Microsoft Purview Data Quality API: Service Principal Can Read Rules but Cannot Create Rules (403 Unauthorized)

Question

Microsoft Purview Data Quality API: Service Principal Can Read Rules but Cannot Create Rules (403 Unauthorized)

Jacob V 0

Hi,

Does Microsoft Purview Data Quality support create/update/delete operations using Service Principal authentication?

Or are Data Quality write operations restricted to delegated user permissions (user_impersonation)?

If Service Principal write access is supported:

What additional permissions are required?
Are there any additional Entra ID API permissions that must be granted?
Are there separate Data Quality roles required beyond Collection Administrator / Data Curator / Data Reader?

Any guidance would be appreciated.

Thanks.

Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-19T14:24:03.64+00:00
Hi @Jacob V

Thank you for reaching out to the Microsoft Q&A forum.

Yes, Microsoft Purview Data Quality APIs support OAuth authentication using a Service Principal. However, a 403 Unauthorized error during Create/Update/Delete Rule operations usually indicates a permissions issue, not an authentication issue.

Please verify:

The Service Principal is assigned the required Purview roles (for example, Collection Administrator or Data Curator) at the appropriate collection scope.

The access token is obtained with the scope https://purview.azure.net/.default.

Role assignment changes have had sufficient time to propagate.

Currently, Microsoft documentation does not clearly specify any additional Entra ID API permissions or separate Data Quality-specific roles required for rule creation.

If read operations succeed but Create Rule returns 403, please share:

The exact API being called(Create Rule, Update Rule, Delete Rule, etc.)

The full 403 response body (including error code and message)

The roles currently assigned to the service principal in Purview

This will help determine whether the issue is due to missing permissions or a current limitation of the Data Quality API.

References:

https://learn.microsoft.com/en-us/rest/api/purview/purviewdataquality/create-rules/create-rules?view=rest-purview-purviewdataquality-2026-01-12-preview&tabs=HTTP

2 answers

Your answer

Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-19T14:24:03.64+00:00

Hi @Jacob V

Thank you for reaching out to the Microsoft Q&A forum.

Yes, Microsoft Purview Data Quality APIs support OAuth authentication using a Service Principal. However, a 403 Unauthorized error during Create/Update/Delete Rule operations usually indicates a permissions issue, not an authentication issue.

Please verify:

The Service Principal is assigned the required Purview roles (for example, Collection Administrator or Data Curator) at the appropriate collection scope.

The access token is obtained with the scope https://purview.azure.net/.default.

Role assignment changes have had sufficient time to propagate.

Currently, Microsoft documentation does not clearly specify any additional Entra ID API permissions or separate Data Quality-specific roles required for rule creation.

If read operations succeed but Create Rule returns 403, please share:

The exact API being called(Create Rule, Update Rule, Delete Rule, etc.)

The full 403 response body (including error code and message)

The roles currently assigned to the service principal in Purview

This will help determine whether the issue is due to missing permissions or a current limitation of the Data Quality API.

References:

https://learn.microsoft.com/en-us/rest/api/purview/purviewdataquality/create-rules/create-rules?view=rest-purview-purviewdataquality-2026-01-12-preview&tabs=HTTP

Answer 1

Jacob V 0

Hi @Himaja Y

I have verified the Service Principal has the required roles and the correct access token. The service principal can successfully execute GET .../global-rules and receives HTTP 200, however POST .../global-rules return "Not authorized to access account".

The exact API being called(Create Rule, Update Rule, Delete Rule, etc.) POST https://<tenant>-api.purview-service.microsoft.com /datagovernance/quality/business-domains/<domain-id> /data-products/<product-id> /data-assets/<asset-id> /global-rules
The full 403 response body (including error code and message) { "error": { "code": "Unauthorized", "message": "Not authorized to access account" } }
The roles currently assigned to the service principal in Purview The service principal is assigned Collection Administrator, Data Reader, and Data Curator roles

Himaja Y 375 Reputation points Microsoft External Staff Moderator

2026-08-21T12:21:55.29+00:00

Hi @Jacob V ,

I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

Answer 2

Hi @Jacob V ,

Thank you for the update.

Since the Service Principal can successfully execute the GET /global-rules API (HTTP 200), authentication, token scope, and the assigned Purview roles appear to be configured correctly.

However, the POST /global-rules request returns 403 Unauthorized ("Not authorized to access account") even though the Service Principal has Collection Administrator, Data Curator, and Data Reader roles.

This suggests that the issue is specific to Data Quality write operations rather than authentication. Based on the current documentation, it is not clear whether creating Data Quality rules through a Service Principal is fully supported or if certain write operations require delegated user permissions.

At this point, this could be:

A limitation of Service Principal support for Data Quality rule creation.
An undocumented permission requirement for Data Quality authoring operations.
A service-side authorization issue specific to the Data Quality API.

As the required roles have already been assigned and read operations are working, we recommend engaging Microsoft Support to confirm whether POST /global-rules is supported with Service Principal authentication and whether any additional permissions are required.