Forum Discussion

rayphoon's avatar
rayphoon
New Member
6 months ago
Solved

API call to modify Workspace Diagnostics does not work when run under a Service Principal

We are trying to use REST API calls to Fabric to configure diagnostic settings for our Fabric workspaces using a service principal as described in  https://learn.microsoft.com/en-us/rest/api/fabric/...
admin
one lake
workspaces
  • svenchio's avatar
    svenchio
    6 months ago

    hi rayphoon , I have good news (hopefully 🤞) I was able to reproduce your issue, that is, using a SPN calling the interface as documented in the https://learn.microsoft.com/en-us/rest/api/fabric/core/onelake-settings/modify-diagnostics?tabs=HTTP and got the same the same 500 error, but I knew my SPN has all the neccesary Fabric tenant permissions because I use it to create Fabric items ALL THE TIME, also, the same way you do, have a security group with the SPN as member as admin of the workspace, so basically I knew it wasn't a permission issue. 

     

    But then, I remember other instances where, in order for the SPN to execute some operations, IT NEEDS TO BE THE OWNER OF THE ITEMS, else get a 500 error, so, I decided to test this; as shown below, the SPN has admin permission on the workspace via an Entra ID sec. group, and I created a Lakehouse whitout schema support, as shown in the image, the SPN is the owner! 

     

     

    And after I did this, I invoked the interface using the SPN (as usual) and IT WORKED! 

     

     

     I'm pretty confident it will work for you the same way it did for me ... give a try and let us know 😁🤞  ! 

     

    v-karpurapud  can you help us understand why would it be requiered for the SPN to be owner of the lakehouse in addition of workspace admin permissions?  Perhaps also strzala  can you confirm the ownership of the lakehouse for your script to work? I think this confirmation will help figure this out! 

     

    Don't forget a thumbs up if you find this information useful and accept as solution if appropiate. 

     

v-karpurapud's avatar
v-karpurapud
Community Support
6 months ago

Hi rayphoon 
Thank you for reaching out to the Microsoft Fabric community forum.
 

The behavior you’re observing indicates that authentication and initial authorization are working, as the GET endpoint is successful and no 401 or 403 errors are returned. However, the Modify OneLake Diagnostics operation fails during backend processing. While the API documentation states that service principals are supported, write operations follow a different execution path than read operations, including additional internal validation and handling for long-running operations.
 

Before assuming a product issue, please verify that tenant settings allow service principals to access Fabric APIs, that the service principal has the required roles on both the source and destination workspaces, that both workspaces are on the same capacity, and that the 202/long-running operation pattern is being handled correctly. If all these conditions are met and the request still returns a 500 error only when using a service principal but works with a user token, this likely indicates a backend issue.

 

For more details, please refer to the Microsoft official documentation on
Developer admin settings - Microsoft Fabric | Microsoft Learn
Tenant settings index - Microsoft Fabric | Microsoft Learn

 

If you have any further questions, feel free to reach out and we'll be glad to assist.

 

Regards,

Microsoft Fabric Community Support Team.