How to Grant Access to an Entire Azure AD Group in DWH Fabric?

I'm currently working with Microsoft DWH Fabric, and I need to grant read-only access to an entire Azure Active Directory (AAD) group. Specifically, I want to add the group to the db_datareader role in my database.

Here's what I tried so far:

I used the following SQL command to add the group:

ALTER ROLE db_datareader ADD MEMBER [group:group-id-or-name];  

Unfortunately, I got the following error:

Principal 'group:group-id-or-name' could not be found or this principal type is not supported.

I verified that the group exists in Azure AD and tried using both the group's name and object ID, with and without prefixes like group:.

However, this did not resolve the issue either.

Fixed

The problem is that I passed the group ID, instead only the name was passed. So the correct code is ALTER ROLE db_datareader ADD MEMBER [GroupName];

Principal 'group:group-id-or-name' could not be found or this principal type is not supported.

Ensure you have enabled Service principals can use Fabric APIs in fabric workspace, otherwise you may get above error. This setting is located in the Developer settings section and is labeled Service principals can use Fabric APIs.

After that create a user of Active directory group and add role using below command:

ALTER  ROLE db_datareader ADD  MEMBER [<ADGroupName>];

you have mentioned [group:group-id-or-name] in your command, that may be the reason to get Principal 'group:group-id-or-name' could not be found. Along with that ensure you have provided correct group name. For more information, you can refer to below documents:

• Principle 'XYZ' could not be found or this principal type is not supported

• https://learn.microsoft.com/en-us/fabric/data-warehouse/connectivity