I am having permission issues when trying to access MS Sharepoint files from MS Synapse. How to solve this?

Question

I am having permission issues when trying to access MS Sharepoint files from MS Synapse. How to solve this?

João Flavio Assunção Mendonça 20

Dear Community,

Since a while I am trying to read a file from Sharepoint and paste it into a Blob Storage within MS Synapse, however, even being able to correctly receiving the token when I try to copy and paste the file I see the error bellow:

I cannot see all my permissions at Azure but our Azure Admin told me he gave me all the permissions in the Sharepoint folder.

Does someone have any idea what is the problem here?

Thanks

Unauthorized access. Check your access token or permissions. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns:o="urn:schemas-microsoft-com:office:office" lang="en-us" dir="ltr"> <head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Expires" content="0" /><meta http-equiv="X-UA-Compatible" content="IE=8"/><meta name="ROBOTS" content="NOHTMLINDEX" /><title> Error </title><link id="CssLink-b2a70bdb2f23418fbbdfb18e33587cd2" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/corev15.css?rev=chy2wPQZ%2FZ9Vh0GcszUdXw%3D%3DTAG500"/> <link id="CssLink-4716a525c34444a9a8842cb6928f7d9b" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG500"/> <script type="text/javascript">// <![CDATA[ var _initGlobalSnapShot = {};try { if (Object.keys(_initGlobalSnapShot).length == 0) { for (var memberIndex in window) { if (Boolean(memberIndex)) { _initGlobalSnapShot[memberIndex] = 1; } } }} catch (ex) {}; // ]]> </script> <script type="text/javascript">// <![CDATA[

João Flavio Assunção Mendonça 20 Reputation points

2024-11-28T15:08:18.5933333+00:00

By the way I was in contact with a Microsoft Consultant and he started to ghosting us.. not professional at all...only the community can save us !
Chandra Boorla 14,680 Reputation points Microsoft External Staff Moderator

2024-12-02T02:24:01.4433333+00:00
@João Flavio Assunção Mendonça

Greetings & Welcome to Microsoft Q&A forum! Thanks for posting your query!

Apologies for the delay in response.

As I understand that you are facing a permissions-related issue when trying to access SharePoint files from Azure Synapse, and the error message "Unauthorized access. Check your access token or permissions." typically indicates a problem with either the authentication process or the permissions associated with the access token.

Based on the information you provided; it is possible that the issue is related to the permissions set up in Azure Synapse Analytics. While your Azure admin mentioned that permissions were granted for the SharePoint folder, it’s important to ensure that the specific file or folder you're trying to access also has the correct permissions.

Here are some troubleshooting steps that might help you.

Verify Permissions in SharePoint - Double-check the permissions on the specific SharePoint folder/file you're trying to access. Ensure that the permissions are propagated properly and that there are no restrictions preventing external access via APIs.

Service Principal/Identity Permissions - If you're using a managed identity (either user-assigned or system-assigned) for Synapse, ensure that this identity has the necessary roles/permissions in both Azure AD and SharePoint. If you're using a service principal to authenticate, verify that it has the appropriate Azure AD app permissions (e.g., Sites.Read.All).

Check Token Scopes - Use tools like Fiddler or Postman to inspect the access token. Ensure it contains the right claims and scopes for accessing both SharePoint and Blob Storage.

Blob Storage Permissions - Ensure that your Synapse managed identity (or whichever identity you're using) has Blob Storage Contributor permissions to the destination blob container.

For more details, please refer: Copy data from SharePoint Online List by using Azure Data Factory or Azure Synapse Analytics

I hope this information helps. Please do let us know if you have any further queries.

Thank you.
Chandra Boorla 14,680 Reputation points Microsoft External Staff Moderator

2024-12-03T01:17:10.4633333+00:00

@João Flavio Assunção Mendonça

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 14,680 Reputation points Microsoft External Staff Moderator

2024-12-04T02:02:15.8766667+00:00

@João Flavio Assunção Mendonça

Following up to see on the last response and was just checking back to see if my suggestions were helpful. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Accepted answer

1 additional answer

Your answer

João Flavio Assunção Mendonça 20 Reputation points

2024-11-28T15:08:18.5933333+00:00

By the way I was in contact with a Microsoft Consultant and he started to ghosting us.. not professional at all...only the community can save us !
Chandra Boorla 14,680 Reputation points Microsoft External Staff Moderator

2024-12-03T01:17:10.4633333+00:00

@João Flavio Assunção Mendonça

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Chandra Boorla 14,680 Reputation points Microsoft External Staff Moderator

2024-12-04T02:02:15.8766667+00:00

@João Flavio Assunção Mendonça

Following up to see on the last response and was just checking back to see if my suggestions were helpful. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

@João Flavio Assunção Mendonça

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.

Issue:

Since a while I am trying to read a file from Sharepoint and paste it into a Blob Storage within MS Synapse, however, even being able to correctly receiving the token when I try to copy and paste the file I see the error bellow:

I cannot see all my permissions at Azure but our Azure Admin told me he gave me all the permissions in the Sharepoint folder.

Does someone have any idea what is the problem here?

Thanks

Unauthorized access. Check your access token or permissions. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns:o="urn:schemas-microsoft-com:office:office" lang="en-us" dir="ltr"> <head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Expires" content="0" /><meta http-equiv="X-UA-Compatible" content="IE=8"/><meta name="ROBOTS" content="NOHTMLINDEX" /><title> Error </title><link id="CssLink-b2a70bdb2f23418fbbdfb18e33587cd2" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/corev15.css?rev=chy2wPQZ%2FZ9Vh0GcszUdXw%3D%3DTAG500"/> <link id="CssLink-4716a525c34444a9a8842cb6928f7d9b" rel="stylesheet" type="text/css" href="/_layouts/15/1033/styles/error.css?rev=tF7fyfzbaQzNoASoSDlV4A%3D%3DTAG500"/> <script type="text/javascript">// <![CDATA[ var _initGlobalSnapShot = {};try { if (Object.keys(_initGlobalSnapShot).length == 0) { for (var memberIndex in window) { if (Boolean(memberIndex)) { _initGlobalSnapShot[memberIndex] = 1; } } }} catch (ex) {}; // ]]> </script> <script type="text/javascript">// <![CDATA[

Solution:

Thanks a lot for your comments, this part of your text here was essential for me to come with a soluition: "Service Principal/Identity Permissions - If you're using a managed identity (either user-assigned or system-assigned) for Synapse, ensure that this identity has the necessary roles/permissions in both Azure AD and SharePoint. If you're using a service principal to authenticate, verify that it has the appropriate Azure AD app permissions (e.g., Sites.Read.All)."

Based of this comment I could see that I only giving permissions in Azure was not sufficient I also needed permissions in Sharepoint, which by the way is very complicated to set... I had the impression that this feature is not yet complete developed by Microsoft..

For those who also need a step by step procedure in how to copy files from Sharepoint into MS synapse I recommend this link as well:

https://www.syntera.ch/blog/2022/10/10/copy-files-from-sharepoint-to-blob-storage-using-azure-data-factory/

or a more advanced approach here:

https://learn.microsoft.com/en-us/azure/data-factory/connector-sharepoint-online-list?tabs=data-factory

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

Hope this helps. Do let us know if you have any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

João Flavio Assunção Mendonça 20

Dear Chandra,

Thanks a lot for your comments, this part of your text here was essential for me to come with a soluition: "Service Principal/Identity Permissions - If you're using a managed identity (either user-assigned or system-assigned) for Synapse, ensure that this identity has the necessary roles/permissions in both Azure AD and SharePoint. If you're using a service principal to authenticate, verify that it has the appropriate Azure AD app permissions (e.g., Sites.Read.All)."

Based of this comment I could see that I only giving permissions in Azure was not sufficient I also needed permissions in Sharepoint, which by the way is very complicated to set... I had the impression that this feature is not yet complete developed by Microsoft..

For those who also need a step by step procedure in how to copy files from Sharepoint into MS synapse I recommend this link as well:

https://www.syntera.ch/blog/2022/10/10/copy-files-from-sharepoint-to-blob-storage-using-azure-data-factory/

or a more advanced approach here:

https://learn.microsoft.com/en-us/azure/data-factory/connector-sharepoint-online-list?tabs=data-factory

Thanks

Chandra Boorla 14,680 Reputation points Microsoft External Staff Moderator

2024-12-05T06:58:46.8933333+00:00

@ João Flavio Assunção Mendonça

I'm glad to hear that my comments helped you find a solution Setting up permissions across different services can indeed be quite complex. It's great that you were able to identify the need for permissions in both Azure and SharePoint. Thank you for sharing those helpful links!

They will definitely be valuable for others facing similar challenges:

Copy files from SharePoint to Blob Storage using Azure Data Factory Advanced advance approach for connecting SharePoint Online List with Azure Data Factory

Thank you.
Chandra Boorla 14,680 Reputation points Microsoft External Staff Moderator

2024-12-05T07:01:03.8033333+00:00

@João Flavio Assunção Mendonça

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer.

Share via

I am having permission issues when trying to access MS Sharepoint files from MS Synapse. How to solve this?

1 additional answer

Your answer