Forum Discussion
Getting unauthorized issue while executing Notebook from Azure API
Hi,
I have an Azure function , where I would consume Post method to connect and execute Notebook on demand
URI- https://api.fabric.microsoft.com/v1/workspaces/xxxx/items/yyy/jobs/instances?jobType=RunNotebook
. Here am using SPN+MI federated credentials to authenticate. this implementation worked seamleassly in PREPROD with PREPROD azure SPN and MI.
But gettting Unauthorized issue when am using PROD SPN+MI.
Below is the error message
Http.HttpConnectionResponseContent, Headers:
{
x-ms-public-api-error-code: Unauthorized
request-redirected: true
home-cluster-uri: https://df-msit-scus-redirect.analysis.windows.net/
RequestId: 0219d53d-ef90-42e7-9553-d1bf990b1750
Date: Mon, 14 Apr 2025 02:07:44 GMT
Content-Length: 147
Content-Type: application/json; charset=utf-8
}
Could you please share insights if somehing is missed here?
Thanks,
SARIKA
8 Replies
Unauthorizedindicates an issue with permissions or authentication scope when invoking the Microsoft Fabric API from your azure function. The most common cause is either missing Fabric workspace permissions for your prod SPN or incorrect scope configuration in production's AAD app registration. Can you verify these configurations first and retry?
Hi Anonymous ,
Thank you for reaching out to Microsoft Fabric Community.
To enable SPN MI to access Microsoft Fabric APIs, follow these steps. First, go to the Microsoft Fabric Admin Portal, and under Tenant Settings, navigate to Developer Settings, add the PROD SPN App ID to both the “Allow service principals to use APIs” setting and if necessary, “Allow service principals to create and use service principals”.
Ensure your Azure App Registration for the SPN has the required API permissions. Specifically, add and grant admin consent for the following:
Fabric.Read.All, Fabric.Execute.All, and Fabric.Workspaces.ReadWrite.All. You can manage these permissions within the Azure Portal under App Registrations, Your App, API permissions.If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!
Thanks & Regards,
Rekha,
CustomerSupportTeam.
Hi v-sathmakuri ,
I dont see, Tenant settings in Microsoft Admin portal . below is the screenshot. Could you let me know if I had to raise acces anywhere else for this options? Also, FYI I had given every permission under App Registration ->SPN-> API permissions.Below is the screenshot
Note: This feature is working as expected in UAT environment.Only the problem is with PROD SPN/MI. Also UAT and PROD workspace are in same tenant.
Hi Anonymous ,
Thanks for the update! Glad to hear the issue is resolved. Please consider accepting it as the solution on your end so it’ll help others who come across the same issue.
Thank you for using Microsoft Community Forum.Thank you!!
