undefined

Hi rjmsft,

The certificate used for Service Principal + certificate authentication does not have to be created by a specific AME or PME account. The certificate is linked to the App Registration (SPN) itself, not to the user who creates it. From Azure’s perspective, the key points are:

The certificate must be uploaded to SPN - Certificates & secrets - Certificates, and

The authentication process uses the matching private key for that certificate.

This means either AME or PME can generate the certificate, as successful authentication only requires the certificate to be stored on the SPN.

If there are conditional-access or governance policies in your organization about who can manage App Registrations, those are internal policies, not requirements from Fabric or Azure. Use whichever account type your security team allows for managing the SPN.

I understand that when you said you cannot use MI, you meant the Fabric Workspace Identity, not that MI is generally blocked. In this case, the SPN + certificate method is the supported secret-less approach currently, since Fabric does not yet allow using Federated Identity Credentials (FIC) to assume SPNs.

Microsoft identity platform certificate credentials - Microsoft identity platform | Microsoft Learn
Create a self-signed public certificate to authenticate your application - Microsoft identity platform | Microsoft Learn
Embed Power BI content in a Power BI embedded analytics application with service principal and a certificate - Power BI | Microsoft Learn
Microsoft Entra Authentication in Fabric Data Warehouse - Microsoft Fabric | Microsoft Learn
Service principal support in Data Factory - Microsoft Fabric | Microsoft Learn

Thank you.