What happens when a user that owns items is disabled / removed from EntraID

[nomadica]

This is more of an informational message rather than a question.

Recently we disabled an EntraID account that was used to create a number of items including lakehouses, warehouses, notebooks, conenctions, and others (yes that was a bad governance/design not to use service account, but doing mistakes is what enriches knowledge).

We re-enabled the account, that solved only lakehouse SQL endpoint point 1 below. 

We started getting the below behaviour: 

1- Slow lakehouses, and failed SQL endpoints with the message error5/Access is defnied. 

2- Cannot browse lakehouses from dataflow destination

3- Notebook that had parameters stored in a lakehouse file failed with error: ErrorCode=LakehouseOperationFailed,'Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException,Message=Lakehouse operation failed for: Failed to get User Auth access token. The error message is: Failed to get User Auth access token. The error message is: AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. 

4-Dataflow that used lakehouse as destination gave this error: 'Something went wrong, please try again later. If the error persists, please contact support.'. Error code: TokenExpiredError

The solution was mainly to resetup some of the items. That can be devastating if that user created hundreds of items.

Please note that if you want to change the ownership of a lakehouse, it can only be done via MS now, Warehouse can be changed in PowerShell using Change ownership of Fabric Warehouse - Microsoft Fabric | Microsoft Learn, Lakehouse owner change is expected in Feb, 2025 (according to some chat I had with MS support).

PS: If you want to do lakehouse ownership with MS, you need to provide workspace ID, lakehouse ID, old and new user object IDs, for all of them. You will need to run a powershell to get the list of workspaces and datasets in them (Get-PowerBIDataset | Export-Csv -Path "Warehouses.csv" -NoTypeInformation)

[V-yubandi-msft]

Hi @nomadica ,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution we provided for your issue worked for you  or let us know if you need any further assistance?

Your feedback is important to us, Looking forward to your response. 

Thank You.

[V-yubandi-msft]

Hi @nomadica ,

Thank you for reaching out to the Microsoft Fabric community.

There are several circumstances where a user may become disabled.

• When a Dataverse user has no app or license assigned.
• When an environment is created with no initial assignment of a Microsoft Entra group    but then is assigned subsequently. Users not in the group become disabled.
• When a user is removed from the Microsoft Entra group.

To address this, there's an organization setting that lets you override the validation of unlicensed or removed users, allowing you to delete them if needed.

For full details, please check the official Microsoft documentation attached below. It provides comprehensive information and should address your query.

Link:  Delete unlicensed or removed Microsoft Entra group users - Power Platform | Microsoft Learn

If my answer addressed your query, kindly mark it as the Accepted Solution to assist others.

I'd also be grateful for a 'Kudos' if you found my response useful!  

[nomadica]

Thank you @V-yubandi-msft ,

My post is not related to dataverse; can you please clarify if there is a relationship between Fabric OneLake and Dataverse?

[V-yubandi-msft]

Hi @nomadica ,

Thank you for your quick response. We understand that your issue is not related to Dataverse, and we mentioned it just as one possible scenario.

Relationship between Fabric OneLake and Dataverse:

OneLake can also act as a central location for data, which can then be fed to Dataverse so that users combine structured and unstructured data. While Dataverse focuses more on relational data for business processes, OneLake is used for general analytics and big data workloads.

Main use of Dataverse is to hold structured data that can be included in business applications, while OneLake is for holding broader ranges of diverse data that can then be used within analytics, machine learning, or business intelligence applications.

Did I answer your question, please mark it as the Accepted Solution, it will help others. If you need more details, feel free to reach out. Let me know if you need any further modifications.

[V-yubandi-msft]

Hi @nomadica ,

We noticed we haven't received a response from you yet, so we wanted to follow up and ensure the solution we provided addressed your issue. If you require any further assistance or have additional questions, please let us know.

Your feedback is valuable to us, and we look forward to hearing from you soon.

Thank You.

[nomadica · Accepted solution]

Hello,

THe answer doesn't really provide a soltion. What I would accept as a solution is what MS released yesterday: https://learn.microsoft.com/en-us/fabric/fundamentals/item-ownership-take-over