Forum Discussion
automate object level tsql permissions in fabric data warehouse
Hi albosta ,
It’s failing because when you try to give a user or service principal access inside Fabric Warehouse, the Warehouse itself needs to look up that account in Entra ID. It does this using its own Managed Identity, not the service principal you’re calling from DevOps.
If that Managed Identity doesn’t have permission to read Entra ID, the lookup fails, and you get the “Principal could not be resolved” error.
You can try fixing it with below steps:
Turn on the Managed Identity for the Workspace that has your Warehouse.In Entra ID, give that Managed Identity the Directory Readers role.Also give it Microsoft Graph – Directory.Read.All (Application permission) and grant admin consent.Wait 15–20 minutes for the permissions to take effect.
Run your ALTER ROLE ... ADD MEMBER ... from DevOps again - no need to manually create the user, Fabric will do it automatically.
Points to remember:
The Warehouse’s Managed Identity is the “middleman” that talks to Entra ID.Your DevOps service principal just needs permission to run SQL - the lookup permissions belong to the Warehouse’s identity.
Here are some Microsoft Documentations for your reference:
Workspace identity - Microsoft Fabric | Microsoft Learn
Thank you.
Community SupportHi albosta ,
It’s failing because when you try to give a user or service principal access inside Fabric Warehouse, the Warehouse itself needs to look up that account in Entra ID. It does this using its own Managed Identity, not the service principal you’re calling from DevOps.
If that Managed Identity doesn’t have permission to read Entra ID, the lookup fails, and you get the “Principal could not be resolved” error.
You can try fixing it with below steps:
Turn on the Managed Identity for the Workspace that has your Warehouse.In Entra ID, give that Managed Identity the Directory Readers role.Also give it Microsoft Graph – Directory.Read.All (Application permission) and grant admin consent.Wait 15–20 minutes for the permissions to take effect.
Run your ALTER ROLE ... ADD MEMBER ... from DevOps again - no need to manually create the user, Fabric will do it automatically.
Points to remember:
The Warehouse’s Managed Identity is the “middleman” that talks to Entra ID.Your DevOps service principal just needs permission to run SQL - the lookup permissions belong to the Warehouse’s identity.
Here are some Microsoft Documentations for your reference:
Workspace identity - Microsoft Fabric | Microsoft Learn
Thank you.