Forum Discussion

Andersenn's avatar
Andersenn
Frequent Visitor
4 months ago
Solved

Pipeline Script Activity failing with "ItemNotFound" and Authentication errors despite correct setup

Hello,

I am encountering a persistent execution error in a Microsoft Fabric pipeline. Specifically, a Script (or lookup, copydata...) Activity designed to execute a query against a target database is failing during the connection phase.

Depending on the specific target artifact, I am receiving two different errors that seem to point to an underlying authentication or resolution issue.

Error Details / Logs:

Scenario 1 (SQL Database): The system throws an ItemNotFound error regarding the FabricSqlConnectionInfo.

(ids are placeholders for security reasons)
 
Fabric activity failed. ' Error occured while trying to get FabricSqlConnectionInfo. Please retry later. Detailed Message: 'StatusCode: NotFound, WorkspaceId: <WORKSPACE_ID>, ArtifactId: <ARTIFACT_ID>, Error Code: ItemNotFound, Message: Could not found the requested item, Request ID: <REQUEST_ID>, Content: {"requestId":"<REQUEST_ID>","errorCode":"ItemNotFound","message":"Could not found the requested item"}' '.

Scenario 2 (Connecting to a Warehouse): When the target connection is a Warehouse, it throws a connection/authentication failure.

(ids are placeholders for security reasons)
 
ErrorCode=SqlFailedToConnect,'Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException,Message=Cannot connect to SQL Database. Please contact SQL server team for further support. Server: '<SERVER_URL_PLACEHOLDER>', Database: '<DATABASE_ID_PLACEHOLDER>', User: ''. Check the connection configuration is correct, and make sure the SQL Database firewall allows the Data Factory runtime to access.,Source=Microsoft.DataTransfer.Connectors.MSSQL,''Type=Microsoft.Data.SqlClient.SqlException,Message=Could not login because the authentication failed.,Source=Framework Microsoft SqlClient Data Provider,'

If you look closely, the user in this log appears empty.

Troubleshooting Steps Already Performed: To isolate the issue, I have already verified the following:

  • Artifact Existence: The target SQL Database and Warehouse definitely exist in the workspace and have not been deleted or recreated.

  • Connection Configuration: The connection is correctly configured and selected in the Script Activity settings.

  • Permissions: I am a Workspace Admin, so I should have full access to all artifacts within this workspace.

Questions / Suspected Causes: Given that the artifacts exist, the setup is correct within the Fabric UI, and the Warehouse error explicitly mentions an authentication failure, I suspect this is an underlying Entra ID issue during the unattended background execution. Could you please help investigate the following?

  1. Token Expiration: Could there be a silent expiration of the Entra ID token used by the connection?

  2. Conditional Access (MFA): Are there any Entra ID Conditional Access policies blocking the pipeline's execution?

  3. Service Principal / Entra ID Permissions: Is there a specific Tenant setting or Entra ID API permission misconfiguration that would cause these errors despite having Workspace Admin rights?

    Thank you very much for your help

data engineering
data pipeline
  • ati_puri's avatar
    ati_puri
    4 months ago

    Hi Andersenn ,

     

    You can use Workspace IDentity(similar to SPN):

     

    • Enable Workspace Identity for the Fabric workspace.
    • Grant Workspace Identity access to Warehouse / DB
    • Ask Entra ID team to exempt Fabric from MFA CA
    • Rebind the pipeline connection
    • Re-run the pipeline

     

    Let me know if the above solution works for you.

    Thanks

    Ati Puri

11 Replies

  • deborshi_nag's avatar
    deborshi_nag
    Super User
    4 months ago

    Hello Andersenn 

     

    What’s happening in your case is that the Script activity is not executing as you, even though you’re a Workspace Admin. The activity uses the selected connection to resolve and authenticate to the target artifact.

    Workspace roles (Admin / Member / Contributor) control authoring and visibility, but do not control SQL execution permissions. 
     

    Pipeline activities (Script, Copy, Stored Procedure) execute using:

    • The selected principal from the connection (if impersonation succeeds), and/or
    • The Fabric execution identity during resolution or fallback
     
    Scenario 1 – ItemNotFound
    Fabric can’t resolve the artifact metadata using the execution identity.
     
    Scenario 2 – Authentication failed
    Fabric resolves the endpoint but the SQL engine rejects the AAD token because the identity isn’t mapped inside the database.
     
    You should ensure:
    At Workspace / Fabric level - The connection principal has access to the workspace.
     
    Inside the Warehouse / SQL endpoint - Grant permissions to the Organizational Account / Service Principal used in the connection.
     
    • Andersenn's avatar
      Andersenn
      Frequent Visitor
      4 months ago

      Thank you for the detailed explanation regarding how the execution identity resolves the artifacts and handles SQL execution permissions.

      To clarify my setup, both the SQL Database connection and the Warehouse connection are currently configured and authenticated using my own Organizational Account (the exact same user account that holds the Workspace Admin role, and has created all the items in the workspace). This user account does NOT have access to Microsoft Entra ID (this is for a external client).

      • deborshi_nag's avatar
        deborshi_nag
        Super User
        4 months ago

        Thanks for clarifying. 

         

        Fabric Pipelines, SQL engines, background jobs all require Microsoft Entra ID principal. You can only execute data workloads with Entra identities.
         
        So, create or obtain a service principal. This can be done by the client. 

        What you need from them:

        • Application (Client) ID
        • Tenant ID
        • Client Secret (or cert)

         

        Once you have the SPN, perform the following steps in Fabric:

        Step 1:

        1. Open the Workspace
        2. Go to Workspace access
        3. Click Add people or groups
        4. Search for the Service Principal
        5. Assign role:
          • Member or Contributor

        Step 2:

        Now authorise it as a data consumer.

        1. Open the Warehouse
        2. Click Share
        3. Enter the Service Principal name
        4. Grant permissions based on workload:

        Typical minimum for pipelines:

        • Read all data using SQL (ReadData)
        • Build (if semantic model / reporting is involved)

        Step 3:

        Now configure the connection once, correctly.

        Connection settings

        • Connection type:

          • Warehouse or SQL Database (Fabric)

        • Authentication kind: Service Principal

        • Provide:

          • Tenant ID
          • Client ID
          • Client Secret (or certificate)

        Now this connection is

        • Fully Entra‑backed
        • Non‑interactive
        • Suitable for pipelines
  • ati_puri's avatar
    ati_puri
    Resolver III
    4 months ago

    Hi Andersenn ,

     

    You can use Workspace IDentity(similar to SPN):

     

    • Enable Workspace Identity for the Fabric workspace.
    • Grant Workspace Identity access to Warehouse / DB
    • Ask Entra ID team to exempt Fabric from MFA CA
    • Rebind the pipeline connection
    • Re-run the pipeline

     

    Let me know if the above solution works for you.

    Thanks

    Ati Puri

  • v-sgandrathi's avatar
    v-sgandrathi
    Community Support
    4 months ago

    Hi Andersenn,

     

    Thank you deborshi_nag and ati_puri for your response to the query.

     

    Following up to check whether you got a chance to review the suggestions given. If the issue still persists please let us know. Glad to help.

     

    Thank you.

  • v-sgandrathi's avatar
    v-sgandrathi
    Community Support
    4 months ago

    Hi Andersenn,

     

    Following up to check whether you got a chance to review the suggestions given. If the issue still persists please let us know. Glad to help. 

     

    Thank you.