How to fix UserErrorPermissionDeniedOnCloudIR

Question

Hi,

I'm trying to copy files from my sharepoint online document library into azure blob storage, but I am getting this error:

ErrorCode=UserErrorPermissionDeniedOnCloudIR,'Type=Microsoft.DataTransfer.Common.Shared.HybridDeliveryException,Message=Access https://<my-domain>.sharepoint.com/sites/<my-site>/_api/web/GetFileByServerRelativeUrl ('<path/to/file>')/$value' is not allowed on Azure integrate runtime

Are there some costume configurations that need to be made for running copy operations on azure integration runtimes?

Thanks.

Answer 1

Hi ,

Thanks for reaching out to Microsoft Q&A.

The UserErrorPermissionDeniedOnCloudIR error you are seeing typically indicates an issue with permissions or configuration when trying to access SharePoint Online from Azure Integration IR in ADF.

Here are some steps you can take to troubleshoot and resolve this:

1. Verify Permissions on SharePoint Online

• Ensure the user or service principal used for AUTH has the appropriate permissions to access the specified SharePoint Online document library.
• The account needs at least Read permission on the file and library you’re trying to access.

2. Use Self-Hosted Integration Runtime (SHIR)

• Azure Integration Runtime (IR) doesn’t inherently support all network and authentication methods required by SharePoint. To overcome this, consider using a SHIR instead of Azure IR, as SHIR can provide more flexible access to on-premises and private network resources.
• Install SHIR on a VM (or on-prem server) that has network access to SharePoint Online, then use it for your copy operation.

3. Ensure Authentication Method Compatibility

• If you are using Azure AD authentication, ensure that:
  • You are using a valid OAuth token or service principal with permissions to access the SharePoint site.
    • Azure IR or SHIR is configured to support the OAuth authentication method required by SharePoint.
    • When setting up OAuth, make sure to:
      • Register an application in Azure AD, grant API permissions for SharePoint Online, and configure the application for delegated or application permissions, as required.
        • Add the client ID and client secret of the registered application in the linked service configuration for SharePoint Online in ADF.

4. Configure the SharePoint Linked Service Correctly in ADF

• Double-check the configuration of your SharePoint Online linked service in Azure Data Factory:
  • Ensure that the Tenant ID, Client ID, and Client Secret fields (if using a service principal) are correctly populated. Confirm that the correct Site URL is specified.
• If there’s an option for choosing a File path, make sure it is accurate and accessible with the given credentials.

5. Network Configuration and Allowlisting

• Ensure that network access permissions for Azure IR or SHIR are set up correctly. Sometimes, you may need to configure allowlisting to permit ADF access to SharePoint Online.

Additional Tips:

• Review the Azure Data Factory SharePoint Online connector documentation for any specifics related to configuration. Test the configuration by first setting up a simple file access to ensure basic connectivity, then proceed with your complete file copy operation.

If the issue persists, please provide additional details on auth methods and integration runtime configurations to identify any further customizations.

Please feel free to click the 'Upvote' (Thumbs-up) button and 'Accept as Answer'. This helps the community by allowing others with similar queries to easily find the solution.