Forum Discussion
Issue with Workspace Identity Authentication in Fabric Data Pipeline Connector
Hi AdarshChekodu,
Unauthorized / The caller is not authenticated usually means the token the pipeline is running with isn’t recognized for the target action or object. With Workspace Identity that’s almost always one of: the identity isn’t enabled, it doesn’t have permissions on the target item(s), or the activity/connection isn’t actually set to use Workspace Identity.Troubleshooting steps
- Confirm Workspace Identity is enabled on the workspace.
Workspace settings > Identity > turn on Workspace identity. See: Workspace identity. - Use Workspace Identity in the activity/connection.
In the pipeline activity that calls the other pipeline (e.g., Invoke pipeline or HTTP), select Workspace identity as the authentication method. - Give the workspace identity permissions on the target pipeline and any referenced items.
Even in the same workspace, the identity must be able to execute the child pipeline (and anything it uses: notebooks, lakehouses, warehouses, connections). Add it as Contributor (or at least a role that can run pipelines) on those items. Docs: Authenticate with workspace identity. - Tenant/admin settings sanity check.
Make sure your Fabric admin has allowed service principals/managed identities as needed and that Fabric APIs are enabled for them if you also trigger via REST. Reference (APIs context): Pipeline REST API capabilities. - Re-test the Invoke pipeline activity.
There have been reports of failures when invoking pipelines using Workspace Identity; if you’re on that path and everything above is correct, you might be hitting a current limitation/bug. Community threads: Invoke pipeline using Workspace Identity fails.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
- Confirm Workspace Identity is enabled on the workspace.
tayloramy
Thanks alot for your response.
I have a doubt in point 3
I belive what you are saying is tha we need to explicitly provide permission to the Workspace Identity to a Fabric Data Pipeline? Since we cant manage permission for and individual data pipeline we need to Add the Workspace Identity App-Reg to an AD group and provide it Contributor level access to the same Workspace (since both pipelines are in same workspace)
Is my assumption above correct?
Hi AdarshChekodu,
When you create a workspace identity, it is not granted any workspace roles:
Notice that role is blank.
For it to be able to access items, it needs to be granted access. Granting it workspace contributor is the easiest way of doing this.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
I have given the Workspace Admin and using Workspace ID as Authentication, and my both pipelines are in same workspace. Still facing the Unauthorized error.
Hi Dark_Aria,
The OPs problem here was resolved and confirmed resolved by the OP.
Can you spin up a new post with details specific to your environment so we can better help you?
Please include the following:
Tenant settings for service principals accessing APIs
Screenshots of the workspace membership
If using a workspace identity, a screenshot of the workspace identity pageFeel free to tag me in this new post and I can help you out the best I can.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
