## The symptom
In an Azure Synapse Scala notebook you connect to a dedicated SQL pool with the
system-assigned managed identity: `mssparkutils.credentials.getConnectionStringOrCreds`
gives you an access token, you pass it as the `accessToken` property to
`spark.read.jdbc`, and reading the table throws a `com.microsoft.sqlserver.jdbc`
error with no data.
## Why
The token was fine. The SQL pool just did not know the identity. The linked
service and token setup all look correct without this step, so it is easy to
miss.
## The fix
Create a contained user for the Synapse workspace's managed identity in the
database and grant it read access. Run this in the SQL pool, replacing
`jsynapse` with your Synapse workspace name:
```sql
CREATE USER [jsynapse] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [jsynapse];
-- add db_datawriter too if the notebook writes back
```
The reporter confirmed reads worked right after adding the user.
## Checklist
- The identity name is your Synapse workspace name, not the notebook name.
- Grant `db_datawriter` as well if the notebook needs to write back.
- This applies to any managed-identity-to-SQL-pool path: token auth is not
enough, the database needs the user mapped.