Currently, the Fabric Data Factory Invoke Pipeline task uses the user's credentials who saved the pipeline to then authenticate to the Azure Data Factory to execute the ADF pipeline. When that user's password is modified, the token expires and the Fabric Data Factory pipeline must be modified and saved for the Invoke Pipeline tasks to begin working again.
I would like to suggest that there be an option in the Invoke Pipeline Task to use the Fabric Workspace Identity, or specify a Service Principal for authentication to ADF.
Without this change, production Data Factory Pipelines will fail to execute after the owner changes their password.
4 Comments
We face the same problem. Our use case: multiple workspaces, each of them orchestrated by their own 'slave' pipelines within those workspaces. Workspaces are interdependent and thus are orchestrated by a 'master' orchestrator pipeline in separate ws. Dependency on SSO makes the solution less reliable and less secure, as pipeline owner's principal must be granted at least CONTRIBUTOR access on all 'slave' workspaces. Workspace Identities could solve this. Furthermore, one would naturally expect workspace identities behaving as OP has mentioned. We are actively looking forward to this improvement. Keep up the good work and thanks!
- I see the authentication option Workspace Identity in the connection in the connection manager for both Fabric DataPipelines and Notebooks but get authentication error when using it in the pipeline activity. Is this still unsupported? For Data Pipelines it is documented (preview). For Notebooks is not in the the supported items list in the connection setting dialog box but can be choosen anyway. Please add this as using the workspace permission model in enterprise setups at scale relies on it.
- Status changed:NewtoPlanned
This feature is under development for CY26
- Status changed:PlannedtoPlanned
This is under development for CY26
