Purview Internal Server Errors when trying to scan Fabric OneLake

Question

We have set up a scan in Purview to scan a small number of folders and file Fabric OneLake. But we always get an Internal Server Error. This has always worked fine in the past when scanning a fileshare in regular ADLS Gen2 storage. But with a Fabric Onelake data source we simply cannot get it to work.

We followed the prerequisite setup steps: authentication, Service Principal, security groups, permissions, tenants, Entra ID, Fabric API enabling, checked firewall etc etc. but whatever we try we consistently get the same single error in Ingestion Stage log:

Ingestion.InternalServerError,https://app.fabric.microsoft.com/groups/xxxxxxxxxxxx/lakehouses/yyyyyyyyyyyyyyyy/files,"Failed to ingest asset with type fabric_lakehouse and qualified name 'https://app.fabric.microsoft.com/groups/xxxxxxxxxxx/lakehouses/ff6fecc9-f446-4076-85cf-ad4d5f0b5e7a/yyyyyyyyyyyyyy/files' due to invalid data payload to data map. Please contact support for help."

There's also a Scan Monitor Error log with 1 line - error msg "Forbidden":

Timestamp,ErrorCode,OperationName,OperationItem,Message
2025-06-11T13:02:11.617Z, AuthenticationFailed,Enumerate,https://app.fabric.microsoft.com/groups/xxxxxxxxxxxxxx/lakehouses/yyyyyyyyyyyyyyyyy/files,"ADLS Gen2 operation failed for: Storage operation '' on container 'xxxxxxxxxxxxxxxxxx' and path 'yyyyyyyyyyyyyyyy/Files' get failed with 'Operation returned an invalid status code 'Forbidden''. Possible root causes: (1). It's possible because the service principal or managed identity don't have enough permission to access the data. (2). It's possible because some IP address ranges of Purview are not allowed by your Azure Storage firewall settings. Purview IP ranges please refer https://docs.microsoft.com/en-us/azure/data-factory/azure-integration-runtime-ip-addresses. If you allow trusted Microsoft services to access this storage account option in firewall, you must use https://docs.microsoft.com/en-us/azure/data-factory/connector-azure-blob-storage?tabs=data-factory#managed-identity. For more information on Azure Storage firewalls settings, see https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal.. Account: 'onelake'. FileSystem: 'xxxxxxxxxxxxxxxx'. Path: 'yyyyyyyyyyyyyy/Files'. ErrorCode: 'Forbidden'. Message: 'Forbidden'. RequestId: 'zzzzzzzzzzzzzzz'. TimeStamp: 'Wed, 11 Jun 2025 13:02:10 GMT'.."

No expired or rotated credentials. There's no Azure Policy preventing access to Storage accounts. We're not using a self-hosted integration runtime. We're not using IP range restrictions, or Firewall.

We've wasted hours and hours on this! Please help!

Answer 1

Hi @global
Mount the Fabric OneLake folder as a shortcut inside a regular ADLS Gen2 container, and scan that container with Purview instead. This bypasses the Fabric schema ingestion issue. 

I hope this information helps. Please do let us know if you have any further queries.

---

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.