How to fix "Status code 400, "{"error":{"code":"InvalidSubscriptionId","message":"The provided subscription identifier 'resourceGroups' is malformed or invalid."}}""

i was able to resolve after adding the full advanced json , please close the thread , am unblocked.

https://learn.microsoft.com/en-us/azure/data-factory/connector-azure-cosmos-db?tabs=data-factory#user-assigned-managed-identity-authentication

Hello Jaya Vardhani Mamidala,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to fix Status code 400, "{"error":{"code":"InvalidSubscriptionId","message":"The provided subscription identifier 'resourceGroups' is malformed or invalid."}}"".

You will need to ensure that, at Mapping Data Flow runtime (debug or pipeline), the value bound to the “subscriptionId” slot is a real subscription GUID and not empty, most commonly by correctly binding parameters in Debug Settings > Parameters and/or by selecting resources via “From Azure subscription” in the linked service UI. - https://learn.microsoft.com/en-us/azure/data-factory/concepts-data-flow-debug-mode Everything else (including IR mismatch) is secondary and should only be used if parameter binding is proven correct.

What you do by steps is to:

• (a) identify the root cause with proof, then
• (b) apply the one fix that removes resourceGroups from the subscriptionId position.

With the steps below you can:

1. Open your Mapping Data Flow.
2. Turn on Data Flow Debug. When prompted, note you must select an IR configuration for the debug session. -
3. Click Debug Settings → go to the Parameters tab.
4. For every parameter used by:

• the Data Flow, and
  • any referenced dataset(s), set explicit values (do not leave blank). Microsoft explicitly supports supplying parameter values for debugging here.

If any parameter that influences “Subscription / Resource Group / Resource Name / Endpoint” is blank or wrongly mapped, Data Flow runtime may build a malformed management request path. This will help to prove the failure is parameter/value binding, not “connectivity” - https://learn.microsoft.com/en-us/azure/data-factory/concepts-data-flow-debug-mode

STEP 2:

Regarding the error:

Your error proves the runtime is effectively calling something like /subscriptions/<subscriptionId>/... with <subscriptionId> missing, causing resourceGroups to shift into that slot.

Do this depending on how your linked service is defined:

Case A: Linked service uses “From Azure subscription” style fields

1. Open the Linked Service used by the Data Flow source/sink that triggers the error.
2. If the connector UI supports it, choose Browse / Select from Azure subscription (instead of manual text fields).
3. Explicitly pick:

• Subscription
  • Resource group
  • Resource name
  1. Save.

This will forces ADF to store valid identifiers and prevents empty subscriptionId generation.

Case B: Linked service/dataset is parameterized (subscription/rg/name are parameters)

1. Identify parameters that map to:
   • subscriptionId (or subscription name),
   • resourceGroup,
     • resourceName (server/account/etc.)
2. Ensure the subscriptionId parameter is populated with a proper subscription GUID before the Data Flow runs:

• If running in debug: set it in Debug Settings > Parameters (Step 1). - https://learn.microsoft.com/en-us/azure/data-factory/concepts-data-flow-debug-mode
• If running in pipeline: set it in the pipeline activity parameters (pipeline debug/run).

NOTE: If subscriptionId resolves to empty, you will reproduce the exact error: resourceGroups becomes the interpreted subscriptionId. After setting parameters, Data Flow “Test connection” no longer returns InvalidSubscriptionId and proceeds to actual connectivity/permissions checks.

STEP 3:

This is the secondary check (not primary), but it can block debug correctness.

1. When enabling Data Flow Debug, explicitly select the IR configuration your environment expects (AutoResolveIntegrationRuntime or another configured option). Microsoft states you are prompted to select an IR configuration for debug sessions.
2. If you change IR configuration, restart the debug session (turn debug off/on) so the Spark cluster is recreated with that choice. Each debug session is its own Spark cluster. Note: If IR mismatch were the only problem, you’d more typically see network/endpoint errors, not InvalidSubscriptionId. Treat this as a correctness check, not the core fix. - https://learn.microsoft.com/en-us/azure/data-factory/concepts-data-flow-debug-mode

STEP 4:

1. Use Data Preview after debug starts to confirm the Data Flow runtime is actually executing transformations.
2. Remember: Data Preview doesn’t write to sinks; to fully validate sink writes, run the Data Flow in a pipeline debug/run. https://learn.microsoft.com/en-us/azure/data-factory/concepts-data-flow-debug-mode

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.