Forum Discussion
Fabric SharePoint Shortcut - Service Principle
Hi libpekin ,
Thank you for validating this in detail. Based on current Microsoft documentation, Service Principal app only authentication in Fabric and Power BI is mainly supported for REST APIs and specific scenarios, while SharePoint Online connectors rely on delegated user authentication with user context. Because of this, the initial connection using a Service Principal may succeed, but refresh operations on SharePoint files or folders can fail as they require delegated permissions.At present, there is no explicit Microsoft Learn document that directly states this limitation for Fabric SharePoint shortcuts, but the behavior aligns with how authentication is documented across these services, so this can be treated as a current limitation rather than a fully supported scenario.
please go through with the below document hope it may resolve your Issue:
Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn
Power BI Desktop OneDrive and SharePoint integration - Power BI | Microsoft Learn
Authentication vs. authorization - Microsoft identity platform | Microsoft Learn
Hope the above provided information help you resolve the issue, if you have any further concerns or queries, please feel free to reach out to us.
Regards,
Community Support Team.
Hi libpekin,
Thanks for sharing the details and screenshots. I ran into a similar issue before and can see what's happening here.
Even though your SPN has Microsoft Graph → Sites.ReadWrite.All granted (which looks correct in your screenshot), Fabric SharePoint Shortcuts require an additional SharePoint-specific API permission that is separate from Graph. That's most likely why you're seeing the "Invalid credentials" error.
Here's what worked for me:
**1. Add the SharePoint API Permission (separate from Graph)**
In Azure Portal → App Registrations → your app → API Permissions:
- Click Add a permission → choose SharePoint (not Microsoft Graph)
- Select Application permissions → Sites.ReadWrite.All
- Click Grant admin consent
Your final permissions should include both:
- Microsoft Graph → Sites.ReadWrite.All
- SharePoint → Sites.ReadWrite.All
**2. Enable App-Only Authentication on Your Tenant**
This step is often missed. Run the following as a SharePoint Global Admin:
```powershell
Connect-SPOService -Url "https://<tenant>-admin.sharepoint.com"
Set-SPOTenant -DisableCustomAppAuthentication $false
```
**3. Grant the SPN Direct Access to the SharePoint Site**
Azure AD permissions alone are not enough — the SPN also needs to be added directly at the site level:
```powershell
Set-SPOUser -Site "https://<tenant>.sharepoint.com/sites/<your-site>" `
-LoginName "i:0#.f|membership|<app-client-id>@<tenant-id>" `
-IsSiteCollectionAdmin $true
```
**4. Double-check the SharePoint URL Format**
Make sure the URL in the connection settings follows this exact format with no trailing slash:
```
https://<tenant>.sharepoint.com/sites/<site-name>
```
**Why does it work in some tools but not Fabric Shortcuts?**
Fabric's SharePoint shortcut connector talks directly to the SharePoint REST API, not through Microsoft Graph. SharePoint has its own authorization layer. so even if Graph permissions are in place, SharePoint can still reject the SPN unless it's explicitly registered at both the tenant and site level.
If you find this response helpful, kindly consider marking it as the accepted solution and giving it some kudos. This helps others facing similar issues and is greatly appreciated.
Good luck! 🙌