Access lakehouse using logic app via Managed Identity

[Bharath_Kumar_S]

Goal: copy files from lakehouse to sharepoint using logic apps via managed identity access for lakehouse.

I have assigned the managed identity of logic app as contributer in fabric workspace. But still for below config its giving error.

Audience: https://onelake.dfs.fabric.microsoft.com

I have tried with service pincipal, its working fine. But I wanted to try it with managed identity if it was possible.

Have tried with notebooks also(It works fine), but getting admin consent for Graph API for service principal will take time so this is a temporary solution.

1. I want to know if access via managed identity is possible, if yes. How?
2. Is there any one connector for sharepoint in logic app which can automatically update file if exists else creates one? Right now I am using 2 connectors one to create file and other to update, based on their existance.

[BhaveshPatel · Accepted solution]

This is currently not feasible using copy jobs from Lakehouse to Sharepoint using Logic Apps.

[Bharath_Kumar_S]

Hi @v-mdharahman 
Thanks for the clarification. 
I am facing another issue, when I copy csv, txt files its working fine. But when I copy the xlsx file its getting corrupted(not able to open file online or locally after downloading). I tried with multiple files, tried to convert the body to base64, binary before passing it as file content nothing seems to work.

I tried copying the excel file from lakehouse to blob, still it is corrupting the file. And I couldn't find any connector to 'get file content' from lakehouse.

can you please help me figure out why this might be happening. And how can I fix this?

[v-mdharahman]

Hi @Bharath_Kumar_S,

Currently, when you use an HTTP GET request to the Lakehouse endpoint to read a file like .xlsx, the response is not automatically treated as binary in Logic Apps. It gets interpreted as text, which corrupts binary formats like Excel, images, PDFs, etc. So even though the file appears to download, it’s unreadable because it was never preserved in raw binary during transfer.

In Logic Apps, you can use "base64(body('HTTP'))" to convert the output to base64 or if you're passing it to another action (like SharePoint or Blob), map the raw body directly into the File Content field without converting to string/text.

For SharePoint or Blob target make sure the “File Content” field accepts base64/binary directly (depending on the connector). And in Blob storage, use "Create Blob" or "Upload Blob" with Content as body('HTTP').

And if you're using the SharePoint connector in the "Create file" or "Update file" actions, set File Content as "base64ToBinary(body('HTTP'))", if the connector expects binary input.

If I misunderstand your needs or you still have problems on it, please feel free to let us know.  

Best Regards,
Hammad.

[Bharath_Kumar_S]

I tried all these things and it still didn't work. so we decided to use blob storage instead of Lakehouse. Thanks for the guidence.

[v-mdharahman]

Hi @Bharath_Kumar_S,

Thanks for reaching out to the Microsoft fabric community forum.

You're receiving this error because Managed Identity authentication isn't yet fully supported for OneLake REST APIs (i.e., https://onelake.dfs.fabric.microsoft.com) across all Microsoft Fabric tenants particularly through Logic Apps. Although you've granted Contributor access to the Logic App's Managed Identity at the Fabric workspace scope, the OneLake resource principal isn't registered for that identity within AAD and hence the token request fails.

This implies that Logic App's Managed Identity does not have permission to utilize that resource. Your OneLake's resource URL isn't currently capable of issuing tokens for managed identities in your case. 

You are correct in that using a Service Principal with appropriate Graph API and Fabric workspace permissions does indeed work. Until support for Managed Identity is complete, using the service principal is the only consistently reliable option here.

As far as SharePoint create or update behavior in Logic Apps, currently SharePoint's Logic App connector does not have a built-in create or update action in one step, what you're doing is the right and standard approach.

If I misunderstand your needs or you still have problems on it, please feel free to let us know.  

Best Regards,
Hammad.