Operation failed: "Forbidden", 403 When attempting to access LakeHouse files

[carlton7372]

When attempting to access files from one of my applications I get the following ExecutionError:

ExecutionError: An error occurred while calling o539.ls. : Operation failed: "Forbidden", 403, GET, https://onelake.dfs.fabric.microsoft.com/DataEngineeringWKSP?upn=false&resource=filesystem&m..." target="_blank" rel="noopener noreferrer">https://onelake.dfs.fabric.microsoft.com/DataEngineeringWKSP?upn=false&resource=filesystem&m..., Forbidden, "User is not authorized to perform current operation for workspace '0963db25-ad19-489b-944e-82d6fc013b87', artifact 'b8f5e9cd-3c39-44b8-8982-ddecef9e829c'."

The application has successfully registered ok. 

To resolve this, it has been suggested that  I log into the Microsoft Fabric portal, navigate to the lakehouse’s “Manage Access” settings, and add the required identity with an appropriate role (such as Storage Blob Data Contributor or the equivalent Fabric data access role) ensuring that its OAuth token is issued and includes a valid UPN claim; once these permissions are set,  and the GET operation should succeed without a 403 error.

However, when I access the LakeHouse settings I don't see the option to add an identity, see image. Can someone please provide some guidance.

I also can't see anywhere to modify Workspace Setting to permit access

[carlton7372]

Thanks again for getting in touch.

Did you mean something like this

[v-menakakota]

Yes

[carlton7372]

By way of an update, I'm also getting the error:"

{"error":{"code":"Unauthorized","message":"Authentication Failed with Bearer token is not present in the request"}}

[v-menakakota · Accepted solution]

Hi @carlton7372 ,

Thank you for reaching out to us on the Microsoft Fabric Community Forum.

The suggestion to use "Manage Access" and add a role like "Storage Blob Data Contributor" is a bit off,Fabric doesn’t use that exact role. Instead, permissions come from either the workspace level or a special OneLake data access setting (which might be why you’re stuck).

You’re looking in the wrong spot—there’s a workspace-level "Manage Access" and a Lakehouse-level "Manage OneLake data access (preview)" that might not be turned on yet.

 Go to your workspace. Click Manage Access (top-right corner or settings gear). See if you’re an Admin, Member, or Contributor. If you’re just a Viewer, you’ll need someone with more rights to help.

Open the Lakehouse inside the workspace. Check for a button like "Manage OneLake data access (preview)" in the ribbon. If you see it, enable it and add your app’s identity with a role (e.g., read access to all folders).

Here is the documentation link for more understanding:

Get started with OneLake data access roles (preview) - Microsoft Fabric | Microsoft Learn

If this post was helpful, please give us Kudos and consider marking Accept as solution to assist other members in finding it more easily.

[carlton7372]

Hi V-menakakota,

Thanks for getting in touch.

I should have mentioned that I have created service principle to access the onelake via Databricks using the following code:

url = "abfss://DataEngineeringWKSP@onelake.dfs.fabric.microsoft.com/sqlite_lakehouse.Lakehouse"

mount_folder = "/mnt/lake"

# OAuth configuration settings for OneLake

configs = {

    "fs.azure.account.auth.type": "OAuth",

    "fs.azure.account.oauth.provider.type": "org.apache.hadoop.fs.azurebfs.oauth2.ClientCredsTokenProvider",

    "fs.azure.account.oauth2.client.id": "ac8db0b1-a061-4899-994b-81253d864bc8",

    "fs.azure.account.oauth2.client.secret": "fNi8Q~1Q.B-Ey12zs066D_G3.E6bslnE_LqY-aFs",

    "fs.azure.account.oauth2.client.endpoint": "https://login.microsoftonline.com/xxxxxxxxxxxxxx037-b5a1-758faef12fc6/oauth2/token"

}

mounted_list = dbutils.fs.mounts()

mounted_exist = False

for item in mounted_list:

    if mount_folder in item.mountPoint:

        mounted_exist = True

        break

if not mounted_exist:

    dbutils.fs.mount(source=url, mount_point=mount_folder, extra_configs=configs)

As a result I need to add the Service Principal, but unfortunately it's not possible to add the service principle where you suggested - you only add People or Email addresses

[v-menakakota]

Hi @carlton7372 ,

We really apologies for the inconvenience, as you mentioned it's not possible to add the service principle we can add only email. Paste in the Application ID of your Service Principal as a guest user (appid@tenant.onmicrosoft.com). Assign it the Member or Contributor role.
If it doesn’t recognize your app ID or gives an error, it’s because Service Principals must be first granted directory access in Entra ID.
Go to Entra ID (Azure Active Directory). Find your app under App registration. Under API permissions, grant it Microsoft Graph . Then in Enterprise Applications, ensure it’s allowed to access Microsoft Fabric

If this post was helpful, please give us Kudos and consider marking Accept as solution to assist other members in finding it more easily.

[carlton7372]

Hi V,

I have added it here, but I'm still getting the Forbidden error

[adurasno]

Hi! Did you ever find a solution? I am facing the same issue