Forum Discussion
SPN as capacity admin
Hello,
I'd like to add SPN to capacity admins in Fabric Admin Portal. User accounts go without a problem.
I've tried to use displayName, objectID, applicationID, group name with SPN added.
Every time I got message "You can't use invalid or duplicate emails."
It looks like the form cannot accept non-user principals.
Adding the SPN via terraform provider was also impossible, regardless of https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/fabric_capacity#administration_members-1
My goal is to use SPN for deployment all of the fabric infrastructure (capacity, domains, workspaces....).
Thanks đ
Hello eleonora8
The Fabric Admin portal âCapacity adminsâ UI only accepts user principals (UPNs/emails) and validates inputs as email identities, which causes service principals to be rejected with the error âYou canât use invalid or duplicate emails.â As a result, non-user principals such as SPNs are not supported by that UI, even though Fabric capacities themselves do support SPNs at the resource level.Workaround:Add the service principal as a Capacity Admin via the Azure portal, not the Fabric Admin portal. In Azure, navigate to the Fabric capacity resource â Settings â Capacity administrators, choose Enterprise applications, and add the SPN (or managed identity); this path officially supports SPNs and is the documented approach.This has been explained here -
2 Replies
Before you go that route consider the rather severe impact this has on the auditability of your capacity activities. Are you really sure?
Hello eleonora8
The Fabric Admin portal âCapacity adminsâ UI only accepts user principals (UPNs/emails) and validates inputs as email identities, which causes service principals to be rejected with the error âYou canât use invalid or duplicate emails.â As a result, non-user principals such as SPNs are not supported by that UI, even though Fabric capacities themselves do support SPNs at the resource level.Workaround:Add the service principal as a Capacity Admin via the Azure portal, not the Fabric Admin portal. In Azure, navigate to the Fabric capacity resource â Settings â Capacity administrators, choose Enterprise applications, and add the SPN (or managed identity); this path officially supports SPNs and is the documented approach.This has been explained here -
