Trusted workspace access to ADLS does not work with 403 error

[apturlov]

I am trying to configure Trusted Workspace Access to Azure Data Lake Storage Account from a Fabric workspace using a workspace identity when the ADLS public network access is set to "Enabled from selected network". To exclude the obvious situation, I verified that the shortcut works when the ADLS public network access is set to simply enabled.

My scenario is that I want to create a shortcut in a Lakehouse from the ADLS file folder that contains many .CSV files. It's an enterprise environment so ADLS is not allowed to have public access.

For this configuration I used this article Trusted workspace access in Microsoft Fabric - Microsoft Fabric | Microsoft Learn, and I should mention that it's severely outdated, but I could not find any other documentation.

What I did:
1. Enabled identity in the workspace.
2. Assigned Storage Blob Data Owner RBAC to the workspace identity on the entire ADLS account.

3. Added the workspace identity as a Memeber to the workspace user access list.

4. Created a network rule for the ADLS using PowerShell script from the article above.

5. Created a connection in Fabric to the ADLS container using DFS endpoint and Workspace Identity authentication.

6. Tried to create a shortcut in the Lakehouse and got this error:

Interestingly, UI shows a container name in the left pane.

Now, I change the ADLS public network access to enabled and I can create a working shortcut. Change public network access to Enabled for selected networks and it stops working.

I performed extensive checks of all the settings using PowerShell so I am pretty shure I did not miss anything. This is very frustrating and I've spent many hours at this point going back and forth with the configuration with no success. Hope, someone can spot what I missed or did wrong. 

[ajarora]

You mentioned you are seeing this issue as part of using shortcut.

You can use CopyJob instead (with Pipeline if you want), which supports trusted service flow with storage with Workspace Identity.

[apturlov · Accepted solution]

I did not mention that I used a Trial Capacity for this experiement and just now after wasting many hours for this feature I've noticed in that article that the Trial capacity is not supported. Bummer 😞

I tested with the commercial F2 and the shortcut worked just fine.
This is not an issue any more.