Skip to content

Commit f4db7ca

Browse files
Harmanpreet-MicrosoftCopilot
Harmanpreet-Microsoft
and
Copilot
committed
fix: use workspace ID for Fabric RBAC in BYO mode
The RBAC script resolved workspace name from desiredFabricWorkspaceName before FABRIC_WORKSPACE_NAME. In BYO mode these differ, causing the Fabric API lookup to fail silently and skip the Contributor role grant. The OneLake indexer then fails with 'access to the workspace was denied'. Changes: - 01_setup_rbac.ps1: Prefer FABRIC_WORKSPACE_NAME over desiredFabricWorkspaceName. Resolve FABRIC_WORKSPACE_ID and pass it. - setup_ai_services_rbac.ps1: Accept -FabricWorkspaceId parameter. Use it directly for role assignment, skip displayName lookup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 2c67390 commit f4db7ca

2 files changed

Lines changed: 64 additions & 34 deletions

File tree

‎scripts/automationScripts/OneLakeIndex/01_setup_rbac.ps1‎

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -96,11 +96,12 @@ try {
9696
if (-not $aiSearchSubscriptionId) { $aiSearchSubscriptionId = $env_vars['aiSearchSubscriptionId'] }
9797
if (-not $aiFoundryName -and $outputs -and $outputs.aiFoundryName -and $outputs.aiFoundryName.value) { $aiFoundryName = $outputs.aiFoundryName.value }
9898
if (-not $aiFoundryName) { $aiFoundryName = $env_vars['aiFoundryName'] }
99-
if (-not $fabricWorkspaceName -and $outputs -and $outputs.desiredFabricWorkspaceName -and $outputs.desiredFabricWorkspaceName.value) { $fabricWorkspaceName = $outputs.desiredFabricWorkspaceName.value }
100-
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = $env_vars['desiredFabricWorkspaceName'] }
99+
# Prefer FABRIC_WORKSPACE_NAME (actual BYO name) over desiredFabricWorkspaceName (requested name that may differ in BYO mode)
101100
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = $env_vars['FABRIC_WORKSPACE_NAME'] }
102101
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = $env:FABRIC_WORKSPACE_NAME }
103102
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = Get-AzdEnvValue -Key 'FABRIC_WORKSPACE_NAME' }
103+
if (-not $fabricWorkspaceName -and $outputs -and $outputs.desiredFabricWorkspaceName -and $outputs.desiredFabricWorkspaceName.value) { $fabricWorkspaceName = $outputs.desiredFabricWorkspaceName.value }
104+
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = $env_vars['desiredFabricWorkspaceName'] }
104105
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = Get-AzdEnvValue -Key 'fabricWorkspaceNameOut' }
105106
if (-not $fabricWorkspaceName) { $fabricWorkspaceName = Get-AzdEnvValue -Key 'desiredFabricWorkspaceName' }
106107
if (-not $fabricWorkspaceName -and (Test-Path (Join-Path ([IO.Path]::GetTempPath()) 'fabric_workspace.env'))) {
@@ -109,6 +110,14 @@ try {
109110
}
110111
}
111112
if (-not $fabricWorkspaceName -and $env:AZURE_ENV_NAME) { $fabricWorkspaceName = "workspace-$($env:AZURE_ENV_NAME.Trim())" }
113+
114+
# Resolve Fabric workspace ID for direct role assignment (avoids fragile displayName lookup)
115+
$fabricWorkspaceId = ''
116+
if (-not $fabricWorkspaceId) { $fabricWorkspaceId = $env_vars['FABRIC_WORKSPACE_ID'] }
117+
if (-not $fabricWorkspaceId) { $fabricWorkspaceId = $env:FABRIC_WORKSPACE_ID }
118+
if (-not $fabricWorkspaceId) { $fabricWorkspaceId = Get-AzdEnvValue -Key 'FABRIC_WORKSPACE_ID' }
119+
if (-not $fabricWorkspaceId) { $fabricWorkspaceId = Get-AzdEnvValue -Key 'fabricWorkspaceIdOut' }
120+
if (-not $fabricWorkspaceId -and $outputs -and $outputs.fabricWorkspaceIdOut -and $outputs.fabricWorkspaceIdOut.value) { $fabricWorkspaceId = $outputs.fabricWorkspaceIdOut.value }
112121
if (-not $aiSearchResourceId -and $outputs -and $outputs.aiSearchResourceId -and $outputs.aiSearchResourceId.value) { $aiSearchResourceId = $outputs.aiSearchResourceId.value }
113122
if (-not $aiSearchResourceId) { $aiSearchResourceId = $env_vars['aiSearchResourceId'] }
114123

@@ -182,6 +191,7 @@ try {
182191
Warn " AI Foundry: not detected"
183192
}
184193
Log " Fabric Workspace: $fabricWorkspaceName"
194+
if ($fabricWorkspaceId) { Log " Fabric Workspace ID: $fabricWorkspaceId" }
185195
if ($principalId) { Log " Principal ID: $principalId" }
186196

187197
# Setup RBAC permissions
@@ -190,21 +200,25 @@ try {
190200
Log "🔐 Setting up RBAC permissions for OneLake indexing..."
191201

192202
try {
193-
& "$PSScriptRoot/setup_ai_services_rbac.ps1" `
194-
-ExecutionManagedIdentityPrincipalId $principalId `
195-
-AISearchName $aiSearchName `
196-
-AIFoundryName $aiFoundryName `
197-
-AIFoundryResourceGroup $aiFoundryResourceGroup `
198-
-AISearchResourceGroup $aiSearchResourceGroup `
199-
-FabricWorkspaceName $fabricWorkspaceName
203+
$rbacArgs = @{
204+
ExecutionManagedIdentityPrincipalId = $principalId
205+
AISearchName = $aiSearchName
206+
AIFoundryName = $aiFoundryName
207+
AIFoundryResourceGroup = $aiFoundryResourceGroup
208+
AISearchResourceGroup = $aiSearchResourceGroup
209+
FabricWorkspaceName = $fabricWorkspaceName
210+
}
211+
if ($fabricWorkspaceId) { $rbacArgs['FabricWorkspaceId'] = $fabricWorkspaceId }
212+
213+
& "$PSScriptRoot/setup_ai_services_rbac.ps1" @rbacArgs
200214

201215
Log "✅ RBAC configuration completed successfully"
202216
Log "✅ Managed identity can now access AI Search and AI Foundry"
203217
Log "✅ OneLake indexing permissions are configured"
204218
} catch {
205219
Warn "RBAC setup failed: $_"
206220
Log "You can run RBAC setup manually later with:"
207-
Log " ./scripts/OneLakeIndex/setup_ai_services_rbac.ps1 -ExecutionManagedIdentityPrincipalId '$principalId' -AISearchName '$aiSearchName' -AIFoundryName '$aiFoundryName' -FabricWorkspaceName '$fabricWorkspaceName'"
221+
Log " ./scripts/OneLakeIndex/setup_ai_services_rbac.ps1 -ExecutionManagedIdentityPrincipalId '$principalId' -AISearchName '$aiSearchName' -AIFoundryName '$aiFoundryName' -FabricWorkspaceName '$fabricWorkspaceName' -FabricWorkspaceId '$fabricWorkspaceId'"
208222
throw
209223
}
210224
}

‎scripts/automationScripts/OneLakeIndex/setup_ai_services_rbac.ps1‎

Lines changed: 40 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,9 @@ param(
1414
[Parameter(Mandatory = $false)]
1515
[string]$AISearchResourceGroup = "",
1616
[Parameter(Mandatory = $false)]
17-
[string]$FabricWorkspaceName = ""
17+
[string]$FabricWorkspaceName = "",
18+
[Parameter(Mandatory = $false)]
19+
[string]$FabricWorkspaceId = ""
1820
)
1921

2022
Set-StrictMode -Version Latest
@@ -341,7 +343,7 @@ try {
341343
}
342344

343345
# Setup Fabric workspace permissions for OneLake access
344-
if ($FabricWorkspaceName) {
346+
if ($FabricWorkspaceId -or $FabricWorkspaceName) {
345347
Log "Setting up Fabric workspace permissions..."
346348

347349
# Get Fabric access token
@@ -355,23 +357,40 @@ try {
355357
# Create Fabric headers
356358
$fabricHeaders = New-SecureHeaders -Token $fabricToken
357359

358-
# Find the workspace
359-
$workspacesUrl = "https://api.fabric.microsoft.com/v1/workspaces"
360-
$workspacesResponse = Invoke-SecureRestMethod -Uri $workspacesUrl -Headers $fabricHeaders -Method Get
361-
362-
# Debug: Log available workspaces and their properties
363-
Log "Available workspaces:"
364-
foreach ($ws in $workspacesResponse.value) {
365-
Log " - Name: '$($ws.displayName)' ID: $($ws.id)"
360+
$workspaceId = $null
361+
362+
# Use workspace ID directly if provided (avoids fragile displayName lookup, critical for BYO workspaces)
363+
if ($FabricWorkspaceId) {
364+
$workspaceId = $FabricWorkspaceId.Trim()
365+
Log "Using provided Fabric workspace ID: $workspaceId"
366366
}
367-
368-
# Find workspace by displayName only (name property may not exist)
369-
$workspace = $workspacesResponse.value | Where-Object { $_.displayName -eq $FabricWorkspaceName }
370-
371-
if ($workspace) {
372-
$workspaceId = $workspace.id
373-
Log "Found Fabric workspace: $FabricWorkspaceName (ID: $workspaceId)"
367+
368+
# Fall back to displayName lookup if no ID provided
369+
if (-not $workspaceId) {
370+
# Find the workspace
371+
$workspacesUrl = "https://api.fabric.microsoft.com/v1/workspaces"
372+
$workspacesResponse = Invoke-SecureRestMethod -Uri $workspacesUrl -Headers $fabricHeaders -Method Get
373+
374+
# Debug: Log available workspaces and their properties
375+
Log "Available workspaces:"
376+
foreach ($ws in $workspacesResponse.value) {
377+
Log " - Name: '$($ws.displayName)' ID: $($ws.id)"
378+
}
379+
380+
# Find workspace by displayName only (name property may not exist)
381+
$workspace = $workspacesResponse.value | Where-Object { $_.displayName -eq $FabricWorkspaceName }
374382

383+
if ($workspace) {
384+
$workspaceId = $workspace.id
385+
Log "Found Fabric workspace: $FabricWorkspaceName (ID: $workspaceId)"
386+
} else {
387+
Warn "Could not find Fabric workspace: '$FabricWorkspaceName'"
388+
Log "Available workspace names: $($workspacesResponse.value.displayName -join ', ')"
389+
Log "Make sure the workspace name matches exactly (case-sensitive)"
390+
}
391+
}
392+
393+
if ($workspaceId) {
375394
# Add the managed identity as a workspace member with Contributor role
376395
$roleAssignmentUrl = "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/roleAssignments"
377396
$rolePayload = @{
@@ -382,7 +401,7 @@ try {
382401
role = "Contributor"
383402
} | ConvertTo-Json -Depth 3
384403

385-
Log "Assigning Contributor role to managed identity in workspace..."
404+
Log "Assigning Contributor role to managed identity in workspace $workspaceId..."
386405
try {
387406
Invoke-SecureRestMethod -Uri $roleAssignmentUrl -Headers @{
388407
Authorization = "Bearer $fabricToken"
@@ -399,10 +418,6 @@ try {
399418
Log " 2. Add managed identity $ExecutionManagedIdentityPrincipalId as Contributor"
400419
}
401420
}
402-
} else {
403-
Warn "Could not find Fabric workspace: '$FabricWorkspaceName'"
404-
Log "Available workspace names: $($workspacesResponse.value.displayName -join ', ')"
405-
Log "Make sure the workspace name matches exactly (case-sensitive)"
406421
}
407422
}
408423
} catch {
@@ -423,8 +438,9 @@ try {
423438
Log " - AI Foundry project identity has Search roles"
424439
}
425440
}
426-
if ($FabricWorkspaceName) {
427-
Log " - Contributor on Fabric workspace $FabricWorkspaceName"
441+
if ($FabricWorkspaceId -or $FabricWorkspaceName) {
442+
$wsLabel = if ($FabricWorkspaceId) { "Fabric workspace ID $FabricWorkspaceId" } else { "Fabric workspace $FabricWorkspaceName" }
443+
Log " - Contributor on $wsLabel"
428444
}
429445

430446
} catch {

0 commit comments

Comments
 (0)