Short answer: no, not directly.
Fabric GraphQL endpoints are not public/no-auth endpoints. Microsoft’s documentation states that applications connecting to Fabric API for GraphQL must use Microsoft Entra ID authentication, and the caller then needs the required permissions on the GraphQL API and underlying data source.
So the endpoint cannot be consumed with just the URL, a Fabric workspace permission, or a simple unauthenticated request.
If the external system cannot implement Entra authentication directly, the supported pattern would be to put something in front of Fabric, for example Azure API Management or an Azure Function / custom API.
Example pattern:
External system
→ calls your API / APIM endpoint, possibly with API key or another auth method
→ your API / APIM authenticates to Fabric using Entra ID / managed identity / service principal
→ Fabric GraphQL is called securely
Microsoft also documents APIM integration with Fabric API for GraphQL, including managed identity authentication.
So you can hide the Entra flow from the external system by using a proxy/gateway, but the backend call to Fabric still needs Entra authentication.
I would not treat service accounts, public endpoints, or API keys as a supported direct replacement for Entra authentication against the Fabric GraphQL endpoint.
References:
Best regards
Solutions Architect - Microsoft Fabric Specialist - Parchitect
💡Did my response help you? Clicking Kudos is a small gesture that goes a long way, it encourages contributors and helps the community thrive!
✔️Did I answer your question? Please mark my post as a Solution, it helps others find the answer faster.
