Forum Discussion
API call to modify Workspace Diagnostics does not work when run under a Service Principal
hi rayphoon , I have good news (hopefully 🤞) I was able to reproduce your issue, that is, using a SPN calling the interface as documented in the https://learn.microsoft.com/en-us/rest/api/fabric/core/onelake-settings/modify-diagnostics?tabs=HTTP and got the same the same 500 error, but I knew my SPN has all the neccesary Fabric tenant permissions because I use it to create Fabric items ALL THE TIME, also, the same way you do, have a security group with the SPN as member as admin of the workspace, so basically I knew it wasn't a permission issue.
But then, I remember other instances where, in order for the SPN to execute some operations, IT NEEDS TO BE THE OWNER OF THE ITEMS, else get a 500 error, so, I decided to test this; as shown below, the SPN has admin permission on the workspace via an Entra ID sec. group, and I created a Lakehouse whitout schema support, as shown in the image, the SPN is the owner!
And after I did this, I invoked the interface using the SPN (as usual) and IT WORKED!
I'm pretty confident it will work for you the same way it did for me ... give a try and let us know 😁🤞 !
v-karpurapud can you help us understand why would it be requiered for the SPN to be owner of the lakehouse in addition of workspace admin permissions? Perhaps also strzala can you confirm the ownership of the lakehouse for your script to work? I think this confirmation will help figure this out!
Don't forget a thumbs up if you find this information useful and accept as solution if appropiate.
Thanks for your reply.
Yes, I had tried adding the service principal directly as admin on the workspace as well as the group it is a member of. I also tried giving Fabric Admin role to the Service Principal.
Running the code provided gives the following error:
PS C:\Users\rayp> .\test.ps1
Access token acquired successfully.
C:\Users\rayp\test.ps1 : API call failed with status code: 500
At line:1 char:1
+ .\test.ps1
+ ~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,test.ps1
C:\Users\rayp\test.ps1 : Response body: {"requestId":"889be9a9-b834-429d-ae49-f9e3d61b5e6c","errorCode":"InternalServer
Error","moreDetails":[{"errorCode":"ServerError","message":"","relatedResource":{"resourceId":"913c514f-8d8a-48f4-a365-
71e1d2574a77","resourceType":"Workspace"}}],"message":"An error
occured","relatedResource":{"resourceId":"913c514f-8d8a-48f4-a365-71e1d2574a77","resourceType":"Workspace"}}
At line:1 char:1
+ .\test.ps1
+ ~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,test.ps1
rayphoon I've managed to recrete the issue. You are right, when lakehouse is in another Workspace I get the same error code. I think Microsoft should investigate this.
} : API call failed with status code: 500
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException
Response body: {"requestId":"d177ee27-301c-49b3-a111-ca375d4a12ba","errorCode":"InternalServerError","moreDetails":[{"errorCode":"ServerError","message":"","related
Resource":{"resourceId":"135911f1-13ef-4317-83ce-f822697e4ff1","resourceType":"Workspace"}}],"message":"An error occured","relatedResource":{"resourceId":"135922f1-13ef
-4317-83ce-f822697e4ff1","resourceType":"Workspace"}}
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException