Forum Discussion
FUAM Load_FUAM_Data_E2E error
I am having real issues with permissions.
We have a service principle account with no permissions as stated in the documentation.
We have assigned it to a security group and gave the security group access to the 2 api permissions in fabric.
We are running using a fabric admin account. The initial notebook runs to create all objects but when we run the pipeline load fuam data we get an access error.
When I test the load capacity pipeline on its own the fuam pbi- service-api admin connection is successful but the relative capacities url fails
Just an update on this. I discovered my issue was that the group with the SP account in it was not a member of the Admin Monitoring Workspace. When i added the group to this the pipeline ran successfully.
You do not need to add ANY permissions to the SP account in Azure.
13 Replies
Just an update on this. I discovered my issue was that the group with the SP account in it was not a member of the Admin Monitoring Workspace. When i added the group to this the pipeline ran successfully.
You do not need to add ANY permissions to the SP account in Azure.
Hi higgy7 ,
This sounds like a classic case of partial permission propagation with service principals in Fabric.
Here are a few things to double-check:
API Permissions Scope
Make sure the security group assigned to the service principal has both:- Capacity.Read.All
- Tenant.Read.All
These are required for accessing capacity-related endpoints like relativecapacities.
Admin Consent
Even if the permissions are assigned, they won’t take effect unless admin consent has been granted in Azure AD. You can verify this in the Azure portal under Enterprise Applications > API permissions.Service Principal Role in Fabric
Ensure the service principal is added as a Fabric Admin or at least has Capacity Admin rights in the Fabric portal. Sometimes being in the security group isn’t enough unless the group itself is granted Fabric-level roles.Token Scope
When generating the token for the service principal, make sure the scope includes:
https://analysis.windows.net/powerbi/api/.default
Otherwise, the token might not carry the right claims for capacity endpoints.
- Try Direct API Call
As a test, try calling the relativecapacities endpoint directly using Postman or curl with the same token. This can help isolate whether the issue is with the pipeline or the token itself.
Let me know if you want help testing the token or checking the group setup.
If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.
Hi Just on point 1. Does this not conflict with what has been described in the steps provided on github?
Yes it does, and I have seen it cause issues.
On a side note, are you using the latest version of the install from the fabric-toolbox collection?
https://github.com/microsoft/fabric-toolbox/tree/main/monitoring/fabric-unified-admin-monitoring
