Create Git Credentials for DevOps Repo

[JAnder]

We work in a multi-tenanted environemt so we have over 100 workspaces. For this reason, we manage most tasks through the Rest APIs with a service principal. This means the principal also owns everything and is not a risk for people leaving.

With that in mind, I am looking at migrating the workspaces to use Git integration. I can create the integration with the principal in the UI (but then I own the connection). I want to do it with the API.

https://learn.microsoft.com/en-us/rest/api/fabric/core/git/connect?tabs=HTTP

The connect request fails because I am using AzureDevOps and I get the exception 

 Service Principal with Automatic credentials source is not supported for Azure DevOps.

I am using the Fabric Client SDK for the requests.

    var connection = await fabricClient.Core.Git.ConnectAsync(new Guid(Config.Workspaces.GitTestWorkspace),
            new GitConnectRequest(new AzureDevOpsDetails(
                "xxxx",
                "main",
                "xxxx",
                "xxxx",
                "xxxx")));

https://learn.microsoft.com/en-us/rest/api/fabric/core/git/get-my-git-credentials?tabs=HTTP

Get credentials returns no data, I suppose because I havent created it yet, but I am struggling to do that since there is no create endpoint for create that I can see, I thought that is what connect would do

https://learn.microsoft.com/en-us/rest/api/fabric/core/git/update-my-git-credentials?tabs=HTTP

So it looks like I need a ConfiguredConnectionRequest and not automatic because I am using Azure DevOps. However the request to update that requires a connectionId which does not yet exist.

Can someone point me in the right direction

Thansk very much

[v-karpurapud]

Hi @JAnder 

I wanted to check if you’ve had a chance to review the information provided. If you have any further questions, please let us know. Has your issue been resolved? If not, please share more details so we can assist you further.

Thank You.

[KevinChant]

Have you considered leveraging the Fabric CLI to do this instead? So that it can authenticate with each tenant first and then use the fab API commands for you.

[JAnder]

@KevinChant Are there any docs or can you elaborate a little? If I could run the commands against a CLI to set up the integations and have them owned by the principal that would be good, but I thought we needed to use either UI or API for that.

[v-karpurapud · Accepted solution]

Hi @JAnder 

As of now the Fabric CLI does not provide a way to create a new Azure DevOps Git integration or configure Azure DevOps credentials under a service principal. While the CLI supports service principal authentication, it ultimately calls the same public REST APIs as the SDK and therefore inherits the same limitation: the initial Git credential setup for Azure DevOps must be performed interactively through the Fabric UI under a user identity.
The CLI can still be valuable after the Git connection has been created in the UI, as it enables automation for tasks such as syncing, checking Git connection status, and managing workspace configurations across multiple tenants in a scriptable and consistent way. However, it cannot replace or bypass the UI-based credential configuration step.

Regards,

Microsoft Fabric Community Support Team.

[v-karpurapud]

Hi @JAnder 

Thank you for reaching out to the Microsoft Fabric Community.

In Microsoft Fabric, integrating Azure DevOps Git repositories within a multi-tenant environment using a service principal does not support automatic credential sources for Azure DevOps. As a result, connecting with the ConnectAsync method under a service principal context will not work. Instead, you need to configure Git credentials first by using the UpdateMyGitCredentials API with a ConfiguredConnectionRequest that includes the Azure DevOps username and a valid Personal Access Token (PAT). This API is user-scoped and requires an access token from an interactive user account rather than a service principal. A practical solution is to use an authorized service account (a non-personal Azure AD user) to set up the credentials through the Fabric UI or REST API. Once credentials and the connection are in place, the service principal can programmatically manage Git operations across workspaces.

I hope this information is helpful. If you have any further questions, please let us know. we can assist you further.

Regards,

Microsoft Fabric Community Support Team.
 

[JAnder]

Thanks @v-karpurapud 

It doesn't look like Update My Git Credentials (https://learn.microsoft.com/en-us/rest/api/fabric/core/git/update-my-git-credentials?tabs=HTTP) accepts a PAT token or account details.  It can be done through the UI and then by giving the service principal access to the connection but I am not seeing it on the API. Could you point me to where its documented or show a small snippet?

Also, this may also warrant a different post as its bit of a tangent, but I also noticed The Update From Git API (https://learn.microsoft.com/en-us/rest/api/fabric/core/git/update-from-git?tabs=HTTP ) does not match the SDK. The overload for passing in conflict resolution etc is set to internal, so inaccessible.

// Copyright (c) Microsoft Corporation. All rights reserved.
// Licensed under the MIT License.

// <auto-generated/>

#nullable disable

using System;

namespace Microsoft.Fabric.Api.Core.Models
{
    /// <summary> Contains the update from Git request data. </summary>
    public partial class UpdateFromGitRequest
    {
        /// <summary> Initializes a new instance of <see cref="UpdateFromGitRequest"/>. </summary>
        /// <param name="remoteCommitHash"> Remote full SHA commit hash. </param>
        /// <exception cref="ArgumentNullException"> <paramref name="remoteCommitHash"/> is null. </exception>
        public UpdateFromGitRequest(string remoteCommitHash)
        {
            Argument.AssertNotNull(remoteCommitHash, nameof(remoteCommitHash));

            RemoteCommitHash = remoteCommitHash;
        }

        /// <summary> Initializes a new instance of <see cref="UpdateFromGitRequest"/>. </summary>
        /// <param name="workspaceHead">
        /// Full SHA hash that the workspace is synced to.
        /// This value may be null only after Initialize Connection.
        /// In other cases, the system will validate that the given value is aligned with the head known to the system.
        /// </param>
        /// <param name="remoteCommitHash"> Remote full SHA commit hash. </param>
        /// <param name="conflictResolution">
        /// Conflict resolution to be used in the update from Git operation.
        /// If items are in conflict and a conflict resolution is not specified, the update operation will not start.
        /// </param>
        /// <param name="options"> Options to be used in the update from Git operation. </param>
        internal UpdateFromGitRequest(string workspaceHead, string remoteCommitHash, WorkspaceConflictResolution conflictResolution, UpdateOptions options)
        {
            WorkspaceHead = workspaceHead;
            RemoteCommitHash = remoteCommitHash;
            ConflictResolution = conflictResolution;
            Options = options;
        }

        /// <summary>
        /// Full SHA hash that the workspace is synced to.
        /// This value may be null only after Initialize Connection.
        /// In other cases, the system will validate that the given value is aligned with the head known to the system.
        /// </summary>
        public string WorkspaceHead { get; set; }
        /// <summary> Remote full SHA commit hash. </summary>
        public string RemoteCommitHash { get; }
        /// <summary>
        /// Conflict resolution to be used in the update from Git operation.
        /// If items are in conflict and a conflict resolution is not specified, the update operation will not start.
        /// </summary>
        public WorkspaceConflictResolution ConflictResolution { get; set; }
        /// <summary> Options to be used in the update from Git operation. </summary>
        public UpdateOptions Options { get; set; }
    }
}

[v-karpurapud]

Hi @JAnder 

Thank you for your observations and patience. You are correct, after re-examining the official documentation and SDK behavior, I can confirm that my earlier suggestion regarding the use of UpdateMyGitCredentials with a ConfiguredConnectionRequest containing a PAT was inaccurate.

Currently, there is no supported or documented API endpoint that allows a service principal to programmatically create or configure Git credentials for Fabric or Azure DevOps using a PAT. The credential setup must be performed interactively through the Fabric UI under a user context, after which access can be delegated to the service principal.

Although this limitation is not explicitly stated in the documentation, it is consistently reflected in SDK and REST API behavior and has been validated through community discussions and real world usage patterns.

Regards,

Microsoft Fabric Community Support Team.