Issue with Workspace Identity Authentication in Fabric Data Pipeline Connector

[AdarshChekodu]

Hi everyone,

I’m encountering a problem when trying to use Workspace Identity for authentication with the Fabric Data Pipeline Connector.

Background:

• When using the Developer’s OAuth 2.0 authentication method, if the developer changes their account password, the connector breaks.

• To avoid this, I tried switching to Workspace Identity authentication.

The problem:

When I use Workspace Identity to authenticate the pipeline, I get the following error:

{ "requestId": "375296e6-9949-4291-83eb-45fd2c206deb", "errorCode": "Unauthorized", "message": "The caller is not authenticated to access this resource" }

Note: The pipeline I am triggering is in the same workspace as the main pipeline

My question:

Could someone please help me understand what might be wrong with my setup? What could be causing the Workspace Identity authentication to fail?

Thanks in advance!

[v-ssriganesh]

Hi @AdarshChekodu,

Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to @tayloramy for sharing valuable insights.

Could you please confirm if your query has been resolved by the provided solutions? This would be helpful for other members who may encounter similar issues.

Thank you for being part of the Microsoft Fabric Community.

[tayloramy · Accepted solution]

Hi @AdarshChekodu,

Unauthorized / The caller is not authenticated usually means the token the pipeline is running with isn’t recognized for the target action or object. With Workspace Identity that’s almost always one of: the identity isn’t enabled, it doesn’t have permissions on the target item(s), or the activity/connection isn’t actually set to use Workspace Identity.

Troubleshooting steps

1. Confirm Workspace Identity is enabled on the workspace.
   Workspace settings > Identity > turn on Workspace identity. See: Workspace identity.
2. Use Workspace Identity in the activity/connection.
   In the pipeline activity that calls the other pipeline (e.g., Invoke pipeline or HTTP), select Workspace identity as the authentication method.
3. Give the workspace identity permissions on the target pipeline and any referenced items.
   Even in the same workspace, the identity must be able to execute the child pipeline (and anything it uses: notebooks, lakehouses, warehouses, connections). Add it as Contributor (or at least a role that can run pipelines) on those items. Docs: Authenticate with workspace identity.
4. Tenant/admin settings sanity check.
   Make sure your Fabric admin has allowed service principals/managed identities as needed and that Fabric APIs are enabled for them if you also trigger via REST. Reference (APIs context): Pipeline REST API capabilities.
5. Re-test the Invoke pipeline activity.
   There have been reports of failures when invoking pipelines using Workspace Identity; if you’re on that path and everything above is correct, you might be hitting a current limitation/bug. Community threads: Invoke pipeline using Workspace Identity fails.

 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[AdarshChekodu]

@tayloramy 

Thanks alot for your response.

I have a doubt in point 3

I belive what you are saying is tha we need to explicitly provide permission to the Workspace Identity to a Fabric Data Pipeline? Since we cant manage permission for and individual data pipeline we need to Add the Workspace Identity App-Reg to an AD group and provide it Contributor level access to the same Workspace (since both pipelines are in same workspace)

Is my assumption above correct?

[tayloramy]

Hi @AdarshChekodu, 

When you create a workspace identity, it is not granted any workspace roles: 

Notice that role is blank. 

For it to be able to access items, it needs to be granted access. Granting it workspace contributor is the easiest way of doing this. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[Dark_Aria]

Hi @v-ssriganesh @tayloramy 

I have given the Workspace Admin and using Workspace ID as Authentication, and my both pipelines are in same workspace.  Still facing the Unauthorized error.

[tayloramy]

Hi @Dark_Aria, 

The OPs problem here was resolved and confirmed resolved by the OP. 
Can you spin up a new post with details specific to your environment so we can better help you?
Please include the following:

Tenant settings for service principals accessing APIs
Screenshots of the workspace membership
If using a workspace identity, a screenshot of the workspace identity page

Feel free to tag me in this new post and I can help you out the best I can.

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[AdarshChekodu]

@tayloramy 

Thanks alot; this seems to have fixed the problem.

Regards,

Adarsh