Forum Discussion
FUAM Load_FUAM_Data_E2E error
Just an update on this. I discovered my issue was that the group with the SP account in it was not a member of the Admin Monitoring Workspace. When i added the group to this the pipeline ran successfully.
You do not need to add ANY permissions to the SP account in Azure.
Hi higgy7 ,
This sounds like a classic case of partial permission propagation with service principals in Fabric.
Here are a few things to double-check:
API Permissions Scope
Make sure the security group assigned to the service principal has both:- Capacity.Read.All
- Tenant.Read.All
These are required for accessing capacity-related endpoints like relativecapacities.
Admin Consent
Even if the permissions are assigned, they won’t take effect unless admin consent has been granted in Azure AD. You can verify this in the Azure portal under Enterprise Applications > API permissions.Service Principal Role in Fabric
Ensure the service principal is added as a Fabric Admin or at least has Capacity Admin rights in the Fabric portal. Sometimes being in the security group isn’t enough unless the group itself is granted Fabric-level roles.Token Scope
When generating the token for the service principal, make sure the scope includes:
https://analysis.windows.net/powerbi/api/.default
Otherwise, the token might not carry the right claims for capacity endpoints.
- Try Direct API Call
As a test, try calling the relativecapacities endpoint directly using Postman or curl with the same token. This can help isolate whether the issue is with the pipeline or the token itself.
Let me know if you want help testing the token or checking the group setup.
If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.
Hi Just on point 1. Does this not conflict with what has been described in the steps provided on github?
Yes it does, and I have seen it cause issues.
On a side note, are you using the latest version of the install from the fabric-toolbox collection?
https://github.com/microsoft/fabric-toolbox/tree/main/monitoring/fabric-unified-admin-monitoringHi Kevin, so does this mean that permissions DO need to be added within here?
Good question. What I shared doesn’t contradict the GitHub steps, but rather adds some extra checks that are sometimes missed in real-world setups.
The GitHub guide usually assumes:
- Admin consent has already been granted for the API permissions
- The service principal is correctly assigned to the right roles in both Azure and Fabric
- The token being used includes the correct scopes
In practice, though, we often see issues when:
- The security group has the permissions, but the service principal isn’t fully synced or recognized yet
- The token is missing the .default scope or is generated against the wrong resource
- The Fabric role assignment hasn’t propagated fully (especially if it was just added)
So no contradiction — just a few extra layers to double-check when things don’t behave as expected.
Let me know if you want to walk through your setup step-by-step and compare it with the GitHub flow.
If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.
I think a step by step would be really useful if possible. Thanks
