Forum Discussion

Andersenn's avatar
Andersenn
Frequent Visitor
5 months ago
Solved

Pipeline Script Activity failing with "ItemNotFound" and Authentication errors despite correct setup

Hello, I am encountering a persistent execution error in a Microsoft Fabric pipeline. Specifically, a Script (or lookup, copydata...) Activity designed to execute a query against a target database i...
data engineering
data pipeline
  • ati_puri's avatar
    ati_puri
    5 months ago

    Hi Andersenn ,

     

    You can use Workspace IDentity(similar to SPN):

     

    • Enable Workspace Identity for the Fabric workspace.
    • Grant Workspace Identity access to Warehouse / DB
    • Ask Entra ID team to exempt Fabric from MFA CA
    • Rebind the pipeline connection
    • Re-run the pipeline

     

    Let me know if the above solution works for you.

    Thanks

    Ati Puri

deborshi_nag's avatar
deborshi_nag
Icon for Super User rankSuper User
5 months ago

Hello Andersenn 

 

What’s happening in your case is that the Script activity is not executing as you, even though you’re a Workspace Admin. The activity uses the selected connection to resolve and authenticate to the target artifact.

Workspace roles (Admin / Member / Contributor) control authoring and visibility, but do not control SQL execution permissions. 
 

Pipeline activities (Script, Copy, Stored Procedure) execute using:

  • The selected principal from the connection (if impersonation succeeds), and/or
  • The Fabric execution identity during resolution or fallback
 
Scenario 1 – ItemNotFound
Fabric can’t resolve the artifact metadata using the execution identity.
 
Scenario 2 – Authentication failed
Fabric resolves the endpoint but the SQL engine rejects the AAD token because the identity isn’t mapped inside the database.
 
You should ensure:
At Workspace / Fabric level - The connection principal has access to the workspace.
 
Inside the Warehouse / SQL endpoint - Grant permissions to the Organizational Account / Service Principal used in the connection.
 
Andersenn's avatar
Andersenn
Frequent Visitor
5 months ago

Thank you for the detailed explanation regarding how the execution identity resolves the artifacts and handles SQL execution permissions.

To clarify my setup, both the SQL Database connection and the Warehouse connection are currently configured and authenticated using my own Organizational Account (the exact same user account that holds the Workspace Admin role, and has created all the items in the workspace). This user account does NOT have access to Microsoft Entra ID (this is for a external client).

  • deborshi_nag's avatar
    deborshi_nag
    Icon for Super User rankSuper User
    5 months ago

    Thanks for clarifying. 

     

    Fabric Pipelines, SQL engines, background jobs all require Microsoft Entra ID principal. You can only execute data workloads with Entra identities.
     
    So, create or obtain a service principal. This can be done by the client. 

    What you need from them:

    • Application (Client) ID
    • Tenant ID
    • Client Secret (or cert)

     

    Once you have the SPN, perform the following steps in Fabric:

    Step 1:

    1. Open the Workspace
    2. Go to Workspace access
    3. Click Add people or groups
    4. Search for the Service Principal
    5. Assign role:
      • Member or Contributor

    Step 2:

    Now authorise it as a data consumer.

    1. Open the Warehouse
    2. Click Share
    3. Enter the Service Principal name
    4. Grant permissions based on workload:

    Typical minimum for pipelines:

    • Read all data using SQL (ReadData)
    • Build (if semantic model / reporting is involved)

    Step 3:

    Now configure the connection once, correctly.

    Connection settings

    • Connection type:

      • Warehouse or SQL Database (Fabric)

    • Authentication kind: Service Principal

    • Provide:

      • Tenant ID
      • Client ID
      • Client Secret (or certificate)

    Now this connection is

    • Fully Entra‑backed
    • Non‑interactive
    • Suitable for pipelines
    • Andersenn's avatar
      Andersenn
      Frequent Visitor
      5 months ago

      Hi deborshi_nag,

      Thanks for the clarification.

      Quick question: if I am strictly limited to using my nominal user account for all connections and pipeline executions, and this account currently does not have access to Entra ID, should I request that access from the client's IT team along with the specific permissions you mentioned? Could MFA be a problem in this situation?

       

      Thanks for everything, your help has been really useful!

      • deborshi_nag's avatar
        deborshi_nag
        Icon for Super User rankSuper User
        5 months ago

        MFA could pose a problem if policies are enforced by your organisation, and as such user interaction may be required. This can cause token expiration and pipeline failures. You can of course try that approach first, but using SPN conforms to best practices.