Forum Discussion
Fabric SharePoint Shortcut - Service Principle
Hello,
I'm attempting to create a SharePoint shortcut using service principle and I'm running into the error below. The SPN is configured in Azure to use Graph with Sites.ReadWrite.All access. Thanks for your help!
Hi libpekin ,
Thank you for validating this in detail. Based on current Microsoft documentation, Service Principal app only authentication in Fabric and Power BI is mainly supported for REST APIs and specific scenarios, while SharePoint Online connectors rely on delegated user authentication with user context. Because of this, the initial connection using a Service Principal may succeed, but refresh operations on SharePoint files or folders can fail as they require delegated permissions.At present, there is no explicit Microsoft Learn document that directly states this limitation for Fabric SharePoint shortcuts, but the behavior aligns with how authentication is documented across these services, so this can be treated as a current limitation rather than a fully supported scenario.
please go through with the below document hope it may resolve your Issue:
Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn
Power BI Desktop OneDrive and SharePoint integration - Power BI | Microsoft Learn
Authentication vs. authorization - Microsoft identity platform | Microsoft Learn
Hope the above provided information help you resolve the issue, if you have any further concerns or queries, please feel free to reach out to us.
Regards,
Community Support Team.
13 Replies
Hi libpekin,
Thanks for sharing the details and screenshots. I ran into a similar issue before and can see what's happening here.
Even though your SPN has Microsoft Graph → Sites.ReadWrite.All granted (which looks correct in your screenshot), Fabric SharePoint Shortcuts require an additional SharePoint-specific API permission that is separate from Graph. That's most likely why you're seeing the "Invalid credentials" error.
Here's what worked for me:
**1. Add the SharePoint API Permission (separate from Graph)**
In Azure Portal → App Registrations → your app → API Permissions:
- Click Add a permission → choose SharePoint (not Microsoft Graph)
- Select Application permissions → Sites.ReadWrite.All
- Click Grant admin consent
Your final permissions should include both:
- Microsoft Graph → Sites.ReadWrite.All
- SharePoint → Sites.ReadWrite.All
**2. Enable App-Only Authentication on Your Tenant**
This step is often missed. Run the following as a SharePoint Global Admin:
```powershell
Connect-SPOService -Url "https://<tenant>-admin.sharepoint.com"
Set-SPOTenant -DisableCustomAppAuthentication $false
```
**3. Grant the SPN Direct Access to the SharePoint Site**
Azure AD permissions alone are not enough — the SPN also needs to be added directly at the site level:
```powershell
Set-SPOUser -Site "https://<tenant>.sharepoint.com/sites/<your-site>" `
-LoginName "i:0#.f|membership|<app-client-id>@<tenant-id>" `
-IsSiteCollectionAdmin $true
```
**4. Double-check the SharePoint URL Format**
Make sure the URL in the connection settings follows this exact format with no trailing slash:
```
https://<tenant>.sharepoint.com/sites/<site-name>
```
**Why does it work in some tools but not Fabric Shortcuts?**
Fabric's SharePoint shortcut connector talks directly to the SharePoint REST API, not through Microsoft Graph. SharePoint has its own authorization layer. so even if Graph permissions are in place, SharePoint can still reject the SPN unless it's explicitly registered at both the tenant and site level.
If you find this response helpful, kindly consider marking it as the accepted solution and giving it some kudos. This helps others facing similar issues and is greatly appreciated.
Good luck! 🙌
Lodha_Jaydeep thank you for your reply. After I tried, here's my feedback:
All steps worked until I got to "Enable App-Only Auth" then nothing worked after that.
Set-SPOTenant -DisableCustomAppAuthentication $false - false with error: updating DisableCustomAppAuthentication is not allowed anymore for new tenants. This is part of Azure ACS feature retirement.
And the other SharePoint steps did not work, I'm guessing, as a result of DisableCustomAppAuthentication $false, no longer being supportedHi libpekin,
Thank you for trying the steps outlined earlier.
As an additional validation, could you please try creating a test shortcut using your Organizational (domain) account instead of the Service Principal? This will help us confirm whether the issue is related to Service Principal limitations or something else, rather than a permissions-related problem.
Please let me know the outcome, and I’ll be happy to assist further.
Lodha_Jaydeep Yes, I am able to create shortcuts using my Organizational (domain) account (Entra ID) to the same SharePoint Online sites without issues. I tested 3 sites, with success.
Lodha_Jaydeep was your solution implemented with harepoint server or sharepoint online. I'm attempting to shortcut to sharepoint online. Other documents suggest, for sharepoint online, to use the Microsoft Graph Explorer to grant the SPN sharepoint permissions. Just curious.
Based on your confirmation, the shortcut was successfully created using an Organizational (user) account, but not with a Service Principal. Also, my solution was implemented for the sharepoint online.
I have also tested this on my end and observed the same behavior.
For the Service Principal setup, admin consent is required, which will need to be granted by IT administrator. In the meantime, I recommend adding the required SharePoint API permissions and then testing again to see if the issue persists (for example, if it still returns an invalid credentials error).
Please let me know the outcome once you have tried this.
Hi libpekin,
Here's a blog post that might be helpful: https://heyniels.com/2026/03/15/connect-fabric-to-sharepoint-after-the-acs-retirement/
Hi libpekin,
Thanks for checking all the steps and sharing your results.
From what you tested, it is clear that everything works fine with your user account, but only failing when using Service Principal. So this is not a permission issue from your side.
The main reason here is the older method using ACS (App-only auth) is no longer supported for new tenants. That’s why the command to enable it is failing, and because of that the SharePoint-side access steps also won’t work.
As of now, Fabric SharePoint shortcuts are working properly with user (Entra ID) login, but Service Principal support for SharePoint Online is not fully supported in this scenario with the current setup.
That’s why even after giving all permissions, it still shows invalid credentials. So for now, you can continue using your Organizational account to create the shortcut. Your setup looks correct, nothing wrong from your end.
If you get any update after trying the blog shared earlier, please share here, it will help others also.
Regards,
Community Support Team.
