The synapse link is not able to write the data in Azure data lake gen 2 storage account

Question

Hi Team,

The synapse link is not able to write the data in Azure data lake gen 2 storage account. I am getting the following error message.



{"code":"AuthorizationFailed","message":"The client 'ASajjan@revolutiondance.com' with object id '07f0f1c6-8e4a-408e-85dd-f5343442f4cf' has an authorization with ABAC condition that is not fulfilled to perform action 'Microsoft.Authorization/roleAssignments/write' over scope '/subscriptions/49c7487b-406c-4c7f-a9f0-8a203fa2ca0b/resourceGroups/D365DataLakeSandboxGroup/providers/Microsoft.Storage/storageAccounts/pocd/providers/Microsoft.Authorization/roleAssignments/7ed62c22-9247-4a2d-b753-61d8b1a67b89' or the scope is invalid. If access was recently granted, please refresh your credentials."}

Session Id: 5f1cb5c0-8496-4311-a6aa-7d373bfb4c08

Target ADLS account has the permissions of Owner and Storage Blob Data Contributor. The namespace is hierarchical and storage key access is enabled.

Can you anyone help on this?

Answer 1

Hi Abhishek Sajjan,

Thanks for reaching out to Microsoft Q&A.

Please see the link below which has answers to your questions with screenshot guidance. I believe this should be able to help you, try this and let me know.

https://stackoverflow.com/questions/42134892/the-client-with-object-id-does-not-have-authorization-to-perform-action-microso

Please 'Upvote'(Thumbs-up) and 'Accept' as an answer if the reply was helpful. This will benefit other community members who face the same issue.

Answer 2

Hi Abhishek Sajjan ,

Welcome to Microsoft Q&A platform and thanks for posting your query here

From the description of your query, it seems you are trying to leverage Synapse link to connect from source to ADLS. However, it seems it's throwing error that the client is not authorized to perform the action.

Could you please share information like what is the source for synapse link? Azure SQL/SQL/Dataverse?

Kindly Check if the Azure Entra ID and workspace MSI both have access to the ADLS Gen2 account.

You can create a custom role with action Microsoft.Authorization/roleAssignments/write and assign it.

Hope it helps. Please accept the answer by clicking on Accept answer button. Thankyou