API call to modify Workspace Diagnostics does not work when run under a Service Principal

Have you tried granting admin permissions to the Service Principal at the workspace level instead of to the entire security group?

You can also test the code below in PowerShell ISE and verify the response you receive. Make sure to provide the Service Principal details, as well as the Workspace ID and Lakehouse ID where diagnostic is enabled.
Request body is just a sample from documentation: https://learn.microsoft.com/en-us/rest/api/fabric/core/onelake-settings/modify-diagnostics

$TenantId       = "YOUR_TENANT_ID"
$ClientId       = "YOUR_CLIENT_ID"
$ClientSecret   = "YOUR_CLIENT_SECRET"

$WorkspaceId    = "YOUR_WORKSAPCE_ID"
$LakehouseItemId = "YOUR_LAKEHOUSE_ID"

$tokenUrl = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"

$tokenBody = @{
    grant_type    = "client_credentials"
    client_id     = $ClientId
    client_secret = $ClientSecret
    scope         = "https://api.fabric.microsoft.com/.default"
}

try {
    $tokenResponse = Invoke-RestMethod -Method Post -Uri $tokenUrl -ContentType "application/x-www-form-urlencoded" -Body $tokenBody
    $accessToken = $tokenResponse.access_token
    Write-Host "Access token acquired successfully." -ForegroundColor Green
}
catch {
    Write-Error "Failed to acquire access token: $_"
    exit 1
}

$apiUrl = "https://api.fabric.microsoft.com/v1/workspaces/$WorkspaceId/onelake/settings/modifyDiagnostics"

$body = @{
    status      = "Enabled"
    destination = @{
        type      = "Lakehouse"
        lakehouse = @{
            referenceType = "ById"
            itemId        = $LakehouseItemId
            workspaceId   = $WorkspaceId
        }
    }
} | ConvertTo-Json -Depth 5

$headers = @{
    Authorization  = "Bearer $accessToken"
    "Content-Type" = "application/json"
}

try {
    $response = Invoke-WebRequest -Method Post -Uri $apiUrl -Headers $headers -Body $body -UseBasicParsing
    Write-Host "Response Code: $($response.StatusCode)" -ForegroundColor Green
    Write-Host "Diagnostics setting modified successfully." -ForegroundColor Green
    if ($response.Content) {
        $response.Content | ConvertFrom-Json | ConvertTo-Json -Depth 5
    }
}
catch {
    if ($_.Exception.Response) {
        $statusCode = [int]$_.Exception.Response.StatusCode
        Write-Error "API call failed with status code: $statusCode"
        $reader = New-Object System.IO.StreamReader($_.Exception.Response.GetResponseStream())
        $errorBody = $reader.ReadToEnd()
        Write-Error "Response body: $errorBody"
    }
    else {
        Write-Error "API call failed: $($_.Exception.Message)"
    }
}

 
You should receive following status:

Hi rayphoon 
Thank you for reaching out to the Microsoft Fabric community forum.
 

The behavior you’re observing indicates that authentication and initial authorization are working, as the GET endpoint is successful and no 401 or 403 errors are returned. However, the Modify OneLake Diagnostics operation fails during backend processing. While the API documentation states that service principals are supported, write operations follow a different execution path than read operations, including additional internal validation and handling for long-running operations.
 

Before assuming a product issue, please verify that tenant settings allow service principals to access Fabric APIs, that the service principal has the required roles on both the source and destination workspaces, that both workspaces are on the same capacity, and that the 202/long-running operation pattern is being handled correctly. If all these conditions are met and the request still returns a 500 error only when using a service principal but works with a user token, this likely indicates a backend issue.

For more details, please refer to the Microsoft official documentation on
Developer admin settings - Microsoft Fabric | Microsoft Learn
Tenant settings index - Microsoft Fabric | Microsoft Learn

If you have any further questions, feel free to reach out and we'll be glad to assist.

Regards,

Microsoft Fabric Community Support Team.
 

Hi, I should have mentioned that testing was done using Postman so I could see the response codes returned.

Both workspaces are on the same capacity and the Service Principal is a member of a security group which has been granted API access for basically all settings in the Fabric Admin portal that has "service principal" in the setting name.

We have also tried adding the following API permissions to the App Registration service principal:

Azure Service Management - user_impersonation - Delegated

Azure Storage - user_impersonation - Delegated

Microsoft Graph - User.Read - Delegated

Power BI Service - App.Read.All, OneLake.ReadWrite.All - Delegated

The error is 500 - Internal server error with the following response: