Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Microsoft is giving away 50,000 FREE Microsoft Certification exam vouchers. Get Fabric certified for FREE! Learn more

Reply
pellitteris
Frequent Visitor

Scheduled pipelines stop working after MFA or other security features are enabled for the owner user

A couple of weeks ago it happened for the second time that, in the face of user security activities in Microsoft Entra, such as enabling MFA or conditional access policies, the Fabric pipelines stopped working with the following error:

 

BadRequest Error fetching pipeline default identity userToken, response content:

{

  "code": "LSROBOTokenFailure",

  "message": "AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000009-0000-0000-c000-000000000000'. Trace ID: ef8487ca-dd2e-4dc0-8f22-31cf20dc1000 Correlation ID: d0a7a195-6416-4523-afa3-177274c43af9 Timestamp: 2025-02-26 01:16:19Z The returned error contains a claims challenge. For additional info on how to handle claims related to multifactor authentication, Conditional Access, and incremental consent, see https://aka.ms/msal-conditional-access-claims. If you are using the On-Behalf-Of flow, see https://aka.ms/msal-conditional-access-claims-obo for details.",

  "target": "PipelineDefaultIdentity-7ae043b5-a708-47a7-b716-ec3612575bc6",

  "details": null,

  "error": null

}. FetchUserTokenForPipelineAsync

 

 

To restart the operation, it was enough to make a fake change to the pipeline and save it and everything started working again. This was done for 47 pipelines!!

Being an enterprise service, I expect, I hope that the pipelines when scheduled, are executed with the service user identity (workspace identity), so why if something changes to the pipeline owner user, does it stop working? I expect that whoever creates or modifies the pipelines has no relationship with the identity that runs the pipeline when it is scheduled.

 

1 ACCEPTED SOLUTION

Hi @pellitteris,

Thank you for sharing your perspective. I understand the challenges of enforcing identity policies, especially in enterprise environments where security teams manage access independently of application teams.

Currently, Microsoft Fabric pipelines execute using the identity of the last user who modified them, which can lead to disruptions when that user's authentication is impacted by MFA or Conditional Access changes. Unfortunately, Service Principal (SPN) authentication is not yet supported for Fabric pipelines, which means they cannot run under a fully independent service identity at this time.

To mitigate the risk of pipeline failures, setting up monitoring for scheduled pipeline runs is a great approach. You can leverage Fabric monitoring features to track failures and receive alerts when pipelines fail.

I appreciate your feedback, and I encourage you to submit this as a feature request through the Microsoft Fabric Ideas forum to help influence future improvements: New Idea - Microsoft Fabric Community

I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.

View solution in original post

3 REPLIES 3
v-ssriganesh
Community Support
Community Support

Hi @pellitteris,
Thank you for reaching out to the Microsoft Fabric Forum Community.

The error message you provided indicates that a configuration change or a new login location has triggered MFA, causing a token failure for the pipeline's default identity. Since Fabric pipelines rely on the identity of the last user who modified them, security policies like MFA and Conditional Access can interrupt scheduled executions.

Please consider the below suggestions:

  • Reassign the pipeline to an automation account: If feasible, transfer ownership to a dedicated account exempts from MFA to prevent disruptions.
  • Collaborate with your Entra (Azure AD) admin to adjust Conditional Access policies, allowing non-interactive automation accounts to bypass MFA requirements.

If this information is helpful, please “Accept it as a solution” and give a "kudos" to assist other community members in resolving similar issues more efficiently.
Thank you.

If I can be honest, I don't like it very much as a solution, also because as a consultant I can't impose policies that are not compliant with my clients' standards.
Often these activities are carried out by the security team that doesn't always share these changes with the application teams.
As an enterprise tool I would expect that the user who performs the deployment operations has nothing to do with the identity with which the process is executed.
Probably a monitoring should be set up in order to understand when the scheduled pipelines fail.

Hi @pellitteris,

Thank you for sharing your perspective. I understand the challenges of enforcing identity policies, especially in enterprise environments where security teams manage access independently of application teams.

Currently, Microsoft Fabric pipelines execute using the identity of the last user who modified them, which can lead to disruptions when that user's authentication is impacted by MFA or Conditional Access changes. Unfortunately, Service Principal (SPN) authentication is not yet supported for Fabric pipelines, which means they cannot run under a fully independent service identity at this time.

To mitigate the risk of pipeline failures, setting up monitoring for scheduled pipeline runs is a great approach. You can leverage Fabric monitoring features to track failures and receive alerts when pipelines fail.

I appreciate your feedback, and I encourage you to submit this as a feature request through the Microsoft Fabric Ideas forum to help influence future improvements: New Idea - Microsoft Fabric Community

I trust this information proves useful. If it does, kindly Accept it as a solution and give it a 'Kudos' to help others locate it easily.
Thank you.

Helpful resources

Announcements
MarchFBCvideo - carousel

Fabric Monthly Update - March 2025

Check out the March 2025 Fabric update to learn about new features.

March2025 Carousel

Fabric Community Update - March 2025

Find out what's new and trending in the Fabric community.

"); $(".slidesjs-pagination" ).prependTo(".pagination_sec"); $(".slidesjs-pagination" ).append("
"); $(".slidesjs-play.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-stop.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-pagination" ).append(""); $(".slidesjs-pagination" ).append(""); } catch(e){ } /* End: This code is added by iTalent as part of iTrack COMPL-455 */ $(".slidesjs-previous.slidesjs-navigation").attr('tabindex', '0'); $(".slidesjs-next.slidesjs-navigation").attr('tabindex', '0'); /* start: This code is added by iTalent as part of iTrack 1859082 */ $('.slidesjs-play.slidesjs-navigation').attr('id','playtitle'); $('.slidesjs-stop.slidesjs-navigation').attr('id','stoptitle'); $('.slidesjs-play.slidesjs-navigation').attr('role','tab'); $('.slidesjs-stop.slidesjs-navigation').attr('role','tab'); $('.slidesjs-play.slidesjs-navigation').attr('aria-describedby','tip1'); $('.slidesjs-stop.slidesjs-navigation').attr('aria-describedby','tip2'); /* End: This code is added by iTalent as part of iTrack 1859082 */ }); $(document).ready(function() { if($("#slides .item").length < 2 ) { /* Fixing Single Slide click issue (commented following code)*/ // $(".item").css("left","0px"); $(".item.slidesjs-slide").attr('style', 'left:0px !important'); $(".slidesjs-stop.slidesjs-navigation").trigger('click'); $(".slidesjs-previous").css("display", "none"); $(".slidesjs-next").css("display", "none"); } var items_length = $(".item.slidesjs-slide").length; $(".slidesjs-pagination-item > button").attr("aria-setsize",items_length); $(".slidesjs-next, .slidesjs-pagination-item button").attr("tabindex","-1"); $(".slidesjs-pagination-item button").attr("role", "tab"); $(".slidesjs-previous").attr("tabindex","-1"); $(".slidesjs-next").attr("aria-hidden","true"); $(".slidesjs-previous").attr("aria-hidden","true"); $(".slidesjs-next").attr("aria-label","Next"); $(".slidesjs-previous").attr("aria-label","Previous"); //$(".slidesjs-stop.slidesjs-navigation").attr("role","button"); //$(".slidesjs-play.slidesjs-navigation").attr("role","button"); $(".slidesjs-pagination").attr("role","tablist").attr("aria-busy","true"); $("li.slidesjs-pagination-item").attr("role","list"); $(".item.slidesjs-slide").attr("tabindex","-1"); $(".item.slidesjs-slide").attr("aria-label","item"); /*$(".slidesjs-stop.slidesjs-navigation").on('click', function() { var itemNumber = parseInt($('.slidesjs-pagination-item > a.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); });*/ $(".slidesjs-stop.slidesjs-navigation, .slidesjs-pagination-item > button").on('click keydown', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); var itemNumber = parseInt($('.slidesjs-pagination-item > button.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); }); $(".slidesjs-play.slidesjs-navigation").on('click', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); }); $(".slidesjs-pagination-item button").keyup(function(e){ var keyCode = e.keyCode || e.which; if (keyCode == 9) { e.preventDefault(); $(".slidesjs-stop.slidesjs-navigation").trigger('click').blur(); $("button.active").focus(); } }); $(".slidesjs-play").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-stop").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-play")) { $(".slidesjs-stop").focus(); } } }); $(".slidesjs-stop").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-play").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-stop")) { $(".slidesjs-play").focus(); } } }); $(".slidesjs-pagination-item").keydown(function(e){ switch (e.which){ case 37: //left arrow key $(".slidesjs-previous.slidesjs-navigation").trigger('click'); e.preventDefault(); break; case 39: //right arrow key $(".slidesjs-next.slidesjs-navigation").trigger('click'); e.preventDefault(); break; default: return; } $(".slidesjs-pagination-item button.active").focus(); }); }); // Start This code is added by iTalent as part of iTrack 1859082 $(document).ready(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); $("#tip2").attr("aria-hidden","true").addClass("hidden"); $(".slidesjs-stop.slidesjs-navigation, .slidesjs-play.slidesjs-navigation").attr('title', ''); $("a#playtitle").focus(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").mouseover(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").blur(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#playtitle").mouseleave(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#play").keydown(function(ev){ if (ev.which ==27) { $("#tip1").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); $("a#stoptitle").focus(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").mouseover(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").blur(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").mouseleave(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").keydown(function(ev){ if (ev.which ==27) { $("#tip2").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); }); // End This code is added by iTalent as part of iTrack 1859082