Dataflow Gen2 CI/CD Enabled – Refresh Fails for Non-Owner with Admin/Contributor Access

[Bhargava05]

Hi team,

I created a Dataflow Gen2 in Microsoft Fabric with the CI/CD option enabled. When I trigger a refresh as the owner, it completes successfully. However, when a non-owner user with Admin or Contributor access tries to refresh it, the operation fails with the following error:

emails_table WriteToDataDestination: There was a problem refreshing the dataflow: 'Data source credentials are missing or invalid. Please update the connection credentials in settings, and try again.'. Error code: 999999. (Request ID: b2f44e29-a797-43c0-b080-b8272cb85ce4)

But the non-owner was able to successfully refresh the same dfgen2 without ci/cd enabled.

Is this a known issue with CI/CD-enabled Dataflow Gen2? Are there any workarounds or permission settings we should adjust?
Thanks in advance!

[v-dineshya]

Hi @Bhargava05 ,

Thank you for reaching out to the Microsoft Community Forum.

Hi @AntoineW , Thank you for your prompt response.

Hi @Bhargava05 , Could you please try the proposed solution shared by @AntoineW ? In additon to that , I have added the Microsoft community thread. Please refer below link.

Solved: Re: Dataflow Gen2 Fails to refresh - '_WriteToData... - Microsoft Fabric Community

I hope this information helps. Please do let us know if you have any further queries.

Regards,

Dinesh

[v-dineshya]

Hi @Bhargava05 ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. And, if you have any further query do let us know.

Regards,

Dinesh

[v-dineshya]

Hi @Bhargava05 ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. And, if you have any further query do let us know.

Regards,

Dinesh

[AntoineW · Accepted solution]

Hello @Bhargava05,

When CI/CD (Git integration) is enabled in a Fabric workspace:

• The Dataflow Gen2 definition is versioned and stored as JSON in the Git repository.

• Connection credentials, however, are not stored in Git (for security reasons).

• The credentials are instead stored per user in the Fabric service layer.

👉 This means only the user who originally authenticated the data source (the dataflow owner) has valid credentials linked to that Git-bound dataflow instance.

Solutions : 

Option 1 – Re-authenticate the data source as the non-owner

1. Have the non-owner open the Dataflow Gen2 in Edit mode.

2. Go to Settings → Connections.

3. Select the data source → click Edit credentials.

4. Enter their own credentials and save.

🔹 Drawback: each admin/contributor must do this individually (credentials are not shared).

---

**Option 2 – Use a Service Principal (recommended)

If your source supports Azure AD App/Service Principal authentication (SQL, Lakehouse, OneLake, etc.):

1. Create a service principal in Entra ID.

2. Grant it access to the data source.

3. In the Dataflow connection → choose “Sign in with Service Principal”.

✅ Result: credentials are now tenant-level, not user-level, so any workspace admin can trigger refreshes successfully.

Hope it can help you !

Best regards,

Antoine