Forum Discussion
Helper IINotebook Execution Fails When Using Workspace Identity in Microsoft Fabric Pipeline
Hi kasun_rumesh , Thank you for reaching out to the Microsoft Community Forum.
Your workspace setup looks correct from the screenshots, so this does not look like a Workspace Identity creation or workspace permission issue anymore. The error is happening before the notebook execution itself, while Fabric is trying to access workspace details. That usually points to tenant-level API authentication.
Please check whether the tenant setting “Service principals can call Fabric public APIs” is enabled in the Fabric Admin Portal. If the setting is restricted to specific security groups, make sure the Workspace Identity/service principal is included there as well. Also keep “Allow Code-First Artifacts like Notebooks to access this connection” enabled on the notebook connection, since Notebook activities require it.
This looks more like a missing Fabric API permission for the Workspace Identity than a notebook or Key Vault problem.
Super UserHi kasun_rumesh ,
DId you grant your workjspace identity contributor or higher on the workspace itself?
It needs to be added as a member to the workspace with at least contributor permissions.
ALso make sure you enable the "service principals can use Fabric APIs" in the tenant settings, and allow your workspace identity.
Notebook activity - Microsoft Fabric | Microsoft Learn
Using Fabric Workspace Identity (WI) in the Notebook activity
-
Create the Workspace Identity
You must enable WI in your workspace (this may take a moment to load). Create a Workspace Identity in your Fabric workspace. Note that the WI should be created in the same workspace as your Pipeline.
Check out the docs on Workspace Identity.
-
Enable tenant-level settings
Enable the following tenant setting (it's disabled by default): Service principals can call Fabric public APIs.
You can enable this setting in the Fabric admin portal. For more information about this setting, see the enable service principal authentication for admin APIs article.
-
Grant workspace permissions to the Workspace Identity
Open the workspace, select Manage access, and assign permissions to the Workspace Identity. Contributor access is sufficient for most scenarios. If your Notebook is not in the same workspace as your Pipeline, you'll need to assign the WI you created in your Pipeline's workspace at least Contributor access to your Notebook's workspace.
Check out the docs on Give users access to workspaces.
Helper IIYes, I have done it. Please check the first screenshot.
1. It has been created. Please refer to the first screenshot.
2. It is within the same workspace.
3. I have granted member access. Please refer to the first screenshot.
- tayloramy
Hi,
#2 needs to be done even if it is in the same workspace that the WI was created in.
THe WI needs access to the APIs to be able to run the notebook.