Unable to deploy using Azure Devops release pipelines
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 73%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDS%3C/text%3E%3C/svg%3E)
Darpan Sachania (MINDTREE LIMITED)
1
Reputation point Microsoft External Staff
We are trying to push code changes from our Dev Azure Synapse analytics workspace to a Production workspace using Azure DevOps Release pipelines.
Part of security guideline our requirement is to use SPN -- FIC / Managed Identity credentials instead of using SPN [Client ID and Client Secret].
Need help / guidance on the setting up a pipeline to complete this release.
#[error]Encountered with exception:Error: Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired. For more information refer https://aka.ms/azureappservicedeploytsg
Azure DevOps
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2025-03-25T05:25:17.9233333+00:00 Hi @Darpan Sachania (MINDTREE LIMITED) ,
Can you please share your pipeline YAML file?
-
Anonymous
2025-03-25T06:20:08.7933333+00:00 Hi @Darpan Sachania (MINDTREE LIMITED) ,
The error you're facing is due to authentication issues while trying to deploy from your Dev Synapse workspace to the Production workspace using Managed Identity or Federated Identity Credentials (FIC) instead of the traditional Service Principal (Client ID and Secret).
To resolve the issue ,
Ensure Managed Identity or Federated Identity Credentials (FIC) are Configured Properly
- If using Managed Identity, make sure your Azure DevOps agent or pipeline is running in an environment where Managed Identity is enabled.
- If using Federated Identity Credentials (FIC):
Register an Azure AD application, configure Federated Credentials for Azure DevOps service connections, and assign Synapse Administrator and Contributor roles to the application in the Synapse workspace.
You can grant permissions via Azure Portal or using Azure CLI:
az role assignment create --assignee <MI or FIC Object ID> \ --role "Synapse Administrator" \ --scope /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Synapse/workspaces/<workspace-name>Hope this helps.
-
Darpan Sachania (MINDTREE LIMITED) 1 Reputation point Microsoft External Staff
2025-03-26T03:58:36.1866667+00:00 Hi Sirra,
We did use FIC and have given appropriate RBAC roles to the SPN for the service connection as well.
The error has been consistent with both UAMI and SPN FIC based Service connection.
-
Anonymous
2025-03-26T11:05:29.7333333+00:00 Hi @Darpan Sachania (MINDTREE LIMITED) ,
It looks like the issue is related to authentication and the ARM connection in your Azure Devops pipeline.
Please check,
- Ensure that the Federated Credential setup is correctly mapped to the Azure DevOps Service Principal and that it has the required
API permissions, includingSynapse AdministratorandSynapse Contributorroles in Azure Synapse RBAC. - Run the below command to check role assignments,
az role assignment list --assignee <SPN Object ID>This should confirm if the correct permissions are assigned.
- Ensure ARM Connection is Linked to a Resource Group
The error says
ARM connection must be linked with resource group
Make sure your Azure DevOps service connection is associated with a specific
resource groupEdit your pipeline YAML to explicitly specify the
scopein your deployment step,az role assignment create --assignee <SPN Object ID> \ --role "Synapse Administrator" \ --scope /subscriptions/<subscription-id>/resourceGroups/<resource-group>- Try manually authenticating with the
same identityto confirm if it has access to the Synapse workspace:
az login --service-principal -u <Client ID> -p <Secret or Certificate Path> --tenant <Tenant ID> az synapse workspace show --name <workspace-name> --resource-group <resource-group>If this fails, the issue might be with your RBAC assignments.
- And also, the error message says
"The request content size exceeds the maximum size of 4 MB."
suggests that the deployment might be sending too much data.
If you're deploying large ARM templates, consider breaking them into smaller templates or reducing the payload size.
Hope this helps.
- Ensure that the Federated Credential setup is correctly mapped to the Azure DevOps Service Principal and that it has the required
-
Anonymous
2025-03-27T09:41:00.4+00:00 Hi @Darpan Sachania (MINDTREE LIMITED) ,
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
-
Darpan Sachania (MINDTREE LIMITED) 1 Reputation point Microsoft External Staff
2025-04-01T16:54:07.3466667+00:00 Hi @Anonymous
Thank you for the inputs, The issue still persists. Is it possible to connect over a call / meeting to review this?
Sign in to comment
Sign in to answer