Forum Discussion

iremugurlu's avatar
iremugurlu
Microsoft Employee
1 year ago

Eventstream connection with Event Hub

Hello,   I have an existing event hub which I'm planning to use with an eventstream in Fabric. I see two connection options: 1. SAS keys 2. Organisational account   I'm in a microsoft internal ...
Eventstream
Prince0011's avatar
Prince0011
Solution Sage
1 month ago

Hi,

The error (AADSTS65002) indicates that this is an Azure AD consent/preauthorization issue rather than a problem with Eventstream itself. Specifically, the Fabric first-party application is attempting to obtain a token for Azure Event Hubs, but the required preauthorization/tenant consent hasn't been granted.

A few things to check:

  • Verify that your Entra ID (Azure AD) administrator has granted the required consent for the Fabric application to access Azure Event Hubs in your tenant.

  • Since you're on a Microsoft internal tenant where SAS keys are restricted, it's possible that tenant policies are blocking this first-party application from requesting tokens until it's explicitly preauthorized.

  • If possible, test the same Organizational Account connection in a different tenant to determine whether the issue is tenant-specific.

Regarding Managed Identity, as of today, Fabric Eventstream doesn't provide a native option to authenticate to Azure Event Hubs using a user-assigned or system-assigned Managed Identity through the Eventstream connection UI. If this is a requirement for your organization, it's worth checking the latest documentation or raising it with Microsoft Support, as authentication capabilities continue to evolve.

A few questions:

  • Is the Event Hub in the same tenant as your Fabric workspace?

  • Has an Entra ID administrator already granted tenant-wide consent for the required Microsoft applications?

  • Are you able to connect using an Organizational Account from a non-internal tenant?

If this is a Microsoft internal tenant, I'd also recommend involving your tenant administrators, as they can verify whether the required preauthorization policy is preventing token issuance.

If Microsoft provides a workaround or confirms Managed Identity support, please consider sharing the resolution here—it would be helpful for others facing the same authentication issue.

If you found this reply helpful, please consider giving it a Kudos. If it helps resolve your question, marking it as the Accepted Solution will help other community members encountering the same problem.