Connecting Fabric Data Agent via Service Principal or Managed Identities

[Anshid_K]

I am trying to build a webapp hosted in azure, with the Fabric Data Agent as a part of it. Locally I used interactive browser authentication to retrieve the user token, but some sources online mentioned that such connection will not work while it's on web. Are there any other way to establish a user connection to fabric data agent from my app? Can we use service principal or Managed Identities for authentication?

[v-hashadapu]

Hi @Anshid_K , Hope you're doing okay! May we know if it worked for you, or are you still experiencing difficulties? Let us know — your feedback can really help others in the same situation.

[v-hashadapu]

Hi @Anshid_K , Hope you're doing fine. Can you confirm if the problem is solved or still persists? Sharing your details will help others in the community.

[v-hashadapu]

HI @Anshid_K , hope you are doing great. May we know if your issue is solved or if you are still experiencing difficulties. Please share the details as it will help the community, especially others with similar issues.

[v-hashadapu]

Hi @Anshid_K , Thank you for reaching out to the Microsoft Community Forum.

Relying on interactive browser authentication won’t work, it’s meant for local development, not production environments. In a deployed scenario, you’ll need to switch to a non-interactive authentication method.

If your web app runs on an Azure service like App Service or Azure Functions, using Managed Identity is the simplest and most secure approach. It avoids storing any credentials and integrates cleanly with Azure’s identity system. If Managed Identity isn’t available in your setup, you can use a Service Principal, just be sure to register the app in Azure AD, assign it the right API permissions and either configure a client secret or certificate for authentication.

Once your app has an identity, it needs to request an access token scoped to Microsoft Fabric. You can use the Azure Identity client library for Python | Microsoft Learn to do this. That token can then be used to call Fabric APIs or trigger workloads like dataflows, pipelines or notebooks.

For Fabric to accept calls from your app, make sure the service principal or managed identity has the right permissions in the Fabric workspace. Also, in the Fabric admin portal, you need to explicitly enable service principal access to APIs. Keep in mind that the Fabric Data Agent manages access to on-premises data sources and that access is controlled through credentials stored in the gateway connection, not from your web app directly.

Please refer:

Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn

Enable service principal authentication for admin APIs - Microsoft Fabric | Microsoft Learn

Embed Power BI content in an embedded analytics application with service principal and an applicatio...

[Anshid_K]

Hi @v-hashadapu ,

Thank you for quick reply. But in another discussion: Solved: Does Fabric Data agent support Managed Identity or... - Microsoft Fabric Community, it is mentioned that the service principal connection feature is still not realeased. Can you clarify on this matter as well.

[v-hashadapu]

Hi @Anshid_K , Thank you for reaching out to the Microsoft Community Forum.

Sorry for the confusion in my earlier answer. While service principals and managed identities can be used to authenticate your app to call Fabric REST APIs, for example, to trigger a pipeline or notebook, they cannot be used to establish a user connection through the Fabric Data Agent. The agent still relies entirely on credentials configured within the gateway connection itself and app identities can’t be delegated through it.

So please design your web app to authenticate using a service principal or managed identity, but instead of trying to directly access the on premises data, have it trigger a Fabric pipeline or notebook that uses a preconfigured gateway connection. That pipeline or notebook will then access the on-premises data through the agent using the stored credentials securely and within the current supported architecture. This avoids interactive login and keeps your solution production-ready.

[Anshid_K]

Thanks @v-hashadapu  for addressing the issue. This was a solution we had in mind. But this conflicts the idea of user level access management since we are using a pre configured connection with a fixed privileges. Is there any way to generate user specific tokens to interact with fabric data agent?

[v-hashadapu · Accepted solution]

Hi @Anshid_K , Thank you for reaching out to the Microsoft Community Forum.

You're correct, this setup does conflict with user-level access control. And no, there is currently no supported way to generate or use user-specific tokens with the Fabric Data Agent. The agent only supports preconfigured connections using static credentials and does not support delegated authentication or identity passthrough from users.

If you need user-level access, it has to be enforced after the data reaches Fabric, for example, through row-level security (RLS) in Power BI or logic within Fabric workloads. The agent itself cannot enforce per-user access at the source.

How to access on-premises data sources in Data Factory - Microsoft Fabric | Microsoft Learn

Fabric data agent creation (preview) - Learn how to create a Fabric data agent | Microsoft Learn

Authenticate with Microsoft Fabric workspace identity - Microsoft Fabric | Microsoft Learn