Service Principal Getting "HTTP request forbidden" When Reading from Data Warehouse

Hi vmattard,

In Fabric, workspace roles (Admin, Member, Contributor, Viewer) govern high-level operations (create/delete/edit items). However, Spark synapsesql() queries check the item-level permission (Build/Read/Contributor) on the specific Data Warehouse.

That means:

• A service principal with workspace Contributor can create/edit items in the workspace.

• But unless you go into the Data Warehouse, Manage permissions pane and grant the service principal Build (or Contributor) on that warehouse item itself, Spark-to-DW queries from the notebook API will still get blocked.

That’s why you see:

• Lakehouse access works (because Lakehouse Contributor is implied by workspace Contributor).

• Warehouse access fails (because Spark uses the DW’s item ACL, not just workspace role).

please refer this doc for more:

https://learn.microsoft.com/en-us/fabric/data-warehouse/service-principals

Thanks,

Prashanth

MS Fabric community support