Forum Discussion
Glossary access issue in portal
I'm new to Purview and need some guidance on how to troubleshoot this.
I have created a new glossary over the apis and can list the new glossary after its creation.
I cannot however see the new glossary in the portal.
I am the purview admin so have all the access rights including Data Curator. The api uses a registered app with client secret to gain access. The apis can confirm access and creation of the glossary, the portal just throws a 403 error message
Muddying the waters a little I have a federated user on the tenant where purview is running.
I really don't know where to start troubleshooting this, any help appreciated
1 Reply
A 403 in Purview typically indicates that the portal is attempting to call an API under your user context. Still, the request is blocked due to missing permissions or an incorrect identity. Since you mentioned the glossary was created successfully through the registered app, that proves the service principal has the right API permissions. The problem shows up only in the portal, which relies on your interactive user identity. If your account is federated, Purview may sometimes fail to resolve the correct identity when cross-tenant or conditional access policies are in effect.
A few practical checks will help you narrow it down. First, confirm that your user account (not just the service principal) has been granted the required Purview roles, such as Data Curator and Collection Admin, at the proper scope. Second, check if conditional access or MFA policies could be blocking the portal calls but not the API calls. Third, try signing in with a native (non-federated) account in the tenant to see if the problem is tied to federation. If that works, the fix is usually to adjust your federated identity mapping or re-grant explicit RBAC assignments in Purview for that user. Clearing cached sessions and forcing a re-authentication in the Purview portal is also worth testing.
In short, the glossary is available, but the portal is not authorized to display it within your current sign-in context. Aligning the RBAC roles with your interactive user account and verifying federation or conditional access policies should resolve the issue. If those steps do not resolve the issue, raise a Microsoft support case with the request ID from your screenshot..they can then trace exactly which role assignment is being rejected.
