Forum Discussion
Helper Icreate connections with api calls same as adf to fabric ui migration utility do
I'm building an automated ADF → Fabric pipeline migration tool using the REST API. I successfully:
- Parse ADF ARM templates and extract linked services
- Create Fabric connections via POST /v1/connections using a Service Principal (application token / client_credentials flow)
- Deploy 7 pipelines via POST /workspaces/{id}/items with inline datasetSettings and embedded connection GUIDs
- All pipelines deployed successfully (200 OK)
The problem: The connections created by the SPN are NOT visible in the personal "Manage Connections and Gateways" page for any human user. The deployed pipelines show "Failed to load the connection" in Fabric Studio because the connections are owned by the SPN, not a user account.
What the UI Migration Utility does differently: When you use the Fabric UI migration tool, the created connections appear correctly in the Connections page and can be edited/tested/deleted. My assumption is that the UI tool uses a delegated OAuth token (user context) instead of an application token, so the connection is owned by the user.
My questions:
- Is it possible to call POST /v1/connections with a delegated token (device_code flow) to create user-owned connections programmatically — same result as the UI utility?
- Is there a way to transfer ownership of an SPN-created connection to a user via API?
- Is there a different API endpoint the UI migration utility uses to create connections that doesn't have this ownership restriction?
- For enterprise migrations (100+ linked services), what is the recommended approach to create connections programmatically while keeping them user-visible and manageable in the UI?
Hi dataengineerv2,
Based on the Microsoft documentation, the recommended approach is to recreate ADF Linked Services as Fabric Connections when migrating to Fabric and automate the migration wherever possible. The Create Connection REST API supports both User and Service Principal identities, and you can manage connection access by assigning User, User with resharing, or Owner roles using the Add Connection Role Assignment REST API or the Manage connections and gateways experience.
Connections - Create Connection - REST API (Core) | Microsoft Learn
Connections - Add Connection Role Assignment - REST API (Core) | Microsoft Learn
Data source management - Microsoft Fabric | Microsoft Learn
Thank you.
10 Replies
v-kpoloju-msftCommunity Support
Hi dataengineerv2,
Thank you for reaching out to the Microsoft Fabric Community Forum.The issue appears to be related to connection ownership rather than pipeline deployment. Since the connections are created via the Connections REST API using a Service Principal, the connections are owned by the Service Principal and therefore are not visible in the personal Manage Connections and Gateways experience for end users. This differs from the Fabric UI Migration Utility, which likely operates in a delegated user context.
If user visibility and management of connections are required, creating the connections with a delegated OAuth token is the preferred approach. At this time, there is no documented REST API to change the owner of an existing connection after it has been created. For enterprise migrations involving many linked services, Microsoft generally recommends either creating connections under a user identity or using a Service Principal for automation and then assigning appropriate permissions to users or Entra ID security groups for ongoing management.Please refer to the below following documentation links:
1. https://learn.microsoft.com/en-us/rest/api/fabric/core/connections/add-connection-role-assignment?tabs=HTTP
2. https://learn.microsoft.com/en-us/rest/api/fabric/articles/identity-support?
Hope this helps. If you have any questions regarding this, please feel free to reach out us. We will be happy to help.
dataengineerv2tried that way but that also requires browser help like when i start the script , its give me one link which is https://login.microsoftonline.com/ and give me code to submit there , is this the way you are talking about or stiil i can avoid this redirection and can do this with completely by script only ?
its working like showing connection in fabric connection page but needs to verify with submit that code to the url , want to remove this manul part so all this things can be done by the script it self ? does this possible or any other better way to do this for 100 of pipelines and linked services ?- v-kpoloju-msft
Hi dataengineerv2,
Since the connection is being created with a delegated user token, Microsoft Entra ID requires an interactive user sign-in to verify the user's identity and grant consent. The device code flow (providing a URL and code for the user to enter) is one of the supported delegated authentication methods, and this manual sign-in step cannot generally be removed when creating user-owned connections. While delegated authentication results in connections that are visible and manageable in the Fabric Connections page, it requires user authentication at least once to obtain the delegated token.
If your requirement is a fully unattended migration for hundreds of pipelines and linked services, the recommended approach is to use a Service Principal for automation. However, connections created this way remain Service Principal-owned. Currently, there is no documented Fabric REST API to silently create user-owned connections on behalf of another user or transfer ownership of an existing connection after creation. For ongoing management, consider using connection role assignments, security groups, or workspace permissions in combination with Service Principal-based deployments.
Refer these links below are mentioned:
1. https://learn.microsoft.com/en-us/rest/api/fabric/core/connections/add-connection-role-assignment?tabs=HTTP
2. https://learn.microsoft.com/en-us/rest/api/fabric/articles/identity-support?
- timeseriesIQR
Advocate I
Use a standard SQL connection instead of api to simplify your life.
- dataengineerv2
i think you dindt understand , my goal is to migrate pipeinese with converting arm template adf export to fabric , create appropriate connections for this using api call and deployed just problme is its required device code with help of browser to use my account as spn , now want to remove that browser dependency and fully automated ,
how sql can help here?- v-saisrao-msft
Hi dataengineerv2,
Based on the Microsoft documentation, the recommended approach is to recreate ADF Linked Services as Fabric Connections when migrating to Fabric and automate the migration wherever possible. The Create Connection REST API supports both User and Service Principal identities, and you can manage connection access by assigning User, User with resharing, or Owner roles using the Add Connection Role Assignment REST API or the Manage connections and gateways experience.
Connections - Create Connection - REST API (Core) | Microsoft Learn
Connections - Add Connection Role Assignment - REST API (Core) | Microsoft Learn
Data source management - Microsoft Fabric | Microsoft Learn
Thank you.
- v-saisrao-msft
Hi dataengineerv2,
Have you had a chance to review the solution we shared earlier? If the issue persists, feel free to reply so we can help further.
Thank you.
