Forum Discussion
How to remove workspace using Service Principal via Azure Pipeline
Hi piotr_szczerba,
Thank you for your patience, and I apologize for the delayed response!
Based on your findings, the issue appears to be primarily related to the execution order of Terraform rather than API permissions. Since an Admin role cannot be removed if it is the only one remaining, your automation should first delete the workspace while the SPN still has Admin access. Once the workspace is deleted, role assignments are automatically removed, thereby avoiding the API restriction.
Regarding API permissions, you are correct that the "Workspace.ReadWrite.All" permission required for role removal is Delegated, meaning it requires a signed-in user rather than an SPN using Application permissions. Unfortunately, Azure Entra does not provide this permission in Application mode, so your SPN cannot directly remove role assignments via the API. However, this should not impact the deletion of the workspace itself if the execution order is correctly followed.
- The error is likely caused by Terraform trying to remove the Admin role before deleting the workspace, rather than an issue with API permissions.
- Adjust the Terraform execution order to ensure the workspace is deleted first while the SPN retains Admin access.
- Since SPNs cannot utilize Delegated permissions, role removal through the API is not feasible for your setup. However, deleting the workspace should automatically address the role assignments.
If you find this post helpful, kindly accept it as a solution to assist other community members who might be facing a similar issue.
Community SupportHi piotr_szczerba ,
Thank you for reaching out to the Microsoft Forum Community.
Based on the error message, it appears to be an issue with insufficient privileges. Please follow these troubleshooting steps, which may help resolve the problem:
- Although you have given "Tenant.WriteReadAll", it may not directly provide the granular permissions required for specific Fabric API actions. Tenant-level permissions typically apply to Azure AD objects, rather than individual resources within services like Fabric.
- Verify the service principal has a direct Admin role on the workspace.
- Ensure there are no Azure Policies that restrict the deletion of workspaces by Service Principals. Such policies could override permissions.
- Confirm that the Azure Pipeline correctly authenticates using the Service Principal credentials is also significant. Any misconfiguration in authentication could lead to permission-related errors during operations like deletion.
If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thank you
Hi v-saisrao-msft
Thank you for the reply.
I just found that it's not really issue with workspace deletion itself but removal of last Role Assignment (Admin Role of SPN).
Terraform first creates the Workspace, then assigns Roles, as well as Admin role for SPN.
When I try to remove the workspace, terraform tries to remove role assignments first and I think this leads to the issue.
According to this documentation:
Workspaces - Delete Workspace Role Assignment - REST API (Core) | Microsoft Learn
In order to remove workspace role assignment I need:
1. Admin role on a workspace
2. Delegated Scope "Workspace.ReadWrite.All"
3. Admin role cannot be removed when it's the only admin role left there.
My question is:
I assume that my terraform automation has to remove the workspace first (while it still has access to it) instead of removing last Admin Role (SPN role used for automation) before workspace removal? and thats why I receive that error with a bit misleading error description?
Or this error description is more likely related with a type of API Permission which I use. Its docummented that this API Request requires Delegated Scope "Workspace.ReadWrite.All". I have currently Tenant Write.Read.All Application Type permissions on Power Bi Scope, and it's the only possible API Permissions role available in Azure Entra with Application Type Permission.
- v-saisrao-msft
Hi piotr_szczerba,
Thank you for your patience, and I apologize for the delayed response!
Based on your findings, the issue appears to be primarily related to the execution order of Terraform rather than API permissions. Since an Admin role cannot be removed if it is the only one remaining, your automation should first delete the workspace while the SPN still has Admin access. Once the workspace is deleted, role assignments are automatically removed, thereby avoiding the API restriction.
Regarding API permissions, you are correct that the "Workspace.ReadWrite.All" permission required for role removal is Delegated, meaning it requires a signed-in user rather than an SPN using Application permissions. Unfortunately, Azure Entra does not provide this permission in Application mode, so your SPN cannot directly remove role assignments via the API. However, this should not impact the deletion of the workspace itself if the execution order is correctly followed.
- The error is likely caused by Terraform trying to remove the Admin role before deleting the workspace, rather than an issue with API permissions.
- Adjust the Terraform execution order to ensure the workspace is deleted first while the SPN retains Admin access.
- Since SPNs cannot utilize Delegated permissions, role removal through the API is not feasible for your setup. However, deleting the workspace should automatically address the role assignments.
If you find this post helpful, kindly accept it as a solution to assist other community members who might be facing a similar issue.
- v-saisrao-msft
Hi piotr_szczerba,
We haven’t heard back from you regarding your issue. If it has been resolved, please mark the helpful response as the solution and give a ‘Kudos’ to assist others. If you still need support, let us know.
Thank you.