An error occurred during execution: Error: Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.

Question

An error occurred during execution: Error: Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.

Boyapati haribabu 0

Can anybody help this one i was getting this issue :

2025-08-12T05:17:07.7528279Z ##[section]Starting: Synapse: DEPLOY (templates)
2025-08-12T05:17:07.7532471Z ==============================================================================
2025-08-12T05:17:07.7532599Z Task         : Synapse workspace deployment
2025-08-12T05:17:07.7532675Z Description  : Deployment task for synapse workspace v2
2025-08-12T05:17:07.7532768Z Version      : 2.5.0
2025-08-12T05:17:07.7532829Z Author       : Microsoft Corporation
2025-08-12T05:17:07.7533077Z Help         : Displays the name of your extension v2
2025-08-12T05:17:07.7533167Z ==============================================================================
2025-08-12T05:17:08.0583574Z Bundle source :  https://web.azuresynapse.net/assets/cmd-api/main.js
2025-08-12T05:17:08.0588041Z Starting deploy operation
2025-08-12T05:17:08.0821363Z Workspace info url:  https://management.azure.com/subscriptions/<abcd>/resourcegroups/ab/providers/Microsoft.Synapse/workspaces/ab?api-version=2019-06-01-preview
2025-08-12T05:17:08.3661927Z deploy operation failed
2025-08-12T05:17:08.3673927Z An error occurred during execution: Error: Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired. For more information refer https://aka.ms/azureappservicedeploytsg
2025-08-12T05:17:08.3699287Z ##[error]Encountered with exception:Error: Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired. For more information refer https://aka.ms/azureappservicedeploytsg
2025-08-12T05:17:08.3757752Z ##[section]Finishing: Synapse: DEPLOY (templates)

Boyapati haribabu 0 Reputation points

2025-08-12T06:51:55.8333333+00:00

i am using this type of credentials
Venkat Reddy Navari 5,405 Reputation points Microsoft External Staff Moderator

2025-08-12T10:41:03.5933333+00:00
HI Boyapati haribabu Thanks for sharing the error and the screenshot. The error message:

Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.

suggests that the pipeline is unable to authenticate using the provided Service Connection.

Based on your screenshot, you're using a workload identity federation with OpenID Connect (OIDC) for your Azure Resource Manager service connection. Here are a few things you should verify:

Troubleshooting Steps:

Check Managed Identity in Azure DevOps Service Connection

Go to your Azure DevOps project > Project Settings > Service Connections.

Select the service connection you're using.

Under "Manage Managed Identity", verify:

The Federated Credentials are correctly configured.

The Client ID, Issuer, and Subject Identifier match what’s expected by Azure.

Ensure Required Role Assignments

Make sure the Managed Identity or Federated Identity used has appropriate RBAC roles (like Contributor or Synapse Contributor) on the Synapse workspace and/or resource group.

You can check this in the Azure Portal under the "Access control (IAM)" tab of the resource.

Validate Token Exchange via OIDC: If you're using federated credentials, ensure:

Your pipeline is running in a GitHub Actions or Azure DevOps environment that supports OIDC.

The OIDC claims in your service principal match the subject configured.

Check for Expiry or Misconfiguration

If you recently rotated credentials or changed the service connection, ensure nothing broke during the update.

You can test the connection from Azure DevOps by clicking "Verify" on the service connection page.

For details, see the official reference here:

Configure workload identity federation in Azure DevOps

Azure App Service Deployment Troubleshooting Guide

If the issue still persists, please share:

Whether the service connection verification passes.

Your pipeline YAML snippet (especially the azureResourceManagerConnection line).

The identity provider (e.g., Azure DevOps, GitHub) you’re using for OIDC

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

1 answer

Your answer

Boyapati haribabu 0 Reputation points

2025-08-12T06:51:55.8333333+00:00

i am using this type of credentials

Answer 1

Boyapati haribabu 0

We using only to allow work load identity federations only service connections

Venkat Reddy Navari 5,405 Reputation points Microsoft External Staff Moderator

2025-08-13T11:07:02.3+00:00

Boyapati haribabu If you’re using workload identity federation for the service connection, double-check in Azure AD that the Issuer and Subject Identifier match exactly with what’s set in DevOps. Also make sure that service principal has the right role (Contributor or Synapse Contributor) on the workspace’s resource group. One quick test is to hit Verify on the service connection in DevOps, if that fails, remove and re-add the federated credential in Azure AD.

Hope this helps. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

An error occurred during execution: Error: Get workspace location error: Could not fetch access token for Azure. Verify if the Service Principal used is valid and not expired.

1 answer

Your answer