Forum Discussion
Connecting Fabric Data Agent via Service Principal or Managed Identities
I am trying to build a webapp hosted in azure, with the Fabric Data Agent as a part of it. Locally I used interactive browser authentication to retrieve the user token, but some sources online mentioned that such connection will not work while it's on web. Are there any other way to establish a user connection to fabric data agent from my app? Can we use service principal or Managed Identities for authentication?
Hi Anshid_K , Thank you for reaching out to the Microsoft Community Forum.
You're correct, this setup does conflict with user-level access control. And no, there is currently no supported way to generate or use user-specific tokens with the Fabric Data Agent. The agent only supports preconfigured connections using static credentials and does not support delegated authentication or identity passthrough from users.
If you need user-level access, it has to be enforced after the data reaches Fabric, for example, through row-level security (RLS) in Power BI or logic within Fabric workloads. The agent itself cannot enforce per-user access at the source.
How to access on-premises data sources in Data Factory - Microsoft Fabric | Microsoft Learn
Fabric data agent creation (preview) - Learn how to create a Fabric data agent | Microsoft Learn
Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn
12 Replies
v-hashadapuCommunity Support
HI Anshid_K , hope you are doing great. May we know if your issue is solved or if you are still experiencing difficulties. Please share the details as it will help the community, especially others with similar issues.
- v-hashadapu
Hi Anshid_K , Thank you for reaching out to the Microsoft Community Forum.
Relying on interactive browser authentication won’t work, it’s meant for local development, not production environments. In a deployed scenario, you’ll need to switch to a non-interactive authentication method.
If your web app runs on an Azure service like App Service or Azure Functions, using Managed Identity is the simplest and most secure approach. It avoids storing any credentials and integrates cleanly with Azure’s identity system. If Managed Identity isn’t available in your setup, you can use a Service Principal, just be sure to register the app in Azure AD, assign it the right API permissions and either configure a client secret or certificate for authentication.
Once your app has an identity, it needs to request an access token scoped to Microsoft Fabric. You can use the Azure Identity client library for Python | Microsoft Learn to do this. That token can then be used to call Fabric APIs or trigger workloads like dataflows, pipelines or notebooks.
For Fabric to accept calls from your app, make sure the service principal or managed identity has the right permissions in the Fabric workspace. Also, in the Fabric admin portal, you need to explicitly enable service principal access to APIs. Keep in mind that the Fabric Data Agent manages access to on-premises data sources and that access is controlled through credentials stored in the gateway connection, not from your web app directly.
Please refer:
Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn
Enable service principal authentication for admin APIs - Microsoft Fabric | Microsoft Learn
Hi v-hashadapu ,
Thank you for quick reply. But in another discussion: Solved: Does Fabric Data agent support Managed Identity or... - Microsoft Fabric Community, it is mentioned that the service principal connection feature is still not realeased. Can you clarify on this matter as well.- v-hashadapu
Hi Anshid_K , Thank you for reaching out to the Microsoft Community Forum.
Sorry for the confusion in my earlier answer. While service principals and managed identities can be used to authenticate your app to call Fabric REST APIs, for example, to trigger a pipeline or notebook, they cannot be used to establish a user connection through the Fabric Data Agent. The agent still relies entirely on credentials configured within the gateway connection itself and app identities can’t be delegated through it.
So please design your web app to authenticate using a service principal or managed identity, but instead of trying to directly access the on premises data, have it trigger a Fabric pipeline or notebook that uses a preconfigured gateway connection. That pipeline or notebook will then access the on-premises data through the agent using the stored credentials securely and within the current supported architecture. This avoids interactive login and keeps your solution production-ready.
- v-hashadapu
Hi Anshid_K , Hope you're doing fine. Can you confirm if the problem is solved or still persists? Sharing your details will help others in the community.
- v-hashadapu
Hi Anshid_K , Hope you're doing okay! May we know if it worked for you, or are you still experiencing difficulties? Let us know — your feedback can really help others in the same situation.
Hi v-hashadapu ,
My requirement is a bit different, but might have found a way around with OAuth and get_token() function to get user token from Power BI scope to access fabric agent. Still need to test it out- v-hashadapu
Hi Anshid_K , Thanks for the update. Please share your results here after testing.
It is possible to call the data agent from a web server using a user specific token.
In python, you can use the OnBehalfOfCredential class from azure identity to generate a user token for the fabric api :
credential = OnBehalfOfCredential(...,user_assertion)
token = credential.get_token("https://api.fabric.microsoft.com/.default").token
Then use that token to call the data agent via mcp.
user_assertion is a token you get from authenticating the user from the frontend with something like msal.
carter_gray705Advocate II
Yes, for a web app you can use Entra ID authentication. Use Authorization Code + PKCE when access needs to be on behalf of the user; Managed Identity or a service principal is better for app-only access.
