Skip to content

Commit 39f0ceb

Browse files
Roopan-MicrosoftRoopan-Microsoft
authored
Merge pull request #141 from Harmanpreet-Microsoft/dev
fix: Improve RBAC setup reliability using FabricWorkspaceId for OneLake indexing (BYO support & enhanced logging)
2 parents 2bd8fc9 + cdf838c commit 39f0ceb

2 files changed

Lines changed: 64 additions & 34 deletions

File tree

‎scripts/automationScripts/OneLakeIndex/01_setup_rbac.ps1‎

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -96,11 +96,12 @@ try {
9696
if (-not $aiSearchSubscriptionId) { $aiSearchSubscriptionId = $env_vars['aiSearchSubscriptionId'] }
9797
if (-not $aiFoundryName -and $outputs -and $outputs.aiFoundryName -and $outputs.aiFoundryName.value) { $aiFoundryName = $outputs.aiFoundryName.value }
9898
if (-not $aiFoundryName) { $aiFoundryName = $env_vars['aiFoundryName'] }
99-
if (-not $fabricWorkspaceName -and $outputs -and $outputs.desiredFabricWorkspaceName -and $outputs.desiredFabricWorkspaceName.value) { $fabricWorkspaceName = $outputs.desiredFabricWorkspaceName.value }
100-
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = $env_vars['desiredFabricWorkspaceName'] }
99+
# Prefer FABRIC_WORKSPACE_NAME (actual BYO name) over desiredFabricWorkspaceName (requested name that may differ in BYO mode)
101100
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = $env_vars['FABRIC_WORKSPACE_NAME'] }
102101
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = $env:FABRIC_WORKSPACE_NAME }
103102
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = Get-AzdEnvValue -Key 'FABRIC_WORKSPACE_NAME' }
103+
if (-not $fabricWorkspaceName -and $outputs -and $outputs.desiredFabricWorkspaceName -and $outputs.desiredFabricWorkspaceName.value) { $fabricWorkspaceName = $outputs.desiredFabricWorkspaceName.value }
104+
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = $env_vars['desiredFabricWorkspaceName'] }
104105
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = Get-AzdEnvValue -Key 'fabricWorkspaceNameOut' }
105106
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = Get-AzdEnvValue -Key 'desiredFabricWorkspaceName' }
106107
if (-not $fabricWorkspaceName -and (Test-Path (Join-Path ([IO.Path]::GetTempPath()) 'fabric_workspace.env'))) {
@@ -109,6 +110,14 @@ try {
109110
}
110111
}
111112
if (-not $fabricWorkspaceName -and $env:AZURE_ENV_NAME) { $fabricWorkspaceName = "workspace-$($env:AZURE_ENV_NAME.Trim())" }
113+
114+
# Resolve Fabric workspace ID for direct role assignment (avoids fragile displayName lookup)
115+
$fabricWorkspaceId = ''
116+
if (-not $fabricWorkspaceId) { $fabricWorkspaceId = $env_vars['FABRIC_WORKSPACE_ID'] }
117+
if (-not $fabricWorkspaceId) { $fabricWorkspaceId = $env:FABRIC_WORKSPACE_ID }
118+
if (-not $fabricWorkspaceId) { $fabricWorkspaceId = Get-AzdEnvValue -Key 'FABRIC_WORKSPACE_ID' }
119+
if (-not $fabricWorkspaceId) { $fabricWorkspaceId = Get-AzdEnvValue -Key 'fabricWorkspaceIdOut' }
120+
if (-not $fabricWorkspaceId -and $outputs -and $outputs.fabricWorkspaceIdOut -and $outputs.fabricWorkspaceIdOut.value) { $fabricWorkspaceId = $outputs.fabricWorkspaceIdOut.value }
112121
if (-not $aiSearchResourceId -and $outputs -and $outputs.aiSearchResourceId -and $outputs.aiSearchResourceId.value) { $aiSearchResourceId = $outputs.aiSearchResourceId.value }
113122
if (-not $aiSearchResourceId) { $aiSearchResourceId = $env_vars['aiSearchResourceId'] }
114123

@@ -182,6 +191,7 @@ try {
182191
Warn " AI Foundry: not detected"
183192
}
184193
Log " Fabric Workspace: $fabricWorkspaceName"
194+
if ($fabricWorkspaceId) { Log " Fabric Workspace ID: $fabricWorkspaceId" }
185195
if ($principalId) { Log " Principal ID: $principalId" }
186196

187197
# Setup RBAC permissions
@@ -190,21 +200,25 @@ try {
190200
Log "🔐 Setting up RBAC permissions for OneLake indexing..."
191201

192202
try {
193-
& "$PSScriptRoot/setup_ai_services_rbac.ps1" `
194-
-ExecutionManagedIdentityPrincipalId $principalId `
195-
-AISearchName $aiSearchName `
196-
-AIFoundryName $aiFoundryName `
197-
-AIFoundryResourceGroup $aiFoundryResourceGroup `
198-
-AISearchResourceGroup $aiSearchResourceGroup `
199-
-FabricWorkspaceName $fabricWorkspaceName
203+
$rbacArgs = @{
204+
ExecutionManagedIdentityPrincipalId = $principalId
205+
AISearchName = $aiSearchName
206+
AIFoundryName = $aiFoundryName
207+
AIFoundryResourceGroup = $aiFoundryResourceGroup
208+
AISearchResourceGroup = $aiSearchResourceGroup
209+
FabricWorkspaceName = $fabricWorkspaceName
210+
}
211+
if ($fabricWorkspaceId) { $rbacArgs['FabricWorkspaceId'] = $fabricWorkspaceId }
212+
213+
& "$PSScriptRoot/setup_ai_services_rbac.ps1" @rbacArgs
200214

201215
Log "✅ RBAC configuration completed successfully"
202216
Log "✅ Managed identity can now access AI Search and AI Foundry"
203217
Log "✅ OneLake indexing permissions are configured"
204218
} catch {
205219
Warn "RBAC setup failed: $_"
206220
Log "You can run RBAC setup manually later with:"
207-
Log " ./scripts/OneLakeIndex/setup_ai_services_rbac.ps1 -ExecutionManagedIdentityPrincipalId '$principalId' -AISearchName '$aiSearchName' -AIFoundryName '$aiFoundryName' -FabricWorkspaceName '$fabricWorkspaceName'"
221+
Log " ./scripts/OneLakeIndex/setup_ai_services_rbac.ps1 -ExecutionManagedIdentityPrincipalId '$principalId' -AISearchName '$aiSearchName' -AIFoundryName '$aiFoundryName' -FabricWorkspaceName '$fabricWorkspaceName' -FabricWorkspaceId '$fabricWorkspaceId'"
208222
throw
209223
}
210224
}

‎scripts/automationScripts/OneLakeIndex/setup_ai_services_rbac.ps1‎

Lines changed: 40 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,9 @@ param(
1414
[Parameter(Mandatory = $false)]
1515
[string]$AISearchResourceGroup = "",
1616
[Parameter(Mandatory = $false)]
17-
[string]$FabricWorkspaceName = ""
17+
[string]$FabricWorkspaceName = "",
18+
[Parameter(Mandatory = $false)]
19+
[string]$FabricWorkspaceId = ""
1820
)
1921

2022
Set-StrictMode -Version Latest
@@ -341,7 +343,7 @@ try {
341343
}
342344

343345
# Setup Fabric workspace permissions for OneLake access
344-
if ($FabricWorkspaceName) {
346+
if ($FabricWorkspaceId -or $FabricWorkspaceName) {
345347
Log "Setting up Fabric workspace permissions..."
346348

347349
# Get Fabric access token
@@ -355,23 +357,40 @@ try {
355357
# Create Fabric headers
356358
$fabricHeaders = New-SecureHeaders -Token $fabricToken
357359

358-
# Find the workspace
359-
$workspacesUrl = "https://api.fabric.microsoft.com/v1/workspaces"
360-
$workspacesResponse = Invoke-SecureRestMethod -Uri $workspacesUrl -Headers $fabricHeaders -Method Get
361-
362-
# Debug: Log available workspaces and their properties
363-
Log "Available workspaces:"
364-
foreach ($ws in $workspacesResponse.value) {
365-
Log " - Name: '$($ws.displayName)' ID: $($ws.id)"
360+
$workspaceId = $null
361+
362+
# Use workspace ID directly if provided (avoids fragile displayName lookup, critical for BYO workspaces)
363+
if ($FabricWorkspaceId) {
364+
$workspaceId = $FabricWorkspaceId.Trim()
365+
Log "Using provided Fabric workspace ID: $workspaceId"
366366
}
367-
368-
# Find workspace by displayName only (name property may not exist)
369-
$workspace = $workspacesResponse.value | Where-Object { $_.displayName -eq $FabricWorkspaceName }
370-
371-
if ($workspace) {
372-
$workspaceId = $workspace.id
373-
Log "Found Fabric workspace: $FabricWorkspaceName (ID: $workspaceId)"
367+
368+
# Fall back to displayName lookup if no ID provided
369+
if (-not $workspaceId) {
370+
# Find the workspace
371+
$workspacesUrl = "https://api.fabric.microsoft.com/v1/workspaces"
372+
$workspacesResponse = Invoke-SecureRestMethod -Uri $workspacesUrl -Headers $fabricHeaders -Method Get
373+
374+
# Debug: Log available workspaces and their properties
375+
Log "Available workspaces:"
376+
foreach ($ws in $workspacesResponse.value) {
377+
Log " - Name: '$($ws.displayName)' ID: $($ws.id)"
378+
}
379+
380+
# Find workspace by displayName only (name property may not exist)
381+
$workspace = $workspacesResponse.value | Where-Object { $_.displayName -eq $FabricWorkspaceName }
374382

383+
if ($workspace) {
384+
$workspaceId = $workspace.id
385+
Log "Found Fabric workspace: $FabricWorkspaceName (ID: $workspaceId)"
386+
} else {
387+
Warn "Could not find Fabric workspace: '$FabricWorkspaceName'"
388+
Log "Available workspace names: $($workspacesResponse.value.displayName -join ', ')"
389+
Log "Make sure the workspace name matches exactly (case-sensitive)"
390+
}
391+
}
392+
393+
if ($workspaceId) {
375394
# Add the managed identity as a workspace member with Contributor role
376395
$roleAssignmentUrl = "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/roleAssignments"
377396
$rolePayload = @{
@@ -382,7 +401,7 @@ try {
382401
role = "Contributor"
383402
} | ConvertTo-Json -Depth 3
384403

385-
Log "Assigning Contributor role to managed identity in workspace..."
404+
Log "Assigning Contributor role to managed identity in workspace $workspaceId..."
386405
try {
387406
Invoke-SecureRestMethod -Uri $roleAssignmentUrl -Headers @{
388407
Authorization = "Bearer $fabricToken"
@@ -399,10 +418,6 @@ try {
399418
Log " 2. Add managed identity $ExecutionManagedIdentityPrincipalId as Contributor"
400419
}
401420
}
402-
} else {
403-
Warn "Could not find Fabric workspace: '$FabricWorkspaceName'"
404-
Log "Available workspace names: $($workspacesResponse.value.displayName -join ', ')"
405-
Log "Make sure the workspace name matches exactly (case-sensitive)"
406421
}
407422
}
408423
} catch {
@@ -423,8 +438,9 @@ try {
423438
Log " - AI Foundry project identity has Search roles"
424439
}
425440
}
426-
if ($FabricWorkspaceName) {
427-
Log " - Contributor on Fabric workspace $FabricWorkspaceName"
441+
if ($FabricWorkspaceId -or $FabricWorkspaceName) {
442+
$wsLabel = if ($FabricWorkspaceId) { "Fabric workspace ID $FabricWorkspaceId" } else { "Fabric workspace $FabricWorkspaceName" }
443+
Log " - Contributor on $wsLabel"
428444
}
429445

430446
} catch {

0 commit comments

Comments
 (0)