordinate with a data administrator
   • If direct permission changes are not possible, contact the database or Azure admin to:
     • Validate the identity being used (service principal, MSI, or user).
     • Create or fix the SQL user for that identity.
     • Assign the required database permissions.

Once the datastore/connection points to an existing Azure SQL Database and the identity has valid authentication and sufficient permissions, the unauthorized data error for that data set should be resolved.

References:

• Troubleshoot data access errors