Lakeflow Connect SharePoint - 403 Error

[ChristianRRL]

Hi, I'd like some help clarifying how lakeflow connect pipelines work (or should work). I went through the steps to (1) set up a connection, and (2) setup the ingestion, but I keep running into the following error:

Operation failed: "This request is not authorized to perform this operation.", 403

On checking the Ingestion Pipeline, I noticed that it's spinning up what I suspect are Job Clusters, but I'm not sure if the issue we're seeing here is due to either (A) the job cluster not having proper access due to some kind of network whitelisting issue for example, or (B) some issue with the access of the unity catalog/schema itself, or (C) something else entirely I may be missing.

Would appreciate some assistance here! Below are some related screenshots:

[henry_collins]

Check the permissions side first. A 403 usually points to an authorization issue rather than the cluster itself. Make sure the pipeline’s service principal/user has the required Unity Catalog privileges on the target catalog, schema, and tables, and also verify the storage credentials/external locations if you’re using them. If those look correct, then move on to checking network rules or workspace connectivity for the ingestion cluster. The pipeline cluster is managed by Lakeflow, so cluster-level access is usually less likely unless there are custom policies in place.

[GabFernandes]

Hi! The 403 error you're seeing is almost certainly not coming from SharePoint — it's coming from Azure Storage.

The key clue is in the error detail: access denied to /cas cloud path. The /cas path is Unity Catalog's managed storage location (Catalog Asset Store) on ADLS Gen2. Lakeflow Connect spins up a job cluster that tries to write there, and that cluster's identity is being denied by Azure.

Here are the three things to check, in order of likelihood:

1. Missing IAM role on the UC managed storage account (most common):

The Databricks workspace managed identity needs Storage Blob Data Contributor on the ADLS Gen2 storage account that backs your Unity Catalog metastore. Go to: Azure Portal → Storage Account (the one linked to your UC metastore) → Access Control (IAM) → check that the Databricks managed identity has Storage Blob Data Contributor.

2. Missing Unity Catalog privileges on the destination:

 The user or service principal that created the pipeline needs explicit grants on the target schema

GRANT USE CATALOG ON CATALOG <your_catalog> TO <principal>;
GRANT USE SCHEMA ON SCHEMA <your_catalog>.<your_schema> TO <principal>;
GRANT CREATE TABLE ON SCHEMA <your_catalog>.<your_schema> TO <principal>;

3. Missing Microsoft Graph API permissions on the Azure AD app:

 If the above are fine, check that your app registration has admin consent granted for Sites.Read.All (or Files.ReadWrite.All) under Microsoft Graph API permissions in Azure AD — without admin consent the token is issued but scoped incorrectly.

---

Why option A is probably it: The error fires during pipeline compute resource setup, before it even touches SharePoint. That timing means the cluster can't reach UC storage — the SharePoint credentials aren't even in play yet at that stage.

Hope this helps!