Forum Discussion

Andersenn's avatar
Andersenn
Frequent Visitor
5 months ago
Solved

Pipeline Script Activity failing with "ItemNotFound" and Authentication errors despite correct setup

Hello, I am encountering a persistent execution error in a Microsoft Fabric pipeline. Specifically, a Script (or lookup, copydata...) Activity designed to execute a query against a target database i...
data engineering
data pipeline
  • ati_puri's avatar
    ati_puri
    5 months ago

    Hi Andersenn ,

     

    You can use Workspace IDentity(similar to SPN):

     

    • Enable Workspace Identity for the Fabric workspace.
    • Grant Workspace Identity access to Warehouse / DB
    • Ask Entra ID team to exempt Fabric from MFA CA
    • Rebind the pipeline connection
    • Re-run the pipeline

     

    Let me know if the above solution works for you.

    Thanks

    Ati Puri

Andersenn's avatar
Andersenn
Frequent Visitor
5 months ago

Thank you for the detailed explanation regarding how the execution identity resolves the artifacts and handles SQL execution permissions.

To clarify my setup, both the SQL Database connection and the Warehouse connection are currently configured and authenticated using my own Organizational Account (the exact same user account that holds the Workspace Admin role, and has created all the items in the workspace). This user account does NOT have access to Microsoft Entra ID (this is for a external client).

deborshi_nag's avatar
deborshi_nag
Icon for Super User rankSuper User
5 months ago

Thanks for clarifying. 

 

Fabric Pipelines, SQL engines, background jobs all require Microsoft Entra ID principal. You can only execute data workloads with Entra identities.
 
So, create or obtain a service principal. This can be done by the client. 

What you need from them:

  • Application (Client) ID
  • Tenant ID
  • Client Secret (or cert)

 

Once you have the SPN, perform the following steps in Fabric:

Step 1:

  1. Open the Workspace
  2. Go to Workspace access
  3. Click Add people or groups
  4. Search for the Service Principal
  5. Assign role:
    • Member or Contributor

Step 2:

Now authorise it as a data consumer.

  1. Open the Warehouse
  2. Click Share
  3. Enter the Service Principal name
  4. Grant permissions based on workload:

Typical minimum for pipelines:

  • Read all data using SQL (ReadData)
  • Build (if semantic model / reporting is involved)

Step 3:

Now configure the connection once, correctly.

Connection settings

  • Connection type:

    • Warehouse or SQL Database (Fabric)

  • Authentication kind: Service Principal

  • Provide:

    • Tenant ID
    • Client ID
    • Client Secret (or certificate)

Now this connection is

  • Fully Entra‑backed
  • Non‑interactive
  • Suitable for pipelines
  • Andersenn's avatar
    Andersenn
    Frequent Visitor
    5 months ago

    Hi deborshi_nag,

    Thanks for the clarification.

    Quick question: if I am strictly limited to using my nominal user account for all connections and pipeline executions, and this account currently does not have access to Entra ID, should I request that access from the client's IT team along with the specific permissions you mentioned? Could MFA be a problem in this situation?

     

    Thanks for everything, your help has been really useful!

    • deborshi_nag's avatar
      deborshi_nag
      Icon for Super User rankSuper User
      5 months ago

      MFA could pose a problem if policies are enforced by your organisation, and as such user interaction may be required. This can cause token expiration and pipeline failures. You can of course try that approach first, but using SPN conforms to best practices. 



      • Andersenn's avatar
        Andersenn
        Frequent Visitor
        5 months ago

        I can only authenticate using OAuth 2.0 with my personal account, so even if I wanted to, I cannot use Service Principals in this case.