Fabric Pipeline is throwing User Auth Fail error

[maxmerchant]

A Fabric pipeline that was successful until last week, started failing this week. Below is the error

Operation on target <Activity Name> failed: Failed to get User Auth access token. The error message is: Failed to get User Auth access token. The error message is: AADSTS50057: The user account is disabled. Trace ID: 414ca503-c780-4c87-b681-a2a36686a200 Correlation ID: f9aec396-eb3b-45b7-abbb-13817fdfec03 Timestamp: 2024-11-12 15:29:59Z The returned error contains a claims challenge. For additional info on how to handle claims related to multifactor authentication, Conditional Access, and incremental consent, see https://aka.ms/msal-conditional-access-claims. If you are using the On-Behalf-Of flow, see https://aka.ms/msal-conditional-access-claims-obo for details...

The original author of this pipeline is no longer with the organization and their M365 ID has been removed/deactivated. It does seem like this causing the pipeline to fail.

Is anyone seeing this behaviour as well? Does this mean the pipelines created by members who leave the organization will fail? Besides recreating the pipeline (using the 'Save As' feature) how were you able to resolve this?

[spencer_sa · Accepted solution]

Ownership changes are tricky.
If you can't temporarily re-enable the account (as the link below) you're kind of left with either using SaveAs or via moving artifacts with Git branches as the user you want to own the data.

https://learn.microsoft.com/en-us/answers/questions/1708216/how-to-take-over-ownership-of-a-ms-fabri...)

[Srisakthi]

Hi  @maxmerchant  , 

I havent explored this but thought might be helpful, please have a look at it. 

1. Create a ticket at Microsoft hand have them add you as a user to the pipeline
2. Use the API : https://learn.microsoft.com/en-us/rest/api/power-bi/admin/pipelines-get-pipelines-as-admin and https://learn.microsoft.com/en-us/rest/api/power-bi/admin/pipelines-update-user-as-admin

Regards,

Srisakthi

[Srisakthi]

Hello @Anonymous ,

It would be easier if we have an option of take over as like semantic model.

Can you please try the option suggested by @SudhavaniKolla3  once ?

Regards,

Srisakthi

[Anonymous · Accepted solution]

Hi @maxmerchant 

Thank you very much SudhavaniKolla3 and spencer_sa for your prompt reply.

The error message AADSTS50057 indicates that the user account associated with the pipeline is disabled, which is likely due to the original author of the pipeline no longer being part of the organization.

This can indeed cause the pipeline to fail, as it relies on the permissions and tokens associated with that user account.

Error AADSTS50057 - User account is disabled | Microsoft Learn

Consider the approach provided by SudhavaniKolla3 and spencer_sa.

If possible, consider creating a service account to manage automated tasks and pipelines. Such an account would not be affected by the departure of an individual.

Regards,

Nono Chen

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[gpalsson]

Searching for this issue, and this came up. The solution is hilariously bad. In case a company has 100 pipelines created by someone, and they leave the company, we are supposed to "save as" and make a copy 100 times.

That is SO BAD!

[SudhavaniKolla3]

as per my knowledge, go to connections and create a new connection with existing user credentials(Eg:your credentials)/service principle credentials, open that pipeline and chnage the connection every where from old to new, it will work.

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[spencer_sa · Accepted solution]

Ownership changes are tricky.
If you can't temporarily re-enable the account (as the link below) you're kind of left with either using SaveAs or via moving artifacts with Git branches as the user you want to own the data.

https://learn.microsoft.com/en-us/answers/questions/1708216/how-to-take-over-ownership-of-a-ms-fabri...)