Forum Discussion
Power BI & Mirrored Databricks Catalog — Table Access Forbidden errors despite Unity Catalog access
Hi RomanTesolkin,
Since only specific tables fail, looks like those tables most likely have row filters or column masks applied in unity catalog. Databricks blocks those tables with row-level security or column masks from being mirrored to external systems like fabric, so you get TableAccessForbidden even though the required permissions are correct.
Remove the row filter or column mask from those and then retry the sync.
Thanks and regards,
Anjan Kumar Chippa
hi Anjan, as mentioned above all tables fail over mirroring, however, i can query them in Power BI over standard Azure Databricks connector and Databricks directly, no access issues. There are no masks applied, on the tables, as i tried to test on dummy excel file as well. It's being blocked on catalogue level fro some reason.
- v-achippa1 month agoCommunity Support
Hi RomanTesolkin,
Here the mirroring reads directly from the catalog, not through the databricks compute like the standard connector, so some catalog types are not supported for mirroring even though they can be queried normally through other methods.
- Since your entire catalog fails, check how it was created in unity catalog. Mirroring does not support lakehouse federated tables and delta sharing tables, or other unsupported table types, please check if your catalog is one of those types. So to use mirroring, the data should be stored in a supported standard unity catalog-managed catalog.
Please refer below documentation:
https://learn.microsoft.com/en-us/fabric/mirroring/azure-databricks-limitations
Thanks and regards,
Anjan Kumar Chippa
- v-achippa1 month agoCommunity Support
Hi RomanTesolkin,
As we haven’t heard back from you, we wanted to kindly follow up to check if the solution I have provided for the issue worked? or let us know if you need any further assistance.
Thanks and regards,
Anjan Kumar Chippa
- RomanTesolkin1 month agoFrequent Visitor
Hi Anjan,
Thanks for the follow-up — this is still not resolved, and I don't think it's non of the listed catalogue types listed in the limitation section, its a simple catalogue with xlsx file in it for testing purposes. Tried with other catalogues,same error.
We also reviewed with Microsoft colleguew the HAR file and backend telemetry for the failing Fabric preview/query operations.
The Databricks-side validation showed that the source catalog, schema, and tables are visible, and a direct query against one of the source tables completed successfully from Databricks. This confirms that the source object exists and can be read directly from the Databricks side.
However, the Fabric-side requests are failing after the mirrored catalog has been created, during the preview/query flow.
Key observations
- The mirrored catalog, schema, and tables are visible in Fabric.
- The Databricks catalog, schema, and tables are visible directly in Databricks.
- A direct Databricks SQL query against the source table completed successfully.
- External Data Access is enabled on the Databricks metastore.
- The required Unity Catalog access was reviewed during the session.
- The HAR and telemetry show that the Fabric UI error is generic, but the backend errors are more specific.
- One failing Fabric preview request returned:
Invalid object name 'test'
- The telemetry shows a SQL exception while Fabric is executing the preview query through the Databricks mirrored catalog path:
Microsoft.Data.SqlClient.SqlException
Number: 208
Message: Invalid object name
- A separate HAR request through the OneLake query path also failed with
QueryFeatureMwcTokenAuthFailure
Status: 403
ErrorCode: AuthorizationFailure
Troubleshooting steps performed
- Reviewed the Fabric connection used by the mirrored Databricks catalog.
- Confirmed that the connection is configured with OAuth authentication.
- Reviewed Databricks Unity Catalog permissions.
- Reviewed the Databricks metastore configuration and confirmed External Data Access is enabled.
- Ran a direct Databricks SQL query against one of the source tables, which returned data successfully.
- Reviewed the HAR file for the failing Fabric preview and query requests.
- Reviewed backend telemetry using the Root Activity IDs from the failed operations.
- Confirmed that the failure occurs in the Fabric preview/query path after the catalog and table metadata are already visible.
Current findings / hypothesis
Based on the current evidence, this does not appear to be a straightforward Databricks-side table permission issue.
The main reason is that the source table can be queried successfully from Databricks, while the failure occurs when Fabric attempts to preview or query the mirrored object through the Fabric Databricks mirrored catalog and OneLake shortcut path.
At this stage, the issue appears more likely related to one of the following areas:
- Fabric mirrored catalog metadata/object resolution.
- Fabric SQL endpoint metadata availability for the mirrored catalog.
- OneLake shortcut authorization or shortcut state.
- Fabric-side access/execute permissions for the user or item.
The two backend errors are important for the next investigation phase:
Invalid object name 'test'
and
QueryFeatureMwcTokenAuthFailure / 403 AuthorizationFailure
Together, these suggest that Fabric can discover the mirrored structure, but the preview/query layer is not able to successfully resolve or authorize access to the object through the mirrored catalog/shortcut path.
i ws suggested Action Plan
- Please test the same preview operation with a user that has Fabric Workspace Admin or Member permissions, to help rule out a Fabric-side permission/execute access issue.
- If possible, create a new mirrored catalog using the same Databricks connection and the same source catalog/schema. This will help confirm whether the issue is isolated to the existing mirrored artifact.
- If available, please validate from the Fabric SQL endpoint whether the impacted table is present in the SQL endpoint metadata by running:
SELECT TABLE_SCHEMA, TABLE_NAME
FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_SCHEMA = 'test_usr'
AND TABLE_NAME = 'test';
Output:
Admin/Member permissions: I am a Fabric Admin and have admin rights on the tested workspace, so this rules out a workspace-level permission gap on my account.
New mirrored catalog: Created a fresh mirrored catalog using the same Databricks connection and source catalog/schema. Same result — preview/query still fails.
SQL endpoint metadata check: Ran the suggested query against INFORMATION_SCHEMA.TABLES for test — it returned zero rows.
So not resolved yet, Will appreciate any ideas/support.
Best,
Roman