failed to load one or more resources due to forbidden issue, error code 403.

Question

failed to load one or more resources due to forbidden issue, error code 403.

Application Manager SPEP 20

Im getting an error message when trying to create a azure synapse link from power apps.

User's image

Pilladi Padma Sai Manisha 6,665 Reputation points Microsoft External Staff Moderator

2026-03-16T18:45:56.6633333+00:00

Hi Application Manager SPEP,
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.
Application Manager SPEP 20 Reputation points

2026-03-20T22:15:39.0333333+00:00

Can you pls escalate my case to the next tier? I already upgrade my support level. thanks.

3 answers

Your answer

Pilladi Padma Sai Manisha 6,665 Reputation points Microsoft External Staff Moderator

2026-03-16T18:45:56.6633333+00:00

Hi Application Manager SPEP,
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.
Application Manager SPEP 20 Reputation points

2026-03-20T22:15:39.0333333+00:00

Can you pls escalate my case to the next tier? I already upgrade my support level. thanks.

Answer 1

Application Manager SPEP 20

Actually I was able to make it work..! Looks like I had to click on ADD client IP as it doenst automatically do it for you!. Now Im getting another issue.



The selected storage account has restricted network access. To proceed, please setup an enterprise policy and connect it to your Dataverse environment. Once done, please enable the 'Select Enterprise Policy with Managed Service Identity' option below. For detailed instructions, please visit: https://learn.microsoft.com/en-us/power-apps/maker/data-platform/azure-synapse-link-msi

Session Id: 4244949c-f206-43a0-9d58-ea3d4722759f

Pilladi Padma Sai Manisha 6,665 Reputation points Microsoft External Staff Moderator

2026-03-19T20:28:36.6966667+00:00
Hi Application Manager SPEP
Thank you for confirming that adding the client IP resolved the initial Azure Synapse Studio access issue.

As discussed, the new message you’re encountering is expected behavior. The selected Azure Storage account is configured with restricted network access. When public access is disabled or limited to selected networks, Azure Synapse Link for Dataverse must use a Managed Service Identity (MSI) to securely access the storage account. This behavior is by design.

To proceed, the following configuration is required.

Required Configuration: Enterprise Policy with Managed Identity:

Register the Azure subscription for Power Platform Run the Microsoft-provided PowerShell script SetupSubscriptionForPowerPlatform.ps1 to register the subscription and enable Enterprise Policy support.

Create an Enterprise Policy (creates the Managed Identity) Run CreateIdentityEnterprisePolicy.ps1, ensuring the policy location matches the Dataverse environment region. Save the generated Enterprise Policy Resource ID.

Grant Reader access to the Enterprise Policy Assign the Reader role on the Enterprise Policy resource to your Azure AD user or Power Platform admin account.

Link the Enterprise Policy to the Dataverse environment Run NewIdentity.ps1 using the Dataverse Environment ID and the Enterprise Policy Resource ID. A response code of 202 confirms successful linkage.

Assign storage permissions to the Managed Identity On the Azure Storage account, grant the Managed Identity:

Storage Blob Data Contributor

Storage Blob Data Owner (required for initial setup)

Verify storage networking settings Ensure the storage account allows trusted Microsoft services and remains restricted to selected networks (public access is not required).

Create the Azure Synapse Link using MSI In Power Apps, create a new Azure Synapse Link and select “Select Enterprise Policy with Managed Service Identity” before saving.

Reference Documentation:

Microsoft Learn – Use managed identities for Azure with your Azure data lake storage https://learn.microsoft.com/power-apps/maker/data-platform/azure-synapse-link-msi

Once these steps are completed, the Azure Synapse Link should be created successfully without any further network or access-related errors.
Application Manager SPEP 20 Reputation points

2026-03-20T22:10:00.9866667+00:00

I cannot get pass this. Error below.
Application Manager SPEP 20 Reputation points

2026-03-23T16:52:31.1+00:00

I keep getting this error when trying step number 4 Link the Enterprise Policy to the Dataverse environment Run NewIdentity.ps1 using the Dataverse Environment ID and the Enterprise Policy Resource ID. A response code of 202 confirms successful linkage.
Pilladi Padma Sai Manisha 6,665 Reputation points Microsoft External Staff Moderator

2026-03-23T23:51:51.89+00:00

Hi Application Manager SPEP,
From the details and screenshot, the key point is that the NewIdentity.ps1 call returns HTTP 202 (Accepted), which means the Enterprise Policy link request was successfully submitted. However, the subsequent error indicates:

“The identity context cannot be confirmed as environment type Dataverse”

This usually happens not because the linking failed, but because the policy propagation or validation has not completed yet, or there is a context/permission mismatch during verification.

Please check the following:

The 202 response confirms the backend operation is asynchronous, so allow some time (typically a few minutes) for the policy to fully propagate before attempting step 4 again.

Ensure the Dataverse Environment ID used is correct and matches exactly the environment where you are trying to apply the policy.

Verify that the user/service principal running the script has sufficient permissions on both sides:

Appropriate role on the Dataverse environment

Access to the Enterprise Policy resource in Azure

Confirm that the tenant and subscription context are aligned (same tenant for Dataverse and Azure resources). Cross-tenant scenarios can cause this validation failure.

Make sure you are using the latest version of the script/module, as older scripts may not correctly validate newer environment types.

If the issue continues even after waiting, re-run the linking command and then validate using a fresh session to avoid cached authentication/context issues.

If possible, please share:

Whether the environment is Production / Sandbox

Confirmation that the policy shows as linked in Azure

Timestamp of when the script was executed

This will help determine if the issue is due to propagation delay or environment validation mismatch.
Pilladi Padma Sai Manisha 6,665 Reputation points Microsoft External Staff Moderator

2026-03-24T21:34:50.7033333+00:00

Hi Application Manager SPEP,
I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered

Answer 2

Application Manager SPEP 20

Hi Pilladi

I still have issues, is there a way that I can get a dedicated tech support resource? Where can I go to upgrade my support so I can get a dedicated support person in a team meeting that can show me the process?

0 comments

Answer 3

Hi Application Manager SPEP,
Thankyou for reaching microsoft Q&A!

The 403 – Forbidden error typically occurs when the user creating the Azure Synapse Link for Dataverse does not have sufficient permissions on the required Azure resources.

To create the link successfully, please ensure the following permissions are configured:

The user must be assigned Synapse Administrator or Synapse Contributor role on the Azure Synapse workspace.

The user must also have Storage Blob Data Contributor (or Owner) access on the associated Azure Storage account used by Synapse.

Verify that the user has the required Power Platform / Dataverse permissions, such as System Administrator or equivalent role in the Dataverse environment.

Ensure the Synapse workspace and Dataverse environment are in supported/compatible regions, as cross-region configurations can sometimes block link creation.

If the Synapse workspace or storage account has network restrictions or firewall rules enabled, confirm that the Microsoft services / trusted services option is allowed so Power Platform can access the resources.

After validating and updating these permissions, sign out and sign back into Power Apps and attempt to create the Synapse link again.

If the issue persists, please share the workspace name, storage account name, and confirmation of the assigned roles so we can further investigate.

Share via

failed to load one or more resources due to forbidden issue, error code 403.

3 answers

Your answer