Linked Service in Azure Data Factory to Microsoft Fabric Lakehouse - SPN is Unauthorized

Question

I am trying to extract data from an on-prem SQL Server and import into a Microsoft Fabric Lakehouse. I am using an Azure Data Factory pipeline instead of the Data Flow or Data Pipeline in Fabric because Fabric doesn't allow the use of Self-Hosted Integration Runtimes, plus I already have Linked Services set up in ADF for on-prem SQL Server. Using the instructions found here, https://learn.microsoft.com/en-us/azure/data-factory/connector-microsoft-fabric-lakehouse?tabs=data-factory, I have created an SPN, added it to Security Group, added the Security Group to the Workspace in Fabric, and allowed SPNs to use Power BI APIs.

When creating the Linked Service in ADF, I am getting an error of "Unauthorized" for an ADLS Gen2 operation.

ADLS Gen2 operation failed for: Operation returned an invalid status code 'Unauthorized'. Account: ''. FileSystem: 'c40d7397-d326-4a03-b246-773dee1589be'. Path: '153dce78-b89b-4ccd-b778-02087d13456d'. ErrorCode: 'Unauthorized'. Message: 'Unauthorized'. TimeStamp: 'Tue, 30 Jan 2024 20:03:51 GMT'.. Operation returned an invalid status code 'Unauthorized' The ADLS Gen2 file system is not accessible in Fabric, though. It is automatically created and managed by Fabric. How do I grant access to the Lakehouse (and the underlying ADLS Gen2 file System) for the SPN in Fabric? The Workspace is in an F2 Pay-As-You-Go Fabric Capacity, as opposed to a Capacity from a Power BI License, is that a problem?

Answer 1

@Tim Knight - Thanks for the question and using MS Q&A platform.It seems like the SPN you created does not have the necessary permissions to access the ADLS Gen2 file system in your Fabric Lakehouse.

Before granting the necessary permission to the SPN experiencing the same error as shown above:

To grant access to the Lakehouse and the underlying ADLS Gen2 file system for the SPN, you can follow these steps:

Step1: Register an application with the Microsoft Identity platform and add a client secret. Afterwards, make note of these values, which you use to define the linked service: I had created a SPN named: chepra-fabric and note the Application (client) ID, and Client secret value.

Step2: Grant the service principal necessary permission in Microsoft Fabric workspace.

Find the name of the Microsoft Fabric Lakehouse which you want to connect: Sample_lakehouse_188 then click on Manage permissions and then click on Add user search for necessary SPN: chepra-fabric and click on necessary permissions required and click on Grant as shown below:

Step3: After granting the necessary permission to the SPN, goback to the linked service and Test connection and it will successfully connects without any issue.

Note: In case, if you are experiencing the same issue - please do wait for 5-10mins and retry to test the connection.

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

This is resolved using the documentation referenced . This issue was Fabric not synchronized with Entra so it was unable to validate the SPN. It took 4-5 to sync up. https://learn.microsoft.com/en-us/azure/data-factory/connector-microsoft-fabric-lakehouse?tabs=data-factory https://learn.microsoft.com/en-us/fabric/data-factory/how-to-ingest-data-into-fabric-from-azure-data-factory#power-bi-admin-portal