Unable to Invoke User Data Function From Power Automate - 403 Forbidden

[JeffreyGonzalez]

I am trying to invoke a UDF from a power automate cloud flow. 

I have generated/registered an application in entra with the proper permissions indicated in the following documentation: https://learn.microsoft.com/en-us/fabric/data-engineering/user-data-functions/tutorial-invoke-from-p...

Namely, the application has been granted GraphQLApi.Execute.All permissions. 

I have tested this with the UDF that I plan to use as well as a simpler UDF that just returns text. 

The Registered application has contributor access in the workspace and also has execute permissions on the specific UDFs that I have tested. 

I generate a token with the client id and client secret against the https://login.microsoftonline.com/<removed>/oauth2/v2.0/token endpoint sucessfully with a scope of "https://analysis.windows.net/powerbi/api/.default"

Upon using the token generated from the above post request, I make a post request to the endpoint provided by the UDF invokation code with my bearer token and receive a '403 Forbidden' error. 

Is there anything that I am missing in terms of permissions, scopes, etc that is inhibiting me from making this function call? 

I have been able to recreate the error in Postman with the same steps listed above. 

[v-nmadadi-msft]

Hi @JeffreyGonzalez 

As we haven’t heard back from you, we wanted to kindly follow up to check if the suggestions  provided by the community members for the issue worked. Please feel free to contact us if you have any further questions.

Thanks and regards

[v-nmadadi-msft]

Hi @JeffreyGonzalez 

May I check if this issue has been resolved? If not, Please feel free to contact us if you have any further questions.

Thank you

[v-nmadadi-msft]

Hi @JeffreyGonzalez 

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.

Thank you.

[nielsvdc]

Hi @JeffreyGonzalez,

First you might want to check the UDF error codes list. A "403 Forbidden" error might not what you think and is according to the list that the response was too large and the invocation failed. So authentication might be correct, but your response output might be over 30MB. Check the UDF service limits list for the response size limit.

If this does not help, you can try to add the Item.Execute.All permission to the service principal.

Hope this helps. If so, please give a Kudos 👍 and mark as Accepted Solution ✔️.

Niels

[JeffreyGonzalez]

Hello, Sorry for the delay. 

To add a layer of complexity to this process, the UDF only returns a status code/success message. Its intended purpose is to run a power automate flow at the end to send data. Any time I try to run the UDF, I am hit with 403. 

The service principal has the following delegated permissions. Is there something that I am missing here? 

[nielsvdc]

Have you tried running the UDF with the default example code and does it work? If yes, there is probably nothing wrong with the permissions for your UDF and then check the info below. If not, I currently don't have the answer.

If you are already trying to trigger the Power Automate flow using the UDF, the UDF might be returning the error from the Power Automate flow. Have you tried triggering the flow from a tool like Bruno or Postman and see if it works?

If not first check the permission on the trigger if it's set to Anyone.

Second, the sp parameter default value in the flow URI is "%2Ftriggers%2Fmanual%2Frun". You can try to change it to "/triggers/manual/run" and see if that works.