How to fix Synapse Resource provisioning failed.

Hey Ron – it sounds like your Synapse workspace is stuck in a “failed” provisioning state because the system-assigned identity was removed and then re-added, so ARM never completed the original workspace deployment. You can often “reset” a stuck workspace by forcing a no-op update (ARM reconcile) or by doing an incremental redeploy. Here are the steps I’d try:

1. Capture the failure details

• In the Azure portal, go to your Resource Group → Deployments and open the failed Microsoft.Synapse/workspaces/write entry. Note the status message and Correlation ID.

• Also check Activity log (filter by Resource type = Microsoft.Synapse/workspaces) for any additional errors.

2. Ensure the identity and permissions are healthy

• On the workspace resource → Identity, verify System-assigned managed identity is “On.”

• Under the workspace’s Access control (IAM), confirm that identity has the right roles (e.g., Synapse Administrator or Contributor on the workspace).

• If you’re using CMK, also ensure the identity has Key Vault crypto permissions (Get, List, Encrypt, Decrypt) or the “Key Vault Crypto Service Encryption User” role on your Key Vault.

3. Register the Synapse provider (if not already)

• Portal: Subscriptions → Resource providers → search Microsoft.Synapse → Register (or re-register).

• CLI:

az account set --subscription "<SUB_ID>"  

az provider register -n Microsoft.Synapse --wait  
```4. Trigger a no-op “reconcile” update  

  This updates a tag on the workspace so ARM picks it up and retries provisioning.  

  ```bash

  az resource tag \

    --ids /subscriptions/<SUB_ID>/resourceGroups/<RG>/providers/Microsoft.Synapse/workspaces/<WORKSPACE_NAME> \

    --tags reconcile="true"

Wait a couple of minutes, then refresh Synapse Studio – the provisioning banner should disappear.

5. If the no-op update doesn’t work, do an incremental redeploy

• Pull your original ARM or Bicep template (matching the existing workspace properties).

• Run:

  az deployment group create \

    --resource-group <RG> \

    --name synapse-redeploy-$(date +%s) \

    --mode Incremental \

    --template-file ./main.bicep \

    --parameters @./parameters.json

This safely brings the live workspace back into sync.

6. Last-resort: recreate the workspace

If the workspace properties you need to change are truly immutable (for example, swapping default storage or toggling createManagedPrivateEndpoint), you’ll need to create a brand-new workspace and migrate your artifacts (Git/publish, Linked Services, integration runtimes, etc.).

Hope this helps you get your workspace out of the failed state!

Reference List

• Resolve common workspace deployment failures (Resource provisioning failed): https://docs.microsoft.com/azure/synapse-analytics/troubleshoot/troubleshoot-synapse-studio#scenario-b
• No-op update “reconcile” tag trick: same article, under “Recover a workspace stuck in Failed”
• ARM incremental redeploy: https://docs.microsoft.com/azure/azure-resource-manager/troubleshooting/common-deployment-errors
• Register Microsoft.Synapse provider: https://docs.microsoft.com/cli/azure/provider#az_provider_register
• CMK Key Vault permissions for Synapse workspace encryption: https://docs.microsoft.com/azure/synapse-analytics/security/workspaces-encryption