Microsoft Fabric Error:
Lakehouse Data Copy Operation Failed
What does this error mean?
A copy activity or pipeline transferring data to or from a Fabric Lakehouse failed due to network connectivity problems, TLS/SSL handshake failures, or authentication issues in the integration runtime. The error can occur in both Azure IR and self-hosted IR environments.
Common causes
- 1Network instability or a dropped TCP connection between the integration runtime and the Lakehouse ABFSS endpoint
- 2TLS/SSL certificate validation failure — common when the integration runtime machine's root CA certificates are outdated
- 3The integration runtime cannot reach the Fabric service endpoint due to firewall or proxy restrictions
- 4Lakehouse access credentials (Shared Access Signature or service principal) have expired during a long-running copy
How to fix it
- 1In Fabric Monitor, open the failed activity run and expand the error details — look for a specific sub-error code indicating whether the failure is TLS, authentication, or network-related.
- 2Test connectivity from the integration runtime to the Fabric Lakehouse endpoint by checking that *.dfs.fabric.microsoft.com is reachable on port 443 from the IR host.
- 3If using a self-hosted IR: verify the IR node has up-to-date TLS root certificates and can reach Fabric endpoints. Update the IR software if a newer version is available.
- 4If using Azure IR: re-test the linked service connection from Fabric — transient TLS handshake failures often resolve on retry. Add a retry policy (2–3 retries, 30-second intervals) to the copy activity.
- 5If the failure is authentication-related, re-enter or rotate the credentials in the Fabric linked service and verify the service principal or managed identity has at least Contributor access on the Lakehouse workspace.
Beyond the docs
Common practitioner solutions not covered in the official documentation.
- 1Retry the copy activity — transient network issues often resolve on retry
- 2If the error message contains 'SSL' or 'TLS': update the root CA certificates on the self-hosted integration runtime machine and restart the IR service
- 3Check that the IR machine can reach the Fabric ABFSS endpoints (*.dfs.core.windows.net and *.blob.core.windows.net) on port 443
- 4If using SAS tokens, verify they haven't expired; rotate and update the credentials in the linked service
- 5Review the IR logs on the host machine for the specific SSL or network error code for targeted diagnostics