Forum Discussion
Outlook component - Error if run by another account
Hello everyone,
In my Pipelines, I used the new Outlook component with a centralized connection at the gateway level.
However, I am encountering a problem because it is not possible to add users to the connection at the gateway level.
And if I run the pipeline with a user other than the one used for authentication at the gateway, an error occurs when the Outlook component is executed, saying that the rights are insufficient.
So, in summary, I can only launch the pipeline with the user authenticated for the Outlook connection at the gateway.
On the configuration side, I have made things variable with the “connection_id” of the data gateway connection.
Do you have the same problem? Have you managed to work around it?
Thank in advance,
Have a nice day,
Vivien
PS : There must be a problem with the forum at the moment. I can't import the screenshots.
Hi vivien57,
This is the expected behavior when using the Outlook component in Microsoft Fabric Pipelines with a centralized gateway connection. The Outlook connector relies on delegated user permissions, so the pipeline always executes the Outlook action under the security context of the user who authenticated the gateway connection. If a different user tries to run the pipeline, they won't have access to the gateway connection, leading to an “insufficient rights” error. Using a dynamic connection_id does not resolve the issue since permissions are checked during execution. Currently, there is no supported way to add multiple users to an Outlook gateway connection. The main options are to run the pipeline with the service account that owns the Outlook connection, use a shared or service mailbox, or redesign the solution to use Microsoft Graph API with application permissions.
As this is a product limitation, the most suitable course of action would be to submit a support ticket with Microsoft.
Create a Fabric and Power BI Support Ticket - Power BI | Microsoft Learn
Thank you,
Community Member.
4 Replies
Hi vivien57,
This is the expected behavior when using the Outlook component in Microsoft Fabric Pipelines with a centralized gateway connection. The Outlook connector relies on delegated user permissions, so the pipeline always executes the Outlook action under the security context of the user who authenticated the gateway connection. If a different user tries to run the pipeline, they won't have access to the gateway connection, leading to an “insufficient rights” error. Using a dynamic connection_id does not resolve the issue since permissions are checked during execution. Currently, there is no supported way to add multiple users to an Outlook gateway connection. The main options are to run the pipeline with the service account that owns the Outlook connection, use a shared or service mailbox, or redesign the solution to use Microsoft Graph API with application permissions.
As this is a product limitation, the most suitable course of action would be to submit a support ticket with Microsoft.
Create a Fabric and Power BI Support Ticket - Power BI | Microsoft Learn
Thank you,
Community Member.Hi vivien57,
This is a known limitation. I really hope that a solution from Microsoft comes soon.
THe workaround that I did is we set up a different user specifically for email activities. That user owns the pipelines so when they run on a schedue they run as that user.
Not ideal, but it works for us.
Hello tayloramy
Thank you for your feedback.
That's what I did, but it's not practical because I don't think it works all the time.
For example: Toto is the owner of the pipeline, and Toto is the account used to connect to Outlook at the DataGateway level. I make a change with a Titi account (which has access to the workspace and the pipeline). The next time I run it, it fails... It's as if it also checks who made the last change, and if it's not the account used for the Outlook connection (and the associated gateway connection), it fails.
Have you encountered this problem as well?
Because this means that changes have to be made with a single account, which isn't ideal in terms of traceability.
Thank in advance,
Have a nice day,
Vivien
Hi vivien57,
The behavior you're seeing matches how the Outlook component works in Microsoft Fabric Pipelines. Even if Toto owns the pipeline and is the account used for the Outlook gateway connection, when Titi edits and republishes the pipeline, Fabric updates the artifact metadata. The system checks gateway connection permissions based on the execution context, which depends on the last publisher. If the latest version is linked to a user without rights to the Outlook gateway connection, the Outlook activity can fail with an “insufficient rights” error. So, both the pipeline owner and the publishing account need to match the Outlook gateway authentication account.
This is a current limitation of the delegated permission model for the Outlook connector. There’s no way to assign multiple users to the same Outlook gateway connection or fully separate it from the authenticated account. The best workaround is to use a dedicated service account for the Outlook gateway connection, pipeline ownership, and publishing, which ensures consistency and avoids failures, though it’s not ideal for traceability until Microsoft improves this functionality.
Thank you.
