Linked Service from Azure Data Factory (ADF) to a Microsoft Fabric Lakehouse

Question

We are attempting to configure a Linked Service from Azure Data Factory (ADF) to a Microsoft Fabric Lakehouse. However, the connection consistently fails with the following error:

“Lakehouse operation failed… ErrorCode: BadRequest, IncomingOperationUntrusted”

⸻

What we have already configured:

• Created a new Fabric Workspace and Lakehouse

• Verified workspace and lakehouse accessibility via UI

• Configured Service Principal (App Registration) with:

• Power BI API permissions:

• Workspace.ReadWrite.All

• Tenant.Read.All

• Admin consent granted

• Added Service Principal to Fabric Workspace with Admin role

• Enabled tenant setting:

• “Service principals can use Fabric APIs”

• Verified Client ID, Tenant ID, and Client Secret are valid

⸻

Additional troubleshooting performed:

• Created a new Lakehouse to rule out resource-level issues

• Retested Linked Service configuration multiple times

• Attempted alternative authentication using Managed Identity, which also failed

⸻

Expected behavior:

ADF Linked Service should successfully connect to Fabric Lakehouse and allow data operations.

⸻

Actual behavior:

Connection fails consistently with “IncomingOperationUntrusted” error, indicating request is not trusted by Fabric backend.

⸻

Request:

• Confirm whether ADF → Fabric Lakehouse integration via Service Principal / Managed Identity is fully supported

• Identify if any additional backend configuration, tenant setting, or regional limitation is required

• Validate if this is a known issue or limitation with Fabric Lakehouse connectors

Answer 1

Hi Marcin Landowski,

Thanks for your question.

This scenario is related to Microsoft Fabric, which falls under a different support scope. The Database & Analytics forum primarily handles Azure data services (like Azure SQL, ADF, Synapse, etc.), while Fabric-specific issues are best handled by the dedicated Fabric community.

I recommend reposting your question in the Microsoft Fabric Q&A forum where subject matter experts can assist you further:

-> https://learn.microsoft.com/answers/tags/214/microsoft-fabric

This will help you get more accurate and faster guidance from the right team.

Thank you for your understanding.

Answer 2

I am not sure if there is a possibility of further assistance? I cannot submit a ticket in Azure due to having to go to Microsoft Q&A first.

Answer 3

Could I have a ticket submitted and a technician assist?

Answer 4

I have again validated all configurations including RBAC, identity, and correct IDs from scratch. The issue is due to the ADF Fabric Lakehouse connector failing at trust validation, likely because of token audience mismatch. This does not affect Warehouse connectivity which uses same things. It successfully gets connected.  Hoping to raise a support ticket to take a closer look if possible.

Answer 5

Hi Marcin Landowski,

thankyou for reaching microsoft Q&A!
so the error you’re seeing isn’t due to any limitation with ADF or Fabric. When “IncomingOperationUntrusted” shows up, it typically means Fabric isn’t able to validate or trust part of the request rather than authentication being unsupported.

ADF can connect to a Fabric Lakehouse using either a service principal or managed identity without any special enablement. Access is controlled through Fabric workspace roles, not Power BI API permissions.

The most common cause is a mismatch in the workspace ID or lakehouse (artifact) ID. These need to be copied exactly from the Fabric portal URL, because even a small difference can cause the request to be rejected. Another frequent issue is permissions your service principal or managed identity must have Contributor or higher at the workspace level, since assigning access only at the lakehouse level is not enough. It’s also important to confirm that the tenant setting allowing service principals to use Fabric APIs is enabled. If you’re using managed identity, make sure the identity attached to ADF is actually the one that has been granted access in Fabric.

To narrow this down, try running a test connection in ADF and capture the full error details, including the timestamp and correlation ID. Enabling diagnostics in ADF can also help you inspect the outgoing request and response. It’s useful to test the same call outside ADF using Postman or CLI with the same identity if it fails there as well, that points to a configuration or trust issue on the Fabric side rather than ADF.

In most cases, this error comes down to Fabric rejecting the request due to an ID mismatch, token audience or scope not aligning correctly, or RBAC changes that haven’t fully propagated yet.

To help pinpoint the issue, it would be useful to confirm whether the IDs you’re using follow the correct GUID format, whether the same call works outside ADF, and to review the full ADF error message with correlation ID. It would also help to know which integration runtime you’re using and whether it has outbound connectivity, along with the regions where your ADF instance and Fabric workspace are deployed.