Notebook Execution Fails When Using Workspace Identity in Microsoft Fabric Pipeline

[kasun_rumesh]

I want to execute the notebook using the Workspace Identity, as it is required to authenticate with Azure Key Vault (No other soloution).
I have already enabled the Workspace Identity and granted the required Member permissions.

Then, through Manage Connections and Gateways, I created a new cloud connection with the connection type set to Notebook.

{I have checked bothway (Allow Code-First Artifacts..................................... ☑️ and 🔲)}

Then, within the pipeline, the notebook activity connection was configured as shown below. I added the notebook that needs to be executed using Workspace Identity into the pipeline.

But When I run the pipeline I got following error.

{

Failed to get workspace details with http error code - 'Unauthorized',
error message - '{"requestId":"requestId","errorCode":"Unauthorized",
"message":"The caller is not authenticated to access this resource","isRetriable":false}'

}

Is there a way to correct this error?

[v-hashadapu]

Hi @kasun_rumesh , Hope you are doing well. Kindly let us know if the issue has been resolved or if further assistance is needed. Your input could be helpful to others in the community.

[v-hashadapu]

Hi @kasun_rumesh , Hope you're doing fine. Can you confirm if the problem is solved or still persists? Sharing your details will help others in the community.

[v-hashadapu]

Hi @kasun_rumesh , Thank you for reaching out to the Microsoft Community Forum.

Your workspace setup looks correct from the screenshots, so this does not look like a Workspace Identity creation or workspace permission issue anymore. The error is happening before the notebook execution itself, while Fabric is trying to access workspace details. That usually points to tenant-level API authentication.

Please check whether the tenant setting “Service principals can call Fabric public APIs” is enabled in the Fabric Admin Portal. If the setting is restricted to specific security groups, make sure the Workspace Identity/service principal is included there as well. Also keep “Allow Code-First Artifacts like Notebooks to access this connection” enabled on the notebook connection, since Notebook activities require it.

This looks more like a missing Fabric API permission for the Workspace Identity than a notebook or Key Vault problem.

[tayloramy]

Hi @kasun_rumesh ,  

DId you grant your workjspace identity contributor or higher on the workspace itself? 
It needs to be added as a member to the workspace with at least contributor permissions. 

ALso make sure you enable the "service principals can use Fabric APIs" in the tenant settings, and allow your workspace identity. 

Notebook activity - Microsoft Fabric | Microsoft Learn

Using Fabric Workspace Identity (WI) in the Notebook activity

1. Create the Workspace Identity

   You must enable WI in your workspace (this may take a moment to load). Create a Workspace Identity in your Fabric workspace. Note that the WI should be created in the same workspace as your Pipeline.

   Check out the docs on Workspace Identity.

2. Enable tenant-level settings

   Enable the following tenant setting (it's disabled by default): Service principals can call Fabric public APIs.

   You can enable this setting in the Fabric admin portal. For more information about this setting, see the enable service principal authentication for admin APIs article.

3. Grant workspace permissions to the Workspace Identity

   Open the workspace, select Manage access, and assign permissions to the Workspace Identity. Contributor access is sufficient for most scenarios. If your Notebook is not in the same workspace as your Pipeline, you'll need to assign the WI you created in your Pipeline's workspace at least Contributor access to your Notebook's workspace.

   Check out the docs on Give users access to workspaces.

[kasun_rumesh]

Yes, I have done it. Please check the first screenshot.

1. It has been created. Please refer to the first screenshot.
2. It is within the same workspace.
3. I have granted member access. Please refer to the first screenshot.

[tayloramy]

Hi, 

#2 needs to be done even if it is in the same workspace that the WI was created in. 

THe WI needs access to the APIs to be able to run the notebook.