Microsoft Fabric with GitHub

Hi Subin, 

 I don't think there is any way to create a private link between Fabric and GitHub, so to use the git integration with GitHub, the IP restriction would need to be turned off on the GitHub side. 

Hi,

Based on the current Microsoft Fabric Git integration limitations, the issue may indeed be related to your GitHub organization's IP allow list configuration.

Microsoft Fabric is a multi-tenant SaaS service and does not provide dedicated or static outbound IP addresses for Git integration with GitHub. Fabric Git integration operates from Microsoft-managed infrastructure, and the outbound IP addresses can vary by region and over time. As a result, GitHub organization IP allow lists can prevent Fabric from accessing repositories even when the PAT permissions and repository permissions are configured correctly.

Currently, Fabric does not support:

• Static outbound IP addresses for Git integration
• Private Endpoint connectivity to GitHub repositories
• Customer-managed network endpoints that can be individually allowlisted in GitHub

If your GitHub organization enforces an IP allow list, Fabric may be unable to authenticate or retrieve repository information unless the relevant Microsoft Fabric service IP ranges are allowed.

As a next step, I would recommend:

1. Testing against a repository that is not subject to the organization's IP allow list to confirm whether the restriction is the root cause.
2. Opening a Microsoft support case to verify whether any region-specific Fabric service IP ranges can be accommodated.
3. Reviewing available community approaches that dynamically synchronize Fabric regional IP ranges with GitHub allow lists if maintaining strict IP restrictions is a firm security requirement.

Based on the current platform capabilities, there is no officially supported option to use Private Endpoints or dedicated static outbound IP addresses for Microsoft Fabric Git integration with GitHub.

Hope this helps clarify the current limitations and available options.

Thanks,

Manoj Annavajjala

I'm reading the other replies and they seem reasonable. What bothers me is the error message. It is specifically a credential error. I would validate that it is a whitelisting issue by attempting to use the PAT on your local laptop. Do a git clone and enter your username and pat when prompted. If you can't connect locally you know it is probably a credential issue.  

Prince0011 sannavajjala BrandonHart tayloramy 

Environment

• GitHub Enterprise (Shared Server) – Per User Monthly Subscription
• Our corporate GitHub organization is protected by IP restrictions.
• The corporate repository is not accessible outside our company network.

Issue

When attempting to connect Microsoft Fabric Workspace to our corporate GitHub repository, Fabric returns the following error  "Invalid credentials or insufficient permissions "

I have already verified that the GitHub account has the required repository permissions.

Workarounds Already Tried

1. Personal Access Token (Classic)

• Created a Classic PAT.
• Assigned the required permissions to the corporate GitHub organization.
• Used the token in Microsoft Fabric.
• Result: Same "Invalid credentials or permissions" error.

2. Fine-Grained Personal Access Token

• Created a Fine-Grained PAT.
• Granted access to the required repositories.
• Organization administrator approved the token.
• Used the approved token in Microsoft Fabric.
• Result: Same "Invalid credentials or permissions" error.

3. Separate GitHub Organization (Without IP Restrictions)

• Created a separate GitHub organization with no IP restrictions.
• Used the same type of PAT to connect Microsoft Fabric.
• Result: Connection was established successfully.

This strongly suggests that the issue is related to the IP restrictions configured on our corporate GitHub organization, rather than the PAT permissions or repository access.

Additional Information

I found Microsoft's published list of Microsoft Fabric IP addresses:

https://www.microsoft.com/en-us/download/details.aspx?id=56519

However, this approach raises a few concerns:

• The IP list is very large.
• The addresses can change over time.
• Allowlisting all Microsoft Fabric IP addresses is not considered a secure option in our organization.
• Our company security policy requires strict IP restrictions, so removing or bypassing them is not an option.

Questions

1. Has anyone successfully integrated Microsoft Fabric with a GitHub Enterprise organization that enforces IP restrictions?
2. Does Microsoft Fabric support using a static outbound IP, private IP, or Private Link for Git integration?
3. Is there any recommended architecture or workaround that allows Fabric to authenticate with GitHub while keeping corporate IP restrictions in place?
4. Are there any Microsoft best practices for organizations with strict network security policies when using Fabric Git integration?

Any suggestions or experiences would be greatly appreciated.

Thank you!

Hi Subin,

Thanks for reaching out to the Microsoft Fabric Community forum.

Based on your testing and the current Microsoft Fabric documentation, the behavior you're seeing aligns with the documented Git integration limitations. The official documentation lists IP allowlist as one of the GitHub Enterprise limitations for Fabric Git integration. Based on your testing and this documented limitation, the behavior is consistent with the IP allow list restriction.

Additionally, if you're using GitHub repositories, ensure that the tenant setting Users can sync workspace items with GitHub repositories is enabled, as this setting is disabled by default.

For more details, please refer to the following official documentation:

Overview of Fabric Git integration - Microsoft Fabric | Microsoft Learn

Git integration process - Microsoft Fabric | Microsoft Learn

Git integration admin settings - Microsoft Fabric | Microsoft Learn

I hope this helps. Please feel free to reach out if you have any further questions.
Thank you.

Hi Subin,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. 

Thank you.

Fabric uses Microsoft-managed outbound infrastructure, so there may not be a fixed IP you can simply whitelist in GitHub. Check with Microsoft support for available outbound IP ranges or private connectivity options for your region. If GitHub IP allow lists cannot support Fabric traffic, a GitHub App/service account approach may be the better option.

Hi Subin,

May I check if this issue has been resolved? If not, Please feel free to contact us if you have any further questions.

Thank you