I am unable to send a Service Bus Message from Sql Server with a newly set up credential and queue

Question

I am unable to send a Service Bus Message from Sql Server with a newly set up credential and queue

Spencer Thompson (Network) 0

I setup a new queue using the same code as before and I cannot actually send a message:

56D2B880-4278-4DB8-AE34-84916885E475 {"response":{"status":{"http":{"code":401,"description":"SubCode=40100: Unauthorized : Unauthorized access for 'Send' operation on endpoint 'sb://netservice.servicebus.windows.net/netservice-portaljobupdates/messages'. Tracking Id: 6e89c3f5-095a-475a-a839-c651f4673cb8_G15"}},"headers":{"HTTP/1.1 401 SubCode=40100":"Unauthorized : Unauthorized access for 'Send' operation on endpoint 'sb://netservice.servicebus.windows.net/netservice-portaljobupdates/messages'. Tracking Id: 6e89c3f5-095a-475a-a839-c651f4673cb8_G15","Date":"Wed, 24 Sep 2025 10:02:00 GMT","Content-Length":"0","Server":"Microsoft-HTTPAPI/2.0","Strict-Transport-Security":"max-age=31536000"}}}

The code I used was figured out here and definitely worked because I have Service Bus messages being sent ok that I set up using the code.

https://free.blessedness.top/en-us/answers/questions/1792292/unable-to-send-message-from-azure-sql-to-service-b

Rupesh Asati 865 Reputation points Microsoft External Staff Moderator

2025-09-24T11:08:52.0033333+00:00

Hello Spencer Thompson (Network),

Thanks for reaching out on Microsoft Q&A. Please provide the information requested in the private message so we can look into this further.

Thanks
Pashikanti Kumar 1,235 Reputation points Microsoft External Staff Moderator

2025-09-24T18:43:12.4166667+00:00
Hi Spencer Thompson,

Thank you for posting your question in the Microsoft Q&A forum

Based on the details you shared, below is an overview and some recommendations for sending messages from Azure SQL Database to Azure Service Bus with Managed Identity.

Scenario Overview

You are logged into Azure SQL Database as an Azure AD Admin user.

You use DATABASE SCOPED CREDENTIAL with identity type Managed Identity referencing a resource ID for Azure Service Bus.

Your code uses sp_invoke_external_rest_endpoint to POST a message payload to the Service Bus queue URL via REST API.

Other Service Bus queues can be sent messages with different credentials, indicating multiple scoped credentials are in use for different queues.

You run all this inside Azure SQL Database, not on-prem SQL Server or hybrid.

Key Components

Authentication Method:

Managed Identity scoped credential in Azure SQL Database.

Identity's resource ID is provided as https://servicebus.azure.net.

SQL code authenticates REST call to Service Bus using this credential.

Database Scoped Credential Setup:

DROP DATABASE SCOPED CREDENTIAL removes any existing one with that name.

OPEN MASTER KEY decrypts DB master key for secure credential storage.

CREATE DATABASE SCOPED CREDENTIAL creates new credential with Managed Identity and resource ID.

REST API Call:

Uses SQL stored procedure sp_invoke_external_rest_endpoint.

Sends HTTP POST to the Service Bus queue endpoint with message payload in JSON.

Captures and prints response.

Important Considerations

The Managed Identity you use must have Send permissions on the specific Service Bus queue/topic in the Azure RBAC model.

Service Bus resource (https://servicebus.azure.net) should match exactly the scope expected for the identity.

The user or Managed Identity used in SQL must be correctly assigned to the Azure SQL Database with permissions to create/use scoped credentials.

Make sure the Master Key is created and accessible in the database before creating scoped credentials.

Verify that the outbound network restrictions on Azure SQL Database allow sending outbound REST calls to Service Bus endpoints.

Recommended Actions

Ensure the Managed Identity has Azure Service Bus Data Sender role on the target queue.

Test the REST API outside SQL (e.g., Postman with managed identity token) to isolate SQL vs identity permission issues.

Review the exact error messages if any during the procedure execution.

Check in Azure Portal that the Managed Identity is active and assigned.

Monitor Service Bus diagnostics logs to see if messages are arriving or being rejected.

I hope the provided answer is helpful,

Please "Up Vote" if the information helped you. This will help us and others in the community as well.

Thanks
Rupesh Asati 865 Reputation points Microsoft External Staff Moderator

2025-09-29T17:17:58.13+00:00

Hi Spencer Thompson,
Following up to see if you had a chance to check the response. Please let me know if you have any further question.

Thanks
Rupesh Asati 865 Reputation points Microsoft External Staff Moderator

2025-09-30T11:53:40.5866667+00:00

Hi Spencer Thompson,

If you had a chance to check the response. Please let me know if you have any further question.

Thanks

1 answer

Your answer

Rupesh Asati 865 Reputation points Microsoft External Staff Moderator

2025-09-24T11:08:52.0033333+00:00

Hello Spencer Thompson (Network),

Thanks for reaching out on Microsoft Q&A. Please provide the information requested in the private message so we can look into this further.

Thanks
Rupesh Asati 865 Reputation points Microsoft External Staff Moderator

2025-09-29T17:17:58.13+00:00

Hi Spencer Thompson,
Following up to see if you had a chance to check the response. Please let me know if you have any further question.

Thanks
Rupesh Asati 865 Reputation points Microsoft External Staff Moderator

2025-09-30T11:53:40.5866667+00:00

Hi Spencer Thompson,

If you had a chance to check the response. Please let me know if you have any further question.

Thanks

Answer 1

Hello Spencer Thompson (Network),

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are unable to send a Service Bus Message from Sql Server with a newly set up credential and queue.

The below should solve the issue:

Open Master Key:

  OPEN MASTER KEY DECRYPTION BY PASSWORD='<yourPassword>';

Create Scoped Credential:

CREATE DATABASE SCOPED CREDENTIAL [https://<serviceBusName>.servicebus.windows.net/<queueName>]
   WITH IDENTITY = 'Managed Identity',
   SECRET = '{"resourceid":"https://servicebus.azure.net"}';

Send Message:

  DECLARE @response NVARCHAR(MAX);
   DECLARE @url NVARCHAR(4000) = N'https://<serviceBusName>.servicebus.windows.net/<queueName>/messages';
   DECLARE @Guid NVARCHAR(40) = NEWID();
   DECLARE @payload NVARCHAR(MAX) = '{ "message": "Hello, world! ' + @Guid + '" }';
   EXEC sp_invoke_external_rest_endpoint
       @method = N'POST',
       @url = @url,
       @credential = [<serviceBusName>.servicebus.windows.net/<queueName>],
       @payload = @payload,
       @response = @response OUTPUT;
   PRINT @Guid + ' ' + @response;

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Share via

I am unable to send a Service Bus Message from Sql Server with a newly set up credential and queue

1 answer

Your answer