hi @rayphoon , I have good news (hopefully 🤞) I was able to reproduce your issue, that is, using a SPN calling the interface as documented in the https://learn.microsoft.com/en-us/rest/api/fabric/core/onelake-settings/modify-diagnostics?tabs=HTTP and got the same the same 500 error, but I knew my SPN has all the neccesary Fabric tenant permissions because I use it to create Fabric items ALL THE TIME, also, the same way you do, have a security group with the SPN as member as admin of the workspace, so basically I knew it wasn't a permission issue.
But then, I remember other instances where, in order for the SPN to execute some operations, IT NEEDS TO BE THE OWNER OF THE ITEMS, else get a 500 error, so, I decided to test this; as shown below, the SPN has admin permission on the workspace via an Entra ID sec. group, and I created a Lakehouse whitout schema support, as shown in the image, the SPN is the owner!
And after I did this, I invoked the interface using the SPN (as usual) and IT WORKED!
I'm pretty confident it will work for you the same way it did for me ... give a try and let us know 😁🤞 !
@v-karpurapud can you help us understand why would it be requiered for the SPN to be owner of the lakehouse in addition of workspace admin permissions? Perhaps also @strzala can you confirm the ownership of the lakehouse for your script to work? I think this confirmation will help figure this out!
Don't forget a thumbs up if you find this information useful and accept as solution if appropiate.
hi @rayphoon , I have good news (hopefully 🤞) I was able to reproduce your issue, that is, using a SPN calling the interface as documented in the https://learn.microsoft.com/en-us/rest/api/fabric/core/onelake-settings/modify-diagnostics?tabs=HTTP and got the same the same 500 error, but I knew my SPN has all the neccesary Fabric tenant permissions because I use it to create Fabric items ALL THE TIME, also, the same way you do, have a security group with the SPN as member as admin of the workspace, so basically I knew it wasn't a permission issue.
But then, I remember other instances where, in order for the SPN to execute some operations, IT NEEDS TO BE THE OWNER OF THE ITEMS, else get a 500 error, so, I decided to test this; as shown below, the SPN has admin permission on the workspace via an Entra ID sec. group, and I created a Lakehouse whitout schema support, as shown in the image, the SPN is the owner!
And after I did this, I invoked the interface using the SPN (as usual) and IT WORKED!
I'm pretty confident it will work for you the same way it did for me ... give a try and let us know 😁🤞 !
@v-karpurapud can you help us understand why would it be requiered for the SPN to be owner of the lakehouse in addition of workspace admin permissions? Perhaps also @strzala can you confirm the ownership of the lakehouse for your script to work? I think this confirmation will help figure this out!
Don't forget a thumbs up if you find this information useful and accept as solution if appropiate.
Have you tried granting admin permissions to the Service Principal at the workspace level instead of to the entire security group?
You can also test the code below in PowerShell ISE and verify the response you receive. Make sure to provide the Service Principal details, as well as the Workspace ID and Lakehouse ID where diagnostic is enabled.
Request body is just a sample from documentation: https://learn.microsoft.com/en-us/rest/api/fabric/core/onelake-settings/modify-diagnostics
$TenantId = "YOUR_TENANT_ID"
$ClientId = "YOUR_CLIENT_ID"
$ClientSecret = "YOUR_CLIENT_SECRET"
$WorkspaceId = "YOUR_WORKSAPCE_ID"
$LakehouseItemId = "YOUR_LAKEHOUSE_ID"
$tokenUrl = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"
$tokenBody = @{
grant_type = "client_credentials"
client_id = $ClientId
client_secret = $ClientSecret
scope = "https://api.fabric.microsoft.com/.default"
}
try {
$tokenResponse = Invoke-RestMethod -Method Post -Uri $tokenUrl -ContentType "application/x-www-form-urlencoded" -Body $tokenBody
$accessToken = $tokenResponse.access_token
Write-Host "Access token acquired successfully." -ForegroundColor Green
}
catch {
Write-Error "Failed to acquire access token: $_"
exit 1
}
$apiUrl = "https://api.fabric.microsoft.com/v1/workspaces/$WorkspaceId/onelake/settings/modifyDiagnostics"
$body = @{
status = "Enabled"
destination = @{
type = "Lakehouse"
lakehouse = @{
referenceType = "ById"
itemId = $LakehouseItemId
workspaceId = $WorkspaceId
}
}
} | ConvertTo-Json -Depth 5
$headers = @{
Authorization = "Bearer $accessToken"
"Content-Type" = "application/json"
}
try {
$response = Invoke-WebRequest -Method Post -Uri $apiUrl -Headers $headers -Body $body -UseBasicParsing
Write-Host "Response Code: $($response.StatusCode)" -ForegroundColor Green
Write-Host "Diagnostics setting modified successfully." -ForegroundColor Green
if ($response.Content) {
$response.Content | ConvertFrom-Json | ConvertTo-Json -Depth 5
}
}
catch {
if ($_.Exception.Response) {
$statusCode = [int]$_.Exception.Response.StatusCode
Write-Error "API call failed with status code: $statusCode"
$reader = New-Object System.IO.StreamReader($_.Exception.Response.GetResponseStream())
$errorBody = $reader.ReadToEnd()
Write-Error "Response body: $errorBody"
}
else {
Write-Error "API call failed: $($_.Exception.Message)"
}
}
You should receive following status:
Helpful resources
Join our Fabric User Panel
Share feedback directly with Fabric product managers, participate in targeted research studies and influence the Fabric roadmap.
Fabric Monthly Update - February 2026
Check out the February 2026 Fabric update to learn about new features.
