Some methods in notebooks do not work when executed from Data Pipelines deployed via SPN

[mmilosanovic]

Hi,

I already created the ticket with Microsoft (2504161420001430) and also opened the issue here and also seems to be related to this issue here.

`notebookutils.runtime.context.get("currentWorkspaceName")` works when executed directly from the Notebook, but does not work when executed from the DataPipeline which was deployed in another workspace using Service Principal via Fabric Core APIs (Create Item - https://learn.microsoft.com/en-us/rest/api/fabric/core/items/create-item?tabs=HTTP).

If I reopen the notebook with my personal account and rerun it again from the DataPipeline, then it works. This implies that the issue is coming from the service principal somehow losing permissions/token and is not able to read the current workspace name where it is running in from the notebookutils runtime context.

What I noticed is that this issue is also present for other built-in methods in Fabric. For example: `notebookutils.lakehouse.get()` and `synapsesql()`. Details can be found here: https://github.com/microsoft/fabric-cicd/issues/202#issuecomment-2797384465. Same approach is being followed in the fabric-cicd library and it is using SPN auth + Fabric Core Create Item APIs (as already mentioned and referenced above).

Did anyone else experience the same/similar issues?

Best regards,

Milos

[KevinChant]

I have had similar issues, typically they are due to issues like the default lakehouse specified.

Look to change what is specified with dynamic replacement when using fabric-cicd:
https://microsoft.github.io/fabric-cicd/latest/how_to/parameterization/#inputs 

[annhwallinger]

Microsoft responded to my case yesterday indicating that synapsesql() does not yet support SPN and there is no deployment date for when it will. 

[mmilosanovic]

I just received the same response, but also that the product team started discussions with the Product Management but they do not have any ETA. They are pointing this out here:

https://learn.microsoft.com/en-us/fabric/data-warehouse/service-principals#limitations 

Service principal support in Data Factory - Microsoft Fabric | Microsoft Learn

[g3kuser]

My ingestion process, which uses pipelines and notebooks, is deployed through the Fabric CI/CD library under SPN ownership. I have extensively used notebookutils (such as GetToken, Mount, getSecret, getWithProperties, updateDefinition, and env methods), sempy (using FabricRestClient to read the list of workspaces, lakehouses, and create shortcuts), and MSAL libraries.

Until last week, I was encountering cluster errors related to the sempy library and the execution of the spark.sql method under the SPN. However, these issues have disappeared as of this week. The process has been running successfully under the SPN for the past four days.

The SPN I am using is not a workspace identity, but a separate SPN created in our tenant with Contributor permissions on Fabric workspaces and read-only Fabric API access.

I have an ongoing support request for the issues I encountered under the SPN. Based on diagnostic logs, I was initially informed it was a permission issue. However, something seems to have changed behind the scenes this week—despite no changes made to permissions on my end, recent retests show successful execution.

Thanks,

Gayatri

[annhwallinger]

Thank you for the info. That all sounds pretty much same as my experience except that we use the synapsesql() function and that still does not work and is not supporting SPN per Microsoft so it all fails at that step and cannot move forward. The other functions before it gets to that one that used to fail are working now.

[BhaveshPatel]

Hello

[mmilosanovic]

hi @BhaveshPatel , sorry I do not understand you answer and do not know how it is related to the topic? This thread is about using SPN to deploy to multi environment setups and as soon as SPN takes over ownership it seems that there are some authorization issue coming from the backend.

[v-tsaipranay]

Hi @mmilosanovic ,

Could you please confirm if the issue has been resolved through the support ticket with Microsoft?

If the issue has been resolved, we kindly request you to share the resolution or key insights here to help others in the community. If we don’t hear back, we’ll go ahead and close this thread.

Should you need further assistance in the future, we encourage you to reach out via the Microsoft Fabric Community Forum and create a new thread. We’ll be happy to help.

Thank you.

[mmilosanovic]

Hi everyone,

I have recently identified the same issue when invoking notebook via execute item APIs via SPN which has `notebookutils.notebook.runMultiple()` method in it. I have opened another support case and asked if it can get prioritized together with the one I still have opened because it is related to the same issue. Support case ID: 2507011420003367

Here is the error message:

[g3kuser]

Hi @mmilosanovic 

I have an ingestion process using pipelines and notebooks deployed through fabric ci-cd library under SPN ownership. I have heavily used runmutiple method and it does work fine under SPN context. I previously used to get some cluster errors with sempy library under SPN which has disappeared starting from this week. SPN that I use is not a workspace identity but a separate SPN created in our tenant with Contributor permission on Fabric workspaces and read only Fabric API access. May be try invoking the notebook through a data factory pipeline and see if that works. 

Thanks,

Gayatri

[mmilosanovic]

Hi, it seems that there was an issue which was misleading. More details from MS support available below:

[v-tsaipranay]

Hi @mmilosanovic ,

Thank you for sharing the update and tracker ID. This case has already been escalated to the PG team, who are currently working on it. We appreciate your patience and they will resolve the issue as soon as possible.

[mmilosanovic]

note resolved yet, support is in back and forth with Notebook team and I am awaiting feedback.

[annhwallinger]

It has not been resolved.

[gaya3krishnan86]

I have noticed today under SPN ownership it no longer can run spark.sql and returns mwc token error. Whereas most of the other library methods with sempy, notebookutils is working even though it gives some cluster issues but the process continues to run successfully. 

[v-tsaipranay]

Hi @mmilosanovic ,

Thank you for your patience and understanding. Our CSS engineers are actively working on the issue, and since it is currently in progress, we expect it to be resolved soon. We appreciate your cooperation and will keep you informed with any updates.

Thank you.

[annhwallinger]

Can you elaborate on 'soon' for those of us trying to control project schedules? This is a BUG not an IDEA. I don't see a workaround for several of the calls including the synapsesql() function?

[gronnerup]

You're absolutely right - this is a known issue when running notebooks in the context of a Service Principal, especially when using notebookutils.runtime.context or mssparkutils.env. I ran into the same thing recently and did a deep dive into how execution context really works in Fabric.

If you're interested, I wrote up my findings (including this bug and a workaround) in this blog post:
Who's Calling? Understanding Execution Context in Microsoft Fabric

[annhwallinger]

Your workaround was so helpful thank you. I don't suppose you have a workaround for synapsesql() ?

[mmilosanovic]

Just to update everyone based on the most recent discussion with Microsoft support on the support case: They have pointed me to Fabric Community forums (so here where we already started discussion and report this issue) and to the Ideas part, so I also created an idea referencing this thread and pointing that this is a known issue and also asking for a fix and/or a workaround.

Please vote here: https://community.fabric.microsoft.com/t5/Fabric-Ideas/Enable-notebookutils-and-other-methods-to-wor...