Forum Discussion
Dataflow Gen2 CI/CD Enabled – Refresh Fails for Non-Owner with Admin/Contributor Access
Hello Bhargava05,
When CI/CD (Git integration) is enabled in a Fabric workspace:
The Dataflow Gen2 definition is versioned and stored as JSON in the Git repository.
Connection credentials, however, are not stored in Git (for security reasons).
The credentials are instead stored per user in the Fabric service layer.
👉 This means only the user who originally authenticated the data source (the dataflow owner) has valid credentials linked to that Git-bound dataflow instance.
Solutions :
Option 1 – Re-authenticate the data source as the non-owner
Have the non-owner open the Dataflow Gen2 in Edit mode.
Go to Settings → Connections.
Select the data source → click Edit credentials.
Enter their own credentials and save.
🔹 Drawback: each admin/contributor must do this individually (credentials are not shared).
**Option 2 – Use a Service Principal (recommended)
If your source supports Azure AD App/Service Principal authentication (SQL, Lakehouse, OneLake, etc.):
Create a service principal in Entra ID.
Grant it access to the data source.
In the Dataflow connection → choose “Sign in with Service Principal”.
✅ Result: credentials are now tenant-level, not user-level, so any workspace admin can trigger refreshes successfully.
Hope it can help you !
Best regards,
Antoine
Hello Bhargava05,
When CI/CD (Git integration) is enabled in a Fabric workspace:
The Dataflow Gen2 definition is versioned and stored as JSON in the Git repository.
Connection credentials, however, are not stored in Git (for security reasons).
The credentials are instead stored per user in the Fabric service layer.
👉 This means only the user who originally authenticated the data source (the dataflow owner) has valid credentials linked to that Git-bound dataflow instance.
Solutions :
Option 1 – Re-authenticate the data source as the non-owner
Have the non-owner open the Dataflow Gen2 in Edit mode.
Go to Settings → Connections.
Select the data source → click Edit credentials.
Enter their own credentials and save.
🔹 Drawback: each admin/contributor must do this individually (credentials are not shared).
**Option 2 – Use a Service Principal (recommended)
If your source supports Azure AD App/Service Principal authentication (SQL, Lakehouse, OneLake, etc.):
Create a service principal in Entra ID.
Grant it access to the data source.
In the Dataflow connection → choose “Sign in with Service Principal”.
✅ Result: credentials are now tenant-level, not user-level, so any workspace admin can trigger refreshes successfully.
Hope it can help you !
Best regards,
Antoine
I can see why this is an accepted solution. But it's not working in my tennant. When configuring a lakehouse connection in a Dataflow Gen2 (CI/CD) (same workspace) , the only option to choose from is "organizational account".
I have a service principal with access to the lakehouse. The service principal is used (and working) in semantic models connecting to the same lakehouse.
When trying to make a new connection under Manage Connections and Gateways > New > Cloud > connection type: Lakehouse I only have the option "OAuth 2.0" available.Help or suggestions are welcome!
Hi arjaano ,
Thank you for reaching out to the Microsoft Community Forum.
As mentioned in your previous response, while configuring a lakehouse connection in a Dataflow Gen2 (CI/CD) (same workspace) , the only option to choose from is "organizational account". Thank you for your information, it will help other community members.
Set up your Lakehouse connection - Microsoft Fabric | Microsoft Learn
Regards,
Dinesh
