Forum Discussion

YashMoroliya's avatar
YashMoroliya
Regular Visitor
1 month ago
Solved

How to pull data from fabric data stores without authentication?

Is there any supported way to expose or consume Fabric GraphQL data externally without requiring Microsoft Entra ID authentication?

For example, can the GraphQL endpoint be accessed through any alternative mechanism such as a public endpoint, API key, embedded access model, service account, or any other supported integration pattern?

Our requirement is to allow an external system to retrieve data without implementing Entra ID-based authentication.

API for GraphQL
data engineering
Lakehouse
  • Parchitect's avatar
    Parchitect
    1 month ago
    Short answer: no, not directly.

     

    Fabric GraphQL endpoints are not public/no-auth endpoints. Microsoft’s documentation states that applications connecting to Fabric API for GraphQL must use Microsoft Entra ID authentication, and the caller then needs the required permissions on the GraphQL API and underlying data source.

     

    So the endpoint cannot be consumed with just the URL, a Fabric workspace permission, or a simple unauthenticated request.

     

    If the external system cannot implement Entra authentication directly, the supported pattern would be to put something in front of Fabric, for example Azure API Management or an Azure Function / custom API.

     

    Example pattern:
    External system
    → calls your API / APIM endpoint, possibly with API key or another auth method
    → your API / APIM authenticates to Fabric using Entra ID / managed identity / service principal
    → Fabric GraphQL is called securely

     

    Microsoft also documents APIM integration with Fabric API for GraphQL, including managed identity authentication.

     

    So you can hide the Entra flow from the external system by using a proxy/gateway, but the backend call to Fabric still needs Entra authentication.

     

    I would not treat service accounts, public endpoints, or API keys as a supported direct replacement for Entra authentication against the Fabric GraphQL endpoint.

     

    References:

     

    Best regards
    Solutions Architect - Microsoft Fabric Specialist - Parchitect

    💡Did my response help you? Clicking Kudos is a small gesture that goes a long way, it encourages contributors and helps the community thrive!
    ✔️Did I answer your question? Please mark my post as a Solution, it helps others find the answer faster.

4 Replies

  • v-csrikanth's avatar
    v-csrikanth
    Community Support
    1 month ago

    Hi YashMoroliya 
    We would like to inquire whether have you got the chance to check the solutions provided by other users in commiunity to resolve the issue. We hope the information provided helps to clear the query. Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.


    Thank you.

  • v-sgandrathi's avatar
    v-sgandrathi
    Community Support
    1 month ago

    Hi YashMoroliya,

    Thank you tayloramy Parchitect for your response to the quey

     

    Following up to check whether you got a chance to review the suggestions given. If the issue still persists please let us know. Glad to help

     

    Thank you.

  • Parchitect's avatar
    Parchitect
    Solution Sage
    1 month ago
    Short answer: no, not directly.

     

    Fabric GraphQL endpoints are not public/no-auth endpoints. Microsoft’s documentation states that applications connecting to Fabric API for GraphQL must use Microsoft Entra ID authentication, and the caller then needs the required permissions on the GraphQL API and underlying data source.

     

    So the endpoint cannot be consumed with just the URL, a Fabric workspace permission, or a simple unauthenticated request.

     

    If the external system cannot implement Entra authentication directly, the supported pattern would be to put something in front of Fabric, for example Azure API Management or an Azure Function / custom API.

     

    Example pattern:
    External system
    → calls your API / APIM endpoint, possibly with API key or another auth method
    → your API / APIM authenticates to Fabric using Entra ID / managed identity / service principal
    → Fabric GraphQL is called securely

     

    Microsoft also documents APIM integration with Fabric API for GraphQL, including managed identity authentication.

     

    So you can hide the Entra flow from the external system by using a proxy/gateway, but the backend call to Fabric still needs Entra authentication.

     

    I would not treat service accounts, public endpoints, or API keys as a supported direct replacement for Entra authentication against the Fabric GraphQL endpoint.

     

    References:

     

    Best regards
    Solutions Architect - Microsoft Fabric Specialist - Parchitect

    💡Did my response help you? Clicking Kudos is a small gesture that goes a long way, it encourages contributors and helps the community thrive!
    ✔️Did I answer your question? Please mark my post as a Solution, it helps others find the answer faster.