title: Attempting to Read parcquet files on linked storage in Azure Synapse
body: <p>I am attempting to give access to parquet files on a Gen2 Data Lake container.  I have owner RBAC on the container but would prefer to limit access in the container for other users.</p>
  <p>My Query is very simple:</p>
  <pre class="lang-sql prettyprint-override"><code>SELECT
    TOP 100 *
  FROM
    OPENROWSET(
      BULK 'https://aztsworddataaipocacldl.dfs.core.windows.net/pocacl/Top/Sub/part-00006-c62926ba-c530-4ad8-87d1-cf38c67a2da3-c000.snappy.parquet',
      FORMAT='PARQUET'
    ) AS [result]
  </code></pre>
  <p>When I run this I have no problems connecting.  I have attempted to add ACL rights onto the files (and of course the containing folders 'Top' and 'Sub').</p>
  <p><a href="https://i.stack.imgur.com/vkssn.png" rel="nofollow noreferrer">I've give RWX on the 'Top' folder using Storage Explorer and default so that it cascades to the 'Sub' folder and parquet files as I add them</a></p>
  <p>When my colleague attempts to run the SQL script the get the error message. <code>Failed to execute query. Error: File 'https://aztsworddataaipocacldl.dfs.core.windows.net/pocacl/Top/Sub/part-00006-c62926ba-c530-4ad8-87d1-cf38c67a2da3-c000.snappy.parquet' cannot be opened because it does not exist or it is used by another process.</code>
  <strong><strong>NB similar results are also experienced in Spark but with a 403 instead</strong></strong></p>
  <p>SQL on-demand provides a link to the  <a href="https://docs.microsoft.com/en-us/azure/synapse-analytics/sql/resources-self-help-sql-on-demand#query-fails-because-file-cannot-be-opened" rel="nofollow noreferrer">following help file</a> after the error, it suggests:</p>
  <blockquote>
  <p>If your query fails with the error saying 'File cannot be opened because it does not exist or it is used by another process' and you're sure both file exist and it's not used by another process it means SQL on-demand can't access the file. <em><strong>This problem usually happens because your Azure Active Directory identity doesn't have rights to access the file. By default, SQL on-demand is trying to access the file using your Azure Active Directory identity. To resolve this issue, you need to have proper rights to access the file.</strong></em> Easiest way is to grant yourself 'Storage Blob Data Contributor' role on the storage account you're trying to query.</p>
  </blockquote>
  <p>I don't wish to grant Storage Blob Data Contributor or Storage Blob Data Reader as this gives access to every file on the container and not just those I want end users to be able to query.  We have found the same experience occurs for SSMS connecting to parquet external tables.</p>
  <p>So then in parts:</p>
  <ol>
  <li>Is this the correct pattern using ACL to grant access, or should I use another method?</li>
  <li>Are there settings on the Storage Account or within my query/notebook that I should be enabling to support ACL?*</li>
  <li>Has ACL been implemented on Synapse Workspace to date given that we're still in preview?</li>
  </ol>
  <p>*I have resisted pasting my entire settings as I really have no idea what is relevant and what entirely irrelevant to this issue but of course can supply.</p>