try to access lakehouse sql endpoint in azure web app using manage identity

[sau102798]

Hi all,

I'm encountering an issue while trying to access the Lakehouse SQL endpoint from my Azure Web App using a managed identity.

Everything was working fine until Friday, 12th May 2025. Since then, the connection has suddenly stopped working. I’ve tried various authentication combinations, but the issue persists.

Error:

Pyodbc.InterfaceError: ('28000', "[28000] [Microsoft][ODBC Driver 18 for SQL Server][SQL Server]Login failed for user '<token-identified principal>'. Reason: Validation of user's permissions failed. Verify the user has the Read item permission. For more information, se (18456) (SQLDriverConnect)")

It seems to be a permission-related issue. Could someone please assist in resolving this?

[v-prasare · Accepted solution]

Hi @sau102798 , 

If your blocked here in this scenario i suggest you to raise a support ticket here. so, that they can assit you in addressing the issue you are facing. please follow below link on how to raise a support ticket:

How to create a Fabric and Power BI Support ticket - Power BI | Microsoft Learn

thanks,

prashanth

[sau102798]

I'm trying to add a token with the appropriate scope(Point 1), but it's not working for me.

The SQL endpoint URL I'm using starts with:
xyz.msit-datawarehouse.fabric.microsoft.com

Currently, I'm facing the following issue when trying to connect:

('28000', '[28000] [Microsoft][ODBC Driver 18 for SQL Server][SQL Server]Could not login because the authentication failed. (18456) (SQLDriverConnect)')

[burakkaragoz]

Hi @sau102798 ,

Just checking in – did the steps I shared help resolve the issue?

✅ If it’s working now, feel free to mark the response as the Accepted Solution. This helps others who face the same issue find the fix faster.
✨ And of course, a little Kudos would be much appreciated!

If you're still running into trouble, let me know what you've tried so far and I’ll help you dig deeper. We’ll get it sorted!

[burakkaragoz]

Hi @sau102798 ,

The error you're seeing usually means that the Managed Identity used by your Azure Web App no longer has the required permissions on the Lakehouse SQL endpoint.

Here’s what you can try:

1. Check if the Managed Identity is still enabled in your Web App (under Identity > System Assigned).
2. Go to your Lakehouse workspace and make sure the Managed Identity has the correct role assigned – ideally something like Lakehouse Reader or Fabric Lakehouse Artifact Reader.
3. If needed, manually grant SQL permissions using:

   GRANT SELECT ON SCHEMA :: [YourSchema] TO [<managed-identity-name>];

1. Make sure you're requesting the token with the correct scope:

   https://database.windows.net/

1. Also double-check if any workspace-level security or RBAC changes were made after May 12.

If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.

[sau102798]

Thank you for your reply @burakkaragoz . I followed all the steps, but I am still getting an authentication error. I am using the trial version of Fabrics. Is there any limit to running queries? 

[burakkaragoz]

Hey @sau102798 

Thanks for the update – good to know you followed the steps.

Since you're using the trial version of Fabric, here are a few things to double-check:

Authentication Troubleshooting

1. AAD Token Scope
   Make sure the token you're using has the correct scope:

   https://lakehouse.fabric.microsoft.com/.default

If you're using https://graph.microsoft.com/.default or similar, it won’t work for SQL endpoint access.

1. Service Principal Permissions
   If you're authenticating via a service principal, ensure it has:

   • Access to the workspace
   • At least Viewer or Contributor role
   • Permission to access the Lakehouse item

2. Trial Limitations
   While the trial version supports most features, there might be capacity throttling or token expiration issues if the environment is idle for too long. Try refreshing the token and re-running the query.

3. SQL Endpoint URL Format
   Double-check the endpoint URL – it should look like:

   https://onelake.fabric.microsoft.com/sql-endpoint/<workspace-id>/<lakehouse-name>

If you can share the exact error message (even just the first line), I can help pinpoint it further.

---

If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.