undefined

[rjmsft]

Hello,
I'm working with an Azure Fabric workspace and need to connect to various data sources (e.g., Azure Storage, SQL Databases, etc.) using a Service Principal (SPN) for authentication. However, I cannot use Managed Identities (MI) or secrets (due to organizational restrictions), and I’m not allowed to store credentials or manage secrets directly.

I’ve heard that Federated Identity Credentials (FIC) can allow SPNs to authenticate via Managed Identity (MI), but I am unsure how to configure it properly in Azure Fabric to connect to the data sources without relying on secrets.

Specific requirements:
Use SPN for authentication (as Managed Identity is not an option as Data owners allow access only on SPN not WSIs/MIs).

No secrets should be used for authentication or storage.

Access data sources in Azure Fabric workspace securely using the SPN.

Ideally, I want to leverage Federated Identity Credential (FIC) to authenticate using Managed Identity while bypassing secrets.

Has anyone implemented this setup in Azure Fabric or can you guide me on how to:

Set up Federated Identity Credentials for an SPN.

Grant the SPN access to Azure data sources.

Connect to these data sources from Azure Fabric using the SPN without requiring secrets.

Thanks for your help!

[v-sgandrathi]

Hi @rjmsft,

Just looping back one last time to check if everything's good on your end. Let me know if you need any final support happy to assist if anything’s still open.

Thank you.

[v-sgandrathi]

Hi @rjmsft,

Just wanted to follow up and confirm that everything has been going well on this. Please let me know if there’s anything from our end.
Please feel free to reach out Microsoft fabric community forum.

Thank you
Sahasra.

[v-sgandrathi]

Hi @rjmsft,

Thanks for your question. To clarify the current platform behavior, Azure Fabric does not support using Federated Identity Credentials (FIC) for Service Principals. Fabric runtimes cannot perform the OIDC token-exchange required for FIC, so an SPN cannot be assumed through FIC inside Notebooks, Pipelines, or Lakehouse engines.

Given your restrictions (no Managed Identities and no secrets), the only supported “secret-less” option today is certificate-based authentication for the SPN. You can upload a certificate to the SPN in Entra ID and use it in Fabric through the Azure Identity SDK. This method is supported in Notebooks, custom code, and partially in Dataflows Gen2.

You can then assign RBAC roles to the SPN on Storage, SQL, or other sources as usual. The certificate simply replaces secrets and enables the SPN to authenticate securely without storing credentials in plain text.

At this time, Fabric does not support FIC-based authentication, so SPN + certificate is the recommended approach for secure, secret-less access.

Thank you.

[rjmsft]

Hi @v-sgandrathi  , Thanks for your response ! Do you have any documentation that could help with SPN +Certificate approach? Is certificate required to be created with AME account or it needs a PME account? It seems the data owners have a condiitonal policy enabled and they check this. Anyways I can check with both of them if I have any documentation to try it out with. Also whem I said I can't use MI I meant Fabrics Workspace Identity

[v-sgandrathi · Accepted solution]

Hi @rjmsft,

The certificate used for Service Principal + certificate authentication does not have to be created by a specific AME or PME account. The certificate is linked to the App Registration (SPN) itself, not to the user who creates it. From Azure’s perspective, the key points are:

The certificate must be uploaded to SPN - Certificates & secrets - Certificates, and

The authentication process uses the matching private key for that certificate.

This means either AME or PME can generate the certificate, as successful authentication only requires the certificate to be stored on the SPN.

If there are conditional-access or governance policies in your organization about who can manage App Registrations, those are internal policies, not requirements from Fabric or Azure. Use whichever account type your security team allows for managing the SPN.

I understand that when you said you cannot use MI, you meant the Fabric Workspace Identity, not that MI is generally blocked. In this case, the SPN + certificate method is the supported secret-less approach currently, since Fabric does not yet allow using Federated Identity Credentials (FIC) to assume SPNs.

Microsoft identity platform certificate credentials - Microsoft identity platform | Microsoft Learn
Create a self-signed public certificate to authenticate your application - Microsoft identity platfo...
Embed Power BI content in a Power BI embedded analytics application with service principal and a cer...
Microsoft Entra Authentication in Fabric Data Warehouse - Microsoft Fabric | Microsoft Learn
Service principal support in Data Factory - Microsoft Fabric | Microsoft Learn

Thank you.

[v-sgandrathi]

Hi @rjmsft,

As we have not received a response from you yet, I would like to confirm whether you have successfully resolved the issue or if you require further assistance.

Thankyou.

[Vinodh247]

You cannot configure a Federated Identity Credential on your SPN and expect Fabric Notebooks, Pipelines, or Lakehouse engines to automatically exchange tokens on behalf of your SPN. The runtime does not support this flow today.

Current workarounds...

1. Use a MI on supporting components (like Data Pipeline Copy Activity via Data Gateway + MI) and ask data owners to grant that MI access. ---> You said this is not allowed.

2. Use certificate based authentication for the SPN: This avoids secrets. Certificates are allowed in strict orgs.
   Fabric supports SPN + certificate in Notebook (via Azure Identity SDK), in Dataflows Gen2 (limited), and in custom code.

3. Use keyvault with kevault MI, --> but you said secrets are not allowed for storage.

4. Use external compute (ADF, synapse, func app) that supports federated identity and hand over data to Fabric via ingestion endpoints.

So the bottom line guidance is...

• Federated Identity Credential cannot be used directly in Fabric today.
• Fabric cannot assume an SPN via FIC.
• Your only secretless SPN option today is certificate-based authentication.
• Configure the SPN with a certificate, assign RBAC to Storage / SQL, and use the Azure Identity SDK inside Fabric Notebooks or Spark to authenticate.
Example: ClientCertificateCredential(tenant_id, client_id, cert_path)