What causes UnauthorizedAccessException?

The DIAHostService logon service account was changed to a new account without migrating resource permissions. The new service account was not granted access to dependent resources such as certificates, folders, or registry keys originally scoped to the previous account. Group Policy or security hardening removed permissions from the current service account. The SHIR was reinstalled or reconfigured and the service account was reset to a default with insufficient privileges

How do I fix UnauthorizedAccessException?

Step 1: Open Event Viewer on the SHIR host machine, navigate to Applications and Services Logs > Integration Runtime, and filter for error-level entries to confirm the UnauthorizedAccessException message.. Step 2: Identify the current logon account for the DIAHostService by opening services.msc, locating 'DIAHostService', and checking the 'Log On' tab.. Step 3: Grant the current service account the same permissions held by the original account — including access to SHIR installation directories, relevant registry keys (HKLM\SOFTWARE\Microsoft\DataTransfer), and any certificates used by the IR.. Step 4: If the service account was intentionally changed, update permissions on all dependent resources (file shares, credential stores, proxy settings) to reference the new account explicitly.. Step 5: Restart the DIAHostService and Self-hosted Integration Runtime Host services, then verify the IR node returns to an Online status in the Azure Data Factory portal.

High severitypermissionsAzure Data Factory →

Power BI Refresh Error:
UnauthorizedAccessException

What does this error mean?

The Self-Hosted Integration Runtime (SHIR) cannot access required resources because the service account running DIAHostService lacks necessary permissions. This typically occurs after a service account change where dependent resource permissions were not updated.

Common causes

1The DIAHostService logon service account was changed to a new account without migrating resource permissions
2The new service account was not granted access to dependent resources such as certificates, folders, or registry keys originally scoped to the previous account
3Group Policy or security hardening removed permissions from the current service account
4The SHIR was reinstalled or reconfigured and the service account was reset to a default with insufficient privileges

How to fix it

1Step 1: Open Event Viewer on the SHIR host machine, navigate to Applications and Services Logs > Integration Runtime, and filter for error-level entries to confirm the UnauthorizedAccessException message.
2Step 2: Identify the current logon account for the DIAHostService by opening services.msc, locating 'DIAHostService', and checking the 'Log On' tab.
3Step 3: Grant the current service account the same permissions held by the original account — including access to SHIR installation directories, relevant registry keys (HKLM\SOFTWARE\Microsoft\DataTransfer), and any certificates used by the IR.
4Step 4: If the service account was intentionally changed, update permissions on all dependent resources (file shares, credential stores, proxy settings) to reference the new account explicitly.
5Step 5: Restart the DIAHostService and Self-hosted Integration Runtime Host services, then verify the IR node returns to an Online status in the Azure Data Factory portal.

Frequently asked questions

Why did this error appear only after changing the Windows service account for DIAHostService?

Resources such as registry keys, local file system paths, and certificates are granted to a specific account identity. When the service account changes, those ACLs still reference the old account. The new account has no inherited rights, so any access attempt by DIAHostService throws UnauthorizedAccessException.

Does reinstalling the Self-Hosted IR fix this error?

Reinstallation alone will not fix it if the underlying service account still lacks permissions. You must explicitly grant the required permissions to the service account before or after reinstallation, otherwise the same error will recur.