Failed to resolve connection when deploying workspace with SPN

[mra1]

Answer: Microsoft added more information to the error, specifying that the SPN did not have proper Key Vault access:

Failed to resolve connection '<guid>' referenced in activity run '<guid>'. ErrorCode: 'DMTS_UserlsNotAllowedToAccessAzureKeyVaultConnectionErrorCode'. ErrorMessage: '{"error":
{"code":"DMTS_UserlsNotAllowedToAccessAzureKeyVaultConnectionErrorCode","pbi.error":{"code":"DMTS_UserlsNotAllowedToAccessAzureKeyVaultConnectionErrorCode","parameters":(),"details":[],"exceptionCulprit":1])}'.

When deploying a data pipeline to a new workspace (staging) using SPN I get the error "Failed to resolve connection'' referenced in activity run''". The SPN has access to connection in question under "Manage Connections and Gateways". When deploying as my own AD user, I do not get this error.

I found other posts that seem to have the same error:

• https://www.reddit.com/r/MicrosoftFabric/comments/1mks48b/copy_data_failed_to_resolve_connection_to/
• https://community.fabric.microsoft.com/t5/Data-Pipeline/Pipeline-activities-failing-with-Failed-to-r...

But no workaround works.

The SPN also has admin access to the workspace.

[v-prasare]

Hi @mra1,

We would like to confirm if our community members answer resolves your query or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are happy to help you.

@Shahid12523& @suparnababu8  Thanks for your prompt response

Thank you for your patience and look forward to hearing from you.
Best Regards,
Prashanth Are

[Shahid12523]

The error happens because SPNs need explicit access to each connection, not just workspace admin rights. Even if the SPN is workspace admin, it may lack credentials or gateway access that a personal AD user has.

Fix:

• Grant the SPN explicit access to the connection in staging workspace.
• Ensure the connection uses SPN authentication with proper credentials.
• If using a gateway, give the SPN gateway access.
• Deploy connections first, then the pipeline.
• This ensures the SPN can resolve the connection at runtime.

[mra1 · Accepted solution]

Thank you for your answer, Microsoft changed the error to include that the SPN did not have access to the Azure Key Vault resource that the connection used. The connection inside Fabric was set up correctly. My fix in this case was to change the connection from a Key Vault reference, to write the password in the connection, although that is not my preferred solution, and therefore need to research which permission the SPN needs in Key Vault. 

[suparnababu8]

Hi @mra1 

I think it's kind of know issue in MS Fabric. It's recorded as a new issue in Microsoft fabric github please read this thread Error while deploying data pipelines to fabric workspace · Issue #433 · microsoft/fabric-cicd 

If no workaround woudn't work, you ahve to wait till Microsoft fix this issue.

Thank you!

Please let me knwo if it helps you.

Did I answer your question? Mark my post as a solution!

Proud to be a Super User!

[mra1]

Hi @suparnababu8 

I think it might be related, although I can succesfully deploy, and can see that the connection has been changed to the correct staging connection, but the data pipeline fails when running, since it cannot resolve the connection. A workaround would be to use my own AD user as the deploying intance, although I'm not sure on how to set that up.