Forum Discussion

AdarshChekodu's avatar
AdarshChekodu
Advocate IV
10 months ago
Solved

Issue with Workspace Identity Authentication in Fabric Data Pipeline Connector

Hi everyone,

I’m encountering a problem when trying to use Workspace Identity for authentication with the Fabric Data Pipeline Connector.

Background:

  • When using the Developer’s OAuth 2.0 authentication method, if the developer changes their account password, the connector breaks.

  • To avoid this, I tried switching to Workspace Identity authentication.

The problem:

When I use Workspace Identity to authenticate the pipeline, I get the following error:

 
{ "requestId": "375296e6-9949-4291-83eb-45fd2c206deb", "errorCode": "Unauthorized", "message": "The caller is not authenticated to access this resource" }
 

Note: The pipeline I am triggering is in the same workspace as the main pipeline

My question:

Could someone please help me understand what might be wrong with my setup? What could be causing the Workspace Identity authentication to fail?

Thanks in advance!

Need Help
pipelines
  • tayloramy's avatar
    tayloramy
    10 months ago

    Hi AdarshChekodu,

     


    Unauthorized / The caller is not authenticated usually means the token the pipeline is running with isn’t recognized for the target action or object. With Workspace Identity that’s almost always one of: the identity isn’t enabled, it doesn’t have permissions on the target item(s), or the activity/connection isn’t actually set to use Workspace Identity.

    Troubleshooting steps

    1. Confirm Workspace Identity is enabled on the workspace.
      Workspace settings > Identity > turn on Workspace identity. See: Workspace identity.
    2. Use Workspace Identity in the activity/connection.
      In the pipeline activity that calls the other pipeline (e.g., Invoke pipeline or HTTP), select Workspace identity as the authentication method.
    3. Give the workspace identity permissions on the target pipeline and any referenced items.
      Even in the same workspace, the identity must be able to execute the child pipeline (and anything it uses: notebooks, lakehouses, warehouses, connections). Add it as Contributor (or at least a role that can run pipelines) on those items. Docs: Authenticate with workspace identity.
    4. Tenant/admin settings sanity check.
      Make sure your Fabric admin has allowed service principals/managed identities as needed and that Fabric APIs are enabled for them if you also trigger via REST. Reference (APIs context): Pipeline REST API capabilities.
    5. Re-test the Invoke pipeline activity.
      There have been reports of failures when invoking pipelines using Workspace Identity; if you’re on that path and everything above is correct, you might be hitting a current limitation/bug. Community threads: Invoke pipeline using Workspace Identity fails.

     

    If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

7 Replies

  • tayloramy's avatar
    tayloramy
    Super User
    10 months ago

    Hi AdarshChekodu,

     


    Unauthorized / The caller is not authenticated usually means the token the pipeline is running with isn’t recognized for the target action or object. With Workspace Identity that’s almost always one of: the identity isn’t enabled, it doesn’t have permissions on the target item(s), or the activity/connection isn’t actually set to use Workspace Identity.

    Troubleshooting steps

    1. Confirm Workspace Identity is enabled on the workspace.
      Workspace settings > Identity > turn on Workspace identity. See: Workspace identity.
    2. Use Workspace Identity in the activity/connection.
      In the pipeline activity that calls the other pipeline (e.g., Invoke pipeline or HTTP), select Workspace identity as the authentication method.
    3. Give the workspace identity permissions on the target pipeline and any referenced items.
      Even in the same workspace, the identity must be able to execute the child pipeline (and anything it uses: notebooks, lakehouses, warehouses, connections). Add it as Contributor (or at least a role that can run pipelines) on those items. Docs: Authenticate with workspace identity.
    4. Tenant/admin settings sanity check.
      Make sure your Fabric admin has allowed service principals/managed identities as needed and that Fabric APIs are enabled for them if you also trigger via REST. Reference (APIs context): Pipeline REST API capabilities.
    5. Re-test the Invoke pipeline activity.
      There have been reports of failures when invoking pipelines using Workspace Identity; if you’re on that path and everything above is correct, you might be hitting a current limitation/bug. Community threads: Invoke pipeline using Workspace Identity fails.

     

    If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

    • AdarshChekodu's avatar
      AdarshChekodu
      Advocate IV
      10 months ago

      tayloramy 

      Thanks alot for your response.

      I have a doubt in point 3

      I belive what you are saying is tha we need to explicitly provide permission to the Workspace Identity to a Fabric Data Pipeline? Since we cant manage permission for and individual data pipeline we need to Add the Workspace Identity App-Reg to an AD group and provide it Contributor level access to the same Workspace (since both pipelines are in same workspace)

      Is my assumption above correct?

      • tayloramy's avatar
        tayloramy
        Super User
        10 months ago

        Hi AdarshChekodu, 

         

        When you create a workspace identity, it is not granted any workspace roles: 

        Notice that role is blank. 

        For it to be able to access items, it needs to be granted access. Granting it workspace contributor is the easiest way of doing this. 

         

        If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

  • v-ssriganesh's avatar
    v-ssriganesh
    Community Support
    10 months ago

    Hi AdarshChekodu,

    Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to tayloramy for sharing valuable insights.

     

    Could you please confirm if your query has been resolved by the provided solutions? This would be helpful for other members who may encounter similar issues.

     

    Thank you for being part of the Microsoft Fabric Community.