Call semPy libraries as service principal

[PetyrBaelish]

I have a notebook that I wish to get information from all datasets across my tenancy. I have been able to do this for workspaces my account has access to, but I need to do this for all workspaces. I don't want to use my global admin account for this, I want to use a service principal instead. I can't figure out how to call fabric.list_datasets as a service principal and after chekcing the SemPy documentation I'm no further forward.

I'm trying to test in the script below, using a single workspace - but my authentication info just isn't connected to calling fabric.list_datasets

Does anyone know how this can be achieved?

My test script:

from azure.identity import ClientSecretCredential
from sempy.fabric import FabricRestClient
import sempy.fabric as fabric

# Service principal credentials
tenant_id = "11111111-1111-1111-1111-111111111111"
client_id = "aaaaaaaa-bbbb-bbbb-cccc-cccccccccccc"
client_secret = "aaaaaaaa-bbbb-bbbb-cccc-dddddddddddd"

# Authenticate using service principal
credential = ClientSecretCredential(tenant_id, client_id, client_secret)

# Initialize the FabricRestClient with the credential
fabric_client = FabricRestClient(token_provider=credential)

# Call the list_datasets method
workspace_id = "222222222-2222-2222-2222-222222222222"
datasets = fabric.list_datasets(workspace_id)

# Print datasets
for dataset in datasets:
print(dataset)

SemPy documentation: https://learn.microsoft.com/en-us/python/api/semantic-link-sempy/sempy?view=semantic-link-python 

[ABI_Rufino]

You are not properly creating the Token Provider.

Try this on a Fabric Notebook:

from azure.identity import ClientSecretCredential
from sempy.fabric import FabricRestClient

# Service principal credentials
tenant_id = "11111111-1111-1111-1111-111111111111"
client_id = "aaaaaaaa-bbbb-bbbb-cccc-cccccccccccc"
client_secret = "aaaaaaaa-bbbb-bbbb-cccc-dddddddddddd"
workspace_id ='aaaaaaaa-bbbb-cccc-dddd-dddddddddddd'

# Create a token provider
class ServicePrincipalTokenProvider:
    def __init__(self, tenant_id, client_id, client_secret):
        self.credential = ClientSecretCredential(
            tenant_id=tenant_id,
            client_id=client_id,
            client_secret=client_secret
        )
        self.scope = "https://analysis.windows.net/powerbi/api/.default"

    def __call__(self):
        token = self.credential.get_token(self.scope)
        return token.token

token_provider = ServicePrincipalTokenProvider(tenant_id, client_id, client_secret)
client = FabricRestClient(token_provider=token_provider)

# Example REST call (e.g., list workspaces)
response = client.get("/v1/workspaces")
# print(response.json())

# Another example REST call (e.g., datasets on a workspace)
response = client.get(f"/v1/workspaces/{workspace_id}/items")
# print(response.json())

[PetyrBaelish]

Thanks. I will just run this script as an admin account - not ideal but looks like the best that can be done

[Anonymous]

Hi @PetyrBaelish ,

Did the above suggestions help with your scenario? if that is the case, you can consider Kudo or Accept the helpful suggestions to help others who faced similar requirements.

If these also don't help, please share more detailed information and description to help us clarify your scenario to test.

How to Get Your Question Answered Quickly 

Regards,

Xiaoxin Sheng

[Anonymous]

Hi @PetyrBaelish,

Perhaps you can tried to use azure keyvault to get the service principal credentials and use in notebook:

secret = mssparkutils.credentials.getSecret('https://key-vault-datasarva.vault.azure.net/', 'secret-value')

Using Azure Key Vault in Microsoft Fabric Notebooks
Regards,

Xiaoxin Sheng

[PetyrBaelish]

Hi @Anonymous 

I have incorporated your suggestion, meaning my client secret now looks like this:

client_secret = mssparkutils.credentials.getSecret('https://my-key-vault.vault.azure.net/', 'My-Secret-Name')

Unfortunately it hasn't worked. I think there's a complete disconnect between the authentication at the start of my script setting up my fabric client authentication, and the next code segment that calls the fabric.list_datasets method.

How can I connect the two, so that when fabric.list_datasets is called, it will use the authentication in the code above? At present its still using my account as my script works when I use a workspace ID that my account has access to, but fails when I use a workspace ID that my account does not have access to.

[Anonymous · Accepted solution]

HI @PetyrBaelish,

After I double checked these credentials that we provide in the notebook. It seems not really used for the sempy functions authorizations.

They only initialed for Fabric RestClient and corresponding functions uses. For the default sempy functions, they still invoked the current user credentials that notebook and its sessions cached.

Regards,

Xiaoxin Sheng