What causes Fabric Pipeline Error 2403?

The Fabric workspace or pipeline resource does not have a managed identity assigned or enabled. The managed identity has not been granted the required RBAC role on the target resource (e.g., Data Factory Contributor or specific data source roles). The MSI token endpoint is unreachable due to network restrictions or a misconfigured Integration Runtime. Tenant-level conditional access policies or managed identity restrictions are blocking token issuance

How do I fix Fabric Pipeline Error 2403?

Step 1: Confirm that a system-assigned or user-assigned managed identity is enabled for the Fabric resource attempting the token request in the Azure portal or Fabric admin settings.. Step 2: Navigate to the target resource (e.g., Azure Data Factory, storage account, or database) and verify that the managed identity has been added with an appropriate role under Access Control (IAM).. Step 3: If using a user-assigned managed identity, ensure the correct identity is explicitly referenced in the pipeline's linked service or connection configuration and that it is associated with the Fabric resource.. Step 4: Check for any Azure Policy or Conditional Access policies in the tenant that may restrict MSI token acquisition and work with your Azure AD administrator to grant an exemption if needed.. Step 5: Test the managed identity token flow independently using Azure CLI (`az account get-access-token --resource `) from the relevant network context to isolate whether the issue is identity assignment or network-level token endpoint access.

Critical severityauthenticationMicrosoft Fabric →

Power BI Refresh Error:
Fabric Pipeline Error 2403

What does this error mean?

Error 2403 occurs when a Fabric pipeline cannot obtain an access token using Managed Service Identity (MSI) for authenticating to a downstream service or Data Factory resource. The managed identity may be misconfigured or lacks the required permissions.

Common causes

1The Fabric workspace or pipeline resource does not have a managed identity assigned or enabled
2The managed identity has not been granted the required RBAC role on the target resource (e.g., Data Factory Contributor or specific data source roles)
3The MSI token endpoint is unreachable due to network restrictions or a misconfigured Integration Runtime
4Tenant-level conditional access policies or managed identity restrictions are blocking token issuance

How to fix it

1Step 1: Confirm that a system-assigned or user-assigned managed identity is enabled for the Fabric resource attempting the token request in the Azure portal or Fabric admin settings.
2Step 2: Navigate to the target resource (e.g., Azure Data Factory, storage account, or database) and verify that the managed identity has been added with an appropriate role under Access Control (IAM).
3Step 3: If using a user-assigned managed identity, ensure the correct identity is explicitly referenced in the pipeline's linked service or connection configuration and that it is associated with the Fabric resource.
4Step 4: Check for any Azure Policy or Conditional Access policies in the tenant that may restrict MSI token acquisition and work with your Azure AD administrator to grant an exemption if needed.
5Step 5: Test the managed identity token flow independently using Azure CLI (`az account get-access-token --resource <target-resource-uri>`) from the relevant network context to isolate whether the issue is identity assignment or network-level token endpoint access.

Frequently asked questions

What RBAC role does the managed identity typically need on an Azure Data Factory resource?

For most pipeline orchestration scenarios, the managed identity needs at minimum the 'Data Factory Contributor' role on the target ADF resource, or a more specific role like 'Storage Blob Data Contributor' when accessing storage. Always follow the principle of least privilege and grant only what the specific activity requires.

Does this error occur differently for system-assigned versus user-assigned managed identities?

Yes. For system-assigned identities, the common issue is that the identity was not enabled or the role was assigned to the wrong resource. For user-assigned identities, the pipeline linked service must explicitly reference the correct identity client ID, and the identity must be attached to the Fabric resource — simply creating the identity is not sufficient.