Service Principal for Semantic model Refresh Issue

[JibinSebastian]

Hi All,
We are trying to set up a service principal for semantic model refresh. We have created the service principal ID, a security group, and added the service principal to all the required workspaces.

However, when we try to create a new connection for the semantic model to the Gold Fabric Warehouse using the service principal, we encounter the following error:

“Unable to create connection for the following reason: It looks like the refresh token expired. Please go to this dataset’s settings page and re-enter the credentials for the data source.”

Are we missing something in the setup?

Specifically, what value should be provided in the Service Principal ID field?

Could someone help me understand the correct way to configure this? I am new to Fabric and currently managing Fabric on my own in the organization. We do have a tenant admin who has already created the service principal.

[ssrithar]

Hi @JibinSebastian ,

Please find the steps to Fix the issue

1. Recreate the connection:

   • Go to the workspace → Create new connection

   • Use:

     • Tenant ID = Directory ID

     • Service Principal ID = Application (Client) ID

     • Service Principal Key = Client secret value

2. Verify permissions:

   • The SP must be assigned to the workspace (Contributor or Member role)

   • Ensure the SP is allowed under tenant settings:
     Admin portal → Tenant settings → Service principals

3. Use the SP to bind the semantic model:

   • When using the SP for scheduled refresh, make sure it’s added as a Gateway Connection credential (if applicable).

---

If everything is configured correctly and the token issue persists, you might also want to:

• Generate a new client secret

• Clear and reconfigure the connection using updated credentials

If this post helps, then please appreciate giving a Kudos or accepting as a Solution to help the other members find it more quickly.
If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

[deborshi_nag]

Hi @JibinSebastian 

You would have to enter the Application (Client) ID of the Azure AD app registration you created (not the object ID).
This is exactly what “Service principal ID” refers to in the UI. 

So you should have:

• Tenant ID = Directory ID from Azure AD
• Service Principal ID = Application (Client) ID
• Service Principal Key = the client secret under Certificates & secrets

Your tenant admin who has created the service pricipal SPN for you should have shared the client secret already. 

Hope this helps - please appreciate by leaving a Kudos or accepting as a Solution!