Can't create DataFlowGen2 (Policy Allows)

Hi daniele_tiles​ 

By “supporting types,” the suggestion refers to the Lakehouse and Warehouse item types. Microsoft documents that Dataflow Gen2 automatically creates internal items named DataflowsStagingLakehouse and DataflowsStagingWarehouse when the first dataflow is created. These are managed by Dataflow Gen2; you should not manually create, rename or modify these staging items.

However, this is a possible explanation to investigate, not a confirmed requirement to allow Lakehouse and Warehouse creation. Microsoft’s policy guidance includes an example allowing only Dataflow Gen2, so we should not assume that your configuration is missing those permissions.

To investigate safely:

1. Reproduce the failure using New item → Dataflow Gen2, separately from the Gen1 migration path. Capture the failed request’s response in the browser’s Developer tools → Network tab, and ask the capacity administrator to check the corresponding policy evaluation in the Fabric audit logs.
2. If an additional permission test is needed, have the capacity administrator temporarily allow Dataflow Gen2, Lakehouse and Warehouse, restricted to the test security group and a non-production test workspace. Compare creation before and after the change using the same user and workspace. This also permits ordinary Lakehouse/Warehouse creation during the test—not just internal staging—so restore the original restriction afterward.
3. If creation succeeds, use the error and policy logs to identify which operation was previously denied. If the policy permits the operation but creation still fails, raise a Fabric support case with the error details, UTC timestamp, workspace/capacity IDs and any request/activity ID. Share full network traces only through the support channel, not publicly.

Italy North is listed as supporting Fabric workloads, so the region alone does not establish the cause. Also account for policy propagation when testing; Microsoft documents that changes take effect within 15 minutes of activation.

Thanks,
C Srikanth
Community Support Team

Hi daniele_tiles, one more thing to rule out alongside the replication from suparnababu8. Dataflow Gen2 can create supporting items in the background when it is first created, for example staging artifacts, so if the policy set only allows the Dataflow item type, that hidden step can fail and show only a generic error. Try adding the supporting types to the policy temporarily to see if the error goes away, and also compare creating it from the workspace New item menu versus the Dataflow Gen1 migration path. If the generic error still appears, the browser network tab response for the failed call usually has a more specific message.

Hello daniele_tiles​ 

I replicated your scenario. it works for me. Pls take a look ate below

I was created  Policy set

with ItemTypes: Only DataflowGen2 can create

Security group is Test group

Workspace Tyope is UK-RTI

Later I give Member access to my TestGroup(SI Babu is part of that group) in UK-RTI workspace. as below

Now when am creating Notebook, it's throwing error bcz I enforced Policy set.

Even for Lakehouse creation as well getting the same error

Now If I go and create DataflowGen2, it's allowing me to create

Hope you're missed few steps. Pls check carefully.

Did I answer your questions

Mark my answer as accepted solution

Proud to be a Super User