What causes UserErrorFailedFileOperation?

The remote server is presenting a self-signed or untrusted SSL/TLS certificate not recognized by the integration runtime. An intermediate proxy or firewall is performing SSL inspection, presenting its own certificate instead of the server's. The integration runtime machine's certificate store is outdated or missing required root CA certificates. Mismatch between the TLS version supported by the runtime and the version required by the ADLS endpoint

How do I fix UserErrorFailedFileOperation?

Step 1: Identify whether a self-hosted integration runtime is in use; if so, ensure its host machine trusts the certificate chain presented by the ADLS or target endpoint.. Step 2: Check if a network proxy or firewall is performing SSL/TLS inspection and, if so, add the proxy's root CA certificate to the integration runtime machine's trusted certificate store.. Step 3: Update the integration runtime to the latest version to ensure modern TLS version compatibility with Azure endpoints.. Step 4: On the self-hosted IR machine, validate the certificate chain manually using a browser or openssl tool against the target ADLS endpoint URL.. Step 5: If the certificate is legitimately untrusted (e.g., internal PKI), import the required root and intermediate certificates into the Windows Certificate Store on the IR host.

High severityconnectivityMicrosoft Fabric →

Power BI Refresh Error:
UserErrorFailedFileOperation

What does this error mean?

The Copy Activity failed because the underlying connection was closed after the SSL/TLS certificate validation failed against ADLS or another endpoint. The runtime could not establish a trusted secure channel.

Common causes

1The remote server is presenting a self-signed or untrusted SSL/TLS certificate not recognized by the integration runtime
2An intermediate proxy or firewall is performing SSL inspection, presenting its own certificate instead of the server's
3The integration runtime machine's certificate store is outdated or missing required root CA certificates
4Mismatch between the TLS version supported by the runtime and the version required by the ADLS endpoint

How to fix it

1Step 1: Identify whether a self-hosted integration runtime is in use; if so, ensure its host machine trusts the certificate chain presented by the ADLS or target endpoint.
2Step 2: Check if a network proxy or firewall is performing SSL/TLS inspection and, if so, add the proxy's root CA certificate to the integration runtime machine's trusted certificate store.
3Step 3: Update the integration runtime to the latest version to ensure modern TLS version compatibility with Azure endpoints.
4Step 4: On the self-hosted IR machine, validate the certificate chain manually using a browser or openssl tool against the target ADLS endpoint URL.
5Step 5: If the certificate is legitimately untrusted (e.g., internal PKI), import the required root and intermediate certificates into the Windows Certificate Store on the IR host.

Frequently asked questions

Does this error occur with the Azure Integration Runtime (cloud) or only self-hosted?

It most commonly occurs with self-hosted integration runtimes because the cloud Azure IR uses Microsoft-managed, up-to-date certificate stores; however, it can occur in either if the endpoint certificate chain is unusual.

Will disabling certificate validation fix this?

Disabling certificate validation is not recommended in production as it exposes the pipeline to man-in-the-middle attacks; instead, properly import the correct certificates into the trusted store.