Forum Discussion
Service Principal Git Integration Fails When Added via AD Group but Works with Direct Assignment
Issue Title:
Service Principal Git Integration Fails When Added via AD Group but Works with Direct Assignment
Issue Description:
When attempting to integrate Azure Fabric with Azure DevOps using a service principal that is a member of an AD security group, the Git integration fails to authenticate. However, when the same service principal is added directly to the Fabric workspace, the integration works successfully.
Steps Taken:
- Created service principal in Azure AD
- Added service principal to AD security group
- Assigned AD group as Admin in Fabric workspace
- Configured Azure DevOps connection in Fabric
- Attempted Git integration → Failed
- Removed AD group, added service principal directly → Succeeded
Questions:
- What is the technical reason for this difference?
- Is this a known limitation of Azure Fabric?
- What does Microsoft officially recommend?
- Where is this documented in official Microsoft resources?
Desired Resolution:
Clarification on the correct approach and official Microsoft documentation supporting the recommendation
Thankyou GilbertQ for Addressing the issue.
Hi chiranjeevira07 ,Thank you for reaching out to Microsoft Fabric Community Forum,Based on the information provided, please verify the following steps.
- Ensure the service principal is added directly to the Fabric workspace and has the required workspace role Admin Access.
- Verify that the Azure DevOps cloud connection is configured correctly and is associated with the same service principal.
- Confirm that Git integration is configured using the supported service principal authentication method.
From your testing, the service principal works when added directly to the workspace but fails when its access is inherited through a Microsoft Entra ID (Azure AD) security group. At this time, Microsoft documentation does not explicitly state whether this scenario is supported or unsupported.
For reference, you can review the following Microsoft documentation:
- Git Integration with Service Principal - Microsoft Fabric | Microsoft Learn
- Automate git integration with a service principal in Azure DevOps - Microsoft Fabric | Microsoft Learn
- Get started with Git integration - Microsoft Fabric | Microsoft Learn
If the issue continues even after verifying the above, please the Activity ID, Request ID, Correlation ID, Timestamp (UTC), Workspace ID, and Tenant ID, along with screenshots of the error and raise a support ticket
Thanks,
Chaithanya.
6 Replies
while this is not official, I have typically always added the service principal account directly to a workspace role for every workspace which typically has all worked successfully. I have then used a notebook, but rather than a daily basis to add this service principle to any newly created workspaces
Thankyou GilbertQ for Addressing the issue.
Hi chiranjeevira07 ,Thank you for reaching out to Microsoft Fabric Community Forum,Based on the information provided, please verify the following steps.
- Ensure the service principal is added directly to the Fabric workspace and has the required workspace role Admin Access.
- Verify that the Azure DevOps cloud connection is configured correctly and is associated with the same service principal.
- Confirm that Git integration is configured using the supported service principal authentication method.
From your testing, the service principal works when added directly to the workspace but fails when its access is inherited through a Microsoft Entra ID (Azure AD) security group. At this time, Microsoft documentation does not explicitly state whether this scenario is supported or unsupported.
For reference, you can review the following Microsoft documentation:
- Git Integration with Service Principal - Microsoft Fabric | Microsoft Learn
- Automate git integration with a service principal in Azure DevOps - Microsoft Fabric | Microsoft Learn
- Get started with Git integration - Microsoft Fabric | Microsoft Learn
If the issue continues even after verifying the above, please the Activity ID, Request ID, Correlation ID, Timestamp (UTC), Workspace ID, and Tenant ID, along with screenshots of the error and raise a support ticket
Thanks,
Chaithanya.
Based on the behavior you've described, this appears to be expected in the current implementation rather than an issue with your configuration.
Git integration in Microsoft Fabric validates the identity performing the Git operations. In some scenarios, permissions inherited through Microsoft Entra ID (Azure AD) security groups are not recognized for service principal authentication, whereas direct workspace assignment is. This is why adding the service principal directly as a Workspace Admin allows the authentication to succeed.
If this behavior is affecting your workflow, the recommended approach is to assign the service principal directly to the Fabric workspace until Microsoft announces support for group-based authorization in this scenario.
I'd also recommend checking the latest Microsoft Fabric documentation and, if you can't find this behavior documented, opening a Microsoft Support ticket or waiting for confirmation from the Fabric product team, as they can clarify whether this is a known limitation or a product bug.
Has anyone else successfully configured Git integration using a service principal that only has permissions through a Microsoft Entra security group? It would be great to know if there are any supported workarounds or recent updates.
hey chiranjeevira07 very interesting finding you have found there.
This behavior is likely a limitation in Fabric Git integration permission since I couldn't find Microsoft documentation that explicitly says service principals must be assigned directly rather than via an Entra ID group. However, based on your testing, direct assignment works while group-based assignment does not.
https://learn.microsoft.com/en-us/fabric/cicd/git-integration/git-integration-with-service-principal
For now let's stick to direct assignment and raise this to MSFT v-kathullac 🙂
Appreciate if you can "Kudos" and/or "Accept as Solution" if this answered your query.
Thankyou rizalard0684 , Prince0011 , GilbertQ for Addressing the issue.
Hi chiranjeevira07 ,
Thank you for reaching out to Microsoft Fabric Community Forum,
As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for the issue worked? or Let us know if you need any further assistance?
Regards,
Chaithanya
Thankyou @rizalard0684 , @Prince0011 , @GilbertQ for Addressing the issue.
Hi @chiranjeevira07 ,
Thank you for reaching out to Microsoft Fabric Community Forum,
As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for the issue worked? or Let us know if you need any further assistance?
Regards,
Chaithanya
