Shortcut to ADLS - Error 401 - Not Authorized

[elpaloo]

Hi! 

I’m encountering a strange and unclear error when trying to create a shortcut in Lakehouse. The error message is: Error 401 - Not Authorized.

I’m using a Service Principal, there are no firewalls enabled on ADLS, and the permissions are set up correctly. However, when using the same Service Principal to connect to the same ADLS via Copy Activity in a Data Pipeline, everything works fine.

Could this issue be related to an internal Lakehouse error? Does anyone know how to fix this problem?

[v-pnaroju-msft]

Hi elpaloo,

We are following up to see if your query has been resolved. Should you have identified a solution, we kindly request you to share it with the community to assist others facing similar issues.

If our response was helpful, please mark it as the accepted solution and provide kudos, as this helps the broader community.

Thank you.

[v-pnaroju-msft]

Hi elpaloo,

We wanted to check in regarding your query, as we have not heard back from you. If you have resolved the issue, sharing the solution with the community would be greatly appreciated and could help others encountering similar challenges.

If you found our response useful, kindly mark it as the accepted solution and provide kudos to guide other members.

Thank you.

[v-pnaroju-msft]

Thank you, @nilendraFabric, for your response.

Hi @elpaloo,

We would like to check if the solution provided by @nilendraFabric  has resolved your issue. If you have found an alternative approach, we encourage you to share it with the community to assist others facing similar challenges.

If you found the response helpful, please mark it as the accepted solution and add kudos. This recognition benefits other members seeking solutions to similar queries.

Thank you.

[nilendraFabric · Accepted solution]

hello @elpaloo 

When creating a shortcut to ADLS Gen2 in a Lakehouse, the authentication process differs fundamentally from Data Pipeline connections. While both utilize the same credentials, they employ different authorization mechanisms and permission requirements

Please make sure these :

The Service Principal must have at minimum the "Storage Blob Data Reader" role for read operations or "Storage Blob Data Contributor" for write operations

Unlike general Azure roles like "Owner" or "Contributor," data operations on ADLS Gen2 specifically require data-plane roles

The storage account must have Hierarchical Namespace enabled for proper ADLS Gen2 functionality