Pipeline → Notebook Activity fails with AADSTS65002 OBO token error on Fabric Trial capacity

[praveensreeram]

**Environment:**
- Capacity: Fabric Trial (FTL64) | Region: Central India
- Workspace Identity: wwi_dev (Service Principal)

**Problem:**
Notebook runs perfectly in interactive mode but fails every time from a Pipeline Notebook Activity — even with a basic print() statement (no Spark code).

**Error:**
```
Failed to create Livy session for executing notebook.
{
"code": "BadRequest",
"message": "Encountered internal error while calling TokenProvider to get obo token. The return code is BadRequest.",
"httpStatusCode": 500,
"ErrorSource": "Fabric/Core Platform AuthNZ and Metadata"
}
```

**Troubleshooting Completed:**
✅ Notebook runs fine interactively
✅ Tenant Settings enabled: Users can create Fabric items, Service principals can use Fabric APIs, read-only admin APIs, Notebooks can use Spark compute
✅ Workspace Identity configured with Contributor role
✅ Security group created & added to Admin API tenant settings
✅ API permissions added to wwi_dev app registration: Microsoft Graph, Power BI Service, Azure Storage
✅ Admin consent granted
✅ Waited 15+ mins for propagation
✅ Environment created & attached to notebook
✅ Session tag added for High Concurrency mode
✅ Deleted & recreated Notebook activity in Pipeline
✅ Cancelled all queued/not-started runs in Monitor

**Root Cause Found:**
When attempting OAuth 2.0 authentication, I get:
```
AADSTS65002: Consent between first party application
'794d4046-fdd1-4645-a4c2-69a5ec34f39e' (Fabric Pipeline Service)
and first party resource '00000002-0000-0000-c000-000000000000'
(Microsoft Graph) must be configured via preauthorization.

Trace ID: ba96741d-16f9-4ec6-a7eb-5c3ff2322000
Correlation ID: 390c53b4-02c6-4516-9f66-c726d3c3dee1
Timestamp: 2026-04-26 04:41:29Z
```

Even as Global Admin, this consent CANNOT be granted — it requires Microsoft-level preauthorization between their own first-party apps.

**Questions:**
1. Is Pipeline → Notebook OBO token flow a known limitation on Fabric Trial?
2. Does this work on paid F SKU capacities?
3. Is AADSTS65002 between Fabric Pipeline Service and Microsoft Graph a known bug?
4. Any undocumented workaround besides Notebook Scheduler?

Currently blocked from using Pipeline → Notebook entirely on Trial. Only workaround is Notebook Scheduler which doesn't support dynamic parameter passing.

Any help appreciated! 🙏

[tayloramy]

Hi @praveensreeram, 

When you are calling the notebook from the pipeline, are you using a connection? If so, are you using oauth, WI, or a service principal for that coonnection? 

[Lozovskyi · Accepted solution]

Hello @praveensreeram,

You have done nice debugging and lots of steps. Seem to be working.

Only few things to check.

If you can run this notebook successfully in interactive mode, does work via pipeline if there is no connection assigned to the run?

[praveensreeram]

Yes @Lozovskyi , I fixed it sometime ago.

In regular Fabric - with connection, it's working

In Trail FAbric - with connection, it's not working. After removing the connection, it's working.