Forum Discussion

Anshid_K's avatar
Anshid_K
Regular Visitor
1 year ago
Solved

Connecting Fabric Data Agent via Service Principal or Managed Identities

I am trying to build a webapp hosted in azure, with the Fabric Data Agent as a part of it. Locally I used interactive browser authentication to retrieve the user token, but some sources online mentio...
Data Agent
data science
v-hashadapu's avatar
v-hashadapu
Icon for Community Support rankCommunity Support
1 year ago

Hi Anshid_K , Thank you for reaching out to the Microsoft Community Forum.

 

Relying on interactive browser authentication won’t work, it’s meant for local development, not production environments. In a deployed scenario, you’ll need to switch to a non-interactive authentication method.

 

If your web app runs on an Azure service like App Service or Azure Functions, using Managed Identity is the simplest and most secure approach. It avoids storing any credentials and integrates cleanly with Azure’s identity system. If Managed Identity isn’t available in your setup, you can use a Service Principal, just be sure to register the app in Azure AD, assign it the right API permissions and either configure a client secret or certificate for authentication.

 

Once your app has an identity, it needs to request an access token scoped to Microsoft Fabric. You can use the Azure Identity client library for Python | Microsoft Learn to do this. That token can then be used to call Fabric APIs or trigger workloads like dataflows, pipelines or notebooks.

 

For Fabric to accept calls from your app, make sure the service principal or managed identity has the right permissions in the Fabric workspace. Also, in the Fabric admin portal, you need to explicitly enable service principal access to APIs. Keep in mind that the Fabric Data Agent manages access to on-premises data sources and that access is controlled through credentials stored in the gateway connection, not from your web app directly.

 

Please refer:

Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn

Enable service principal authentication for admin APIs - Microsoft Fabric | Microsoft Learn

Embed Power BI content in an embedded analytics application with service principal and an application secret - Power BI | Microsoft Learn

  • v-hashadapu's avatar
    v-hashadapu
    Icon for Community Support rankCommunity Support
    1 year ago

    Hi Anshid_K , Thank you for reaching out to the Microsoft Community Forum.

     

    Sorry for the confusion in my earlier answer. While service principals and managed identities can be used to authenticate your app to call Fabric REST APIs, for example, to trigger a pipeline or notebook, they cannot be used to establish a user connection through the Fabric Data Agent. The agent still relies entirely on credentials configured within the gateway connection itself and app identities can’t be delegated through it.

     

    So please design your web app to authenticate using a service principal or managed identity, but instead of trying to directly access the on premises data, have it trigger a Fabric pipeline or notebook that uses a preconfigured gateway connection. That pipeline or notebook will then access the on-premises data through the agent using the stored credentials securely and within the current supported architecture. This avoids interactive login and keeps your solution production-ready.