Dataflow Gen2 CI/CD Enabled – Refresh Fails for Non-Owner with Admin/Contributor Access

Hello Bhargava05,

When CI/CD (Git integration) is enabled in a Fabric workspace:

• The Dataflow Gen2 definition is versioned and stored as JSON in the Git repository.

• Connection credentials, however, are not stored in Git (for security reasons).

• The credentials are instead stored per user in the Fabric service layer.

👉 This means only the user who originally authenticated the data source (the dataflow owner) has valid credentials linked to that Git-bound dataflow instance.

Solutions : 

Option 1 – Re-authenticate the data source as the non-owner

1. Have the non-owner open the Dataflow Gen2 in Edit mode.

2. Go to Settings → Connections.

3. Select the data source → click Edit credentials.

4. Enter their own credentials and save.

🔹 Drawback: each admin/contributor must do this individually (credentials are not shared).

**Option 2 – Use a Service Principal (recommended)

If your source supports Azure AD App/Service Principal authentication (SQL, Lakehouse, OneLake, etc.):

1. Create a service principal in Entra ID.

2. Grant it access to the data source.

3. In the Dataflow connection → choose “Sign in with Service Principal”.

✅ Result: credentials are now tenant-level, not user-level, so any workspace admin can trigger refreshes successfully.

Hope it can help you !

Best regards,

Antoine