Forum Discussion

lakshya-geek's avatar
lakshya-geek
New Member
7 months ago
Solved

Fabric Data Agent + MAF + SSO + OBO Setup Issues

We're having some issues consuming a Fabric Data Agent inside of a pro-code MAF Agent due to SSO and authentication. We want to implement an OBO flow which can help perform data-isolation per user. We are unable to find a straight forward solution for it,
 
Well It does work by giving access to Service principal's of the Bot and App to the fabric workspace!
 
please let us know if you have any clue about it.
admin
capacities
security
workspaces
  • Anonymous's avatar
    Anonymous
    7 months ago

    Hi lakshya-geek ,
    Thanks for reaching out to the Microsoft Fabric Community forum.

    At the moment, there isn’t a straightforward way to propagate the end-user identity to a Fabric Data Agent using an OBO flow when it is invoked from a pro-code MAF agent. As a result, theFabric Data Agent uses a Microsoft-managed Azure OpenAI Assistant and handles authentication for you.

    As a practical approach, you can grant the service principal used by the bot/application access to the Fabric workspace, which allows the Data Agent to execute successfully. If user-level data isolation is required, one option is to enforce it at the semantic model layer using Row-Level Security (RLS) or a similar authorization mechanism, while the agent continues to operate under the application identity.



    Reference: Create a Fabric data agent (preview) - Microsoft Fabric | Microsoft Learn

    I hope this information helps. Please do let us know if you have any further queries.
    Thank you

3 Replies

  • Anonymous's avatar
    Anonymous
    Not applicable
    7 months ago

    Hi lakshya-geek ,
    Thanks for reaching out to the Microsoft Fabric Community forum.

    At the moment, there isn’t a straightforward way to propagate the end-user identity to a Fabric Data Agent using an OBO flow when it is invoked from a pro-code MAF agent. As a result, theFabric Data Agent uses a Microsoft-managed Azure OpenAI Assistant and handles authentication for you.

    As a practical approach, you can grant the service principal used by the bot/application access to the Fabric workspace, which allows the Data Agent to execute successfully. If user-level data isolation is required, one option is to enforce it at the semantic model layer using Row-Level Security (RLS) or a similar authorization mechanism, while the agent continues to operate under the application identity.



    Reference: Create a Fabric data agent (preview) - Microsoft Fabric | Microsoft Learn

    I hope this information helps. Please do let us know if you have any further queries.
    Thank you

  • Anonymous's avatar
    Anonymous
    Not applicable
    7 months ago

    Hi lakshya-geek 

    I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.


    Thank you.

  • Anonymous's avatar
    Anonymous
    Not applicable
    7 months ago

    Hi lakshya-geek 

    May I check if this issue has been resolved? If not, Please feel free to contact us if you have any further questions.


    Thank you