We have a Firewalled storage account which has a few files that we need to access via Synapse notebook. We do that with below code :

abfss_path = f'abfss://[email protected]/data.csv'        
df = spark.read.load(abfss_path, format='csv',header=True)

The managed identity and my user (objectid) for the Synapse workspace has ' Storage Blob Data Contributor' role on the storage account.

The below have been enabled:

  • Allow Azure services on the trusted services list to access this storage account.
  • Specify resource instances that will have access to your storage account based on their system-assigned managed identity.

Running the above code works from the pipeline with a synapse notebook task but fails when run from the studio through the notebook cell.

Error : Operation failed: "This request is not authorized to perform this operation.", 403

I have tried everything but can't get it to work.

Via Pipeline

enter image description here

Via Studio Notebook Cell

enter image description here

I can see AAD (pass through) takes precedence when running from studio, so I tried running the session as 'managed Identity'. This doesn't change anything and I keep getting same error.

How to get this working?

Note : I am not using the managed vnet in my synapse workspace.

  • Can you chek please if you have the storage acount linked inside synapse workspace? (magane->linked services)
    – MBuschi
    Oct 21, 2022 at 8:10
  • @MBuschi : Yes it is and I can query it via the serverless sql pool with openrowset. The problem is while trying to read the file from sparkpool in a user session. It works from a pipeline via Managed identity. Oct 21, 2022 at 8:35
  • Can you check if your AAD user and the managed identity have the same role in the storage account IAM role assignament blase?
    – MBuschi
    Oct 21, 2022 at 15:02


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.