Forum Discussion
Connecting Fabric Data Agent via Service Principal or Managed Identities
Hi Anshid_K , Thank you for reaching out to the Microsoft Community Forum.
You're correct, this setup does conflict with user-level access control. And no, there is currently no supported way to generate or use user-specific tokens with the Fabric Data Agent. The agent only supports preconfigured connections using static credentials and does not support delegated authentication or identity passthrough from users.
If you need user-level access, it has to be enforced after the data reaches Fabric, for example, through row-level security (RLS) in Power BI or logic within Fabric workloads. The agent itself cannot enforce per-user access at the source.
How to access on-premises data sources in Data Factory - Microsoft Fabric | Microsoft Learn
Fabric data agent creation (preview) - Learn how to create a Fabric data agent | Microsoft Learn
Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn
Hi v-hashadapu ,
Thank you for quick reply. But in another discussion: Solved: Does Fabric Data agent support Managed Identity or... - Microsoft Fabric Community, it is mentioned that the service principal connection feature is still not realeased. Can you clarify on this matter as well.
Community SupportHi Anshid_K , Thank you for reaching out to the Microsoft Community Forum.
Sorry for the confusion in my earlier answer. While service principals and managed identities can be used to authenticate your app to call Fabric REST APIs, for example, to trigger a pipeline or notebook, they cannot be used to establish a user connection through the Fabric Data Agent. The agent still relies entirely on credentials configured within the gateway connection itself and app identities can’t be delegated through it.
So please design your web app to authenticate using a service principal or managed identity, but instead of trying to directly access the on premises data, have it trigger a Fabric pipeline or notebook that uses a preconfigured gateway connection. That pipeline or notebook will then access the on-premises data through the agent using the stored credentials securely and within the current supported architecture. This avoids interactive login and keeps your solution production-ready.
Thanks v-hashadapu for addressing the issue. This was a solution we had in mind. But this conflicts the idea of user level access management since we are using a pre configured connection with a fixed privileges. Is there any way to generate user specific tokens to interact with fabric data agent?
- v-hashadapu
Hi Anshid_K , Thank you for reaching out to the Microsoft Community Forum.
You're correct, this setup does conflict with user-level access control. And no, there is currently no supported way to generate or use user-specific tokens with the Fabric Data Agent. The agent only supports preconfigured connections using static credentials and does not support delegated authentication or identity passthrough from users.
If you need user-level access, it has to be enforced after the data reaches Fabric, for example, through row-level security (RLS) in Power BI or logic within Fabric workloads. The agent itself cannot enforce per-user access at the source.
How to access on-premises data sources in Data Factory - Microsoft Fabric | Microsoft Learn
Fabric data agent creation (preview) - Learn how to create a Fabric data agent | Microsoft Learn
Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn