Forum Discussion
Service Principal Git Integration Fails When Added via AD Group but Works with Direct Assignment
- 1 month ago
Thankyou GilbertQ for Addressing the issue.
Hi chiranjeevira07 ,Thank you for reaching out to Microsoft Fabric Community Forum,Based on the information provided, please verify the following steps.
- Ensure the service principal is added directly to the Fabric workspace and has the required workspace role Admin Access.
- Verify that the Azure DevOps cloud connection is configured correctly and is associated with the same service principal.
- Confirm that Git integration is configured using the supported service principal authentication method.
From your testing, the service principal works when added directly to the workspace but fails when its access is inherited through a Microsoft Entra ID (Azure AD) security group. At this time, Microsoft documentation does not explicitly state whether this scenario is supported or unsupported.
For reference, you can review the following Microsoft documentation:
- Git Integration with Service Principal - Microsoft Fabric | Microsoft Learn
- Automate git integration with a service principal in Azure DevOps - Microsoft Fabric | Microsoft Learn
- Get started with Git integration - Microsoft Fabric | Microsoft Learn
If the issue continues even after verifying the above, please the Activity ID, Request ID, Correlation ID, Timestamp (UTC), Workspace ID, and Tenant ID, along with screenshots of the error and raise a support ticket
Thanks,
Chaithanya.
hey chiranjeevira07 very interesting finding you have found there.
This behavior is likely a limitation in Fabric Git integration permission since I couldn't find Microsoft documentation that explicitly says service principals must be assigned directly rather than via an Entra ID group. However, based on your testing, direct assignment works while group-based assignment does not.
https://learn.microsoft.com/en-us/fabric/cicd/git-integration/git-integration-with-service-principal
For now let's stick to direct assignment and raise this to MSFT v-kathullac 🙂
Appreciate if you can "Kudos" and/or "Accept as Solution" if this answered your query.