What causes Fabric Pipeline Error 2505?

The storage linked service connected to the Azure Batch activity is configured to use a SAS token instead of an account access key. A recent security policy change migrated storage connections to SAS-based authentication without accounting for Batch activity requirements. Managed identity or service principal authentication was configured on the storage linked service, which is incompatible with Batch SAS generation. The linked service was copied or cloned from another pipeline that used SAS-based storage

How do I fix Fabric Pipeline Error 2505?

Step 1: Identify the storage linked service referenced by the Azure Batch activity in your Fabric pipeline.. Step 2: Open the linked service in the Fabric Data Factory editor and check the authentication method; if it is set to SAS URI, SAS token, managed identity, or service principal, it must be changed.. Step 3: Switch the authentication method to 'Account Key' and enter the storage account name and its access key from the Azure Portal under Storage Account > Access Keys.. Step 4: Test the linked service connection to confirm account key authentication is working correctly.. Step 5: Re-publish the pipeline and re-run it to confirm the SAS creation error is resolved.

High severityauthenticationMicrosoft Fabric →

Power BI Refresh Error:
Fabric Pipeline Error 2505

What does this error mean?

The pipeline cannot create a Shared Access Signature because Azure Batch activities only support storage accounts authenticated with an account access key, not SAS tokens or other credential types.

Common causes

1The storage linked service connected to the Azure Batch activity is configured to use a SAS token instead of an account access key
2A recent security policy change migrated storage connections to SAS-based authentication without accounting for Batch activity requirements
3Managed identity or service principal authentication was configured on the storage linked service, which is incompatible with Batch SAS generation
4The linked service was copied or cloned from another pipeline that used SAS-based storage

How to fix it

1Step 1: Identify the storage linked service referenced by the Azure Batch activity in your Fabric pipeline.
2Step 2: Open the linked service in the Fabric Data Factory editor and check the authentication method; if it is set to SAS URI, SAS token, managed identity, or service principal, it must be changed.
3Step 3: Switch the authentication method to 'Account Key' and enter the storage account name and its access key from the Azure Portal under Storage Account > Access Keys.
4Step 4: Test the linked service connection to confirm account key authentication is working correctly.
5Step 5: Re-publish the pipeline and re-run it to confirm the SAS creation error is resolved.

Frequently asked questions

Why does Azure Batch require account key authentication instead of SAS?

Azure Batch internally generates its own SAS tokens to grant nodes access to resource files. This process requires the storage account key to sign the tokens; it cannot work from an externally provided SAS token or identity-based credential.

Is there a more secure alternative to using the storage account key with Batch?

You can store the account key in Azure Key Vault and reference it from the Fabric linked service, which avoids hardcoding the key while still satisfying the Batch requirement for key-based authentication.