Issues Authenticating via Service Principal in Fabric Notebook to Connect on Semantic Model

[dimitraga10_]

Hello everyone,

I’m facing an issue with a notebook I recently created on Fabric. I was using a service principal (SP) for authentication to connect to the semantic model and perform certain actions. However, I’m encountering unexpected behavior in my latest run, where errors that I was expecting no longer appear.

The notebook I’m referencing is from the semantic-link-labs/notebooks/Service Principal.ipynb at main · microsoft/semantic-link-labs · GitHub...

 

with labs.service_principal_authentication( key_vault_uri=key_vault_uri, key_vault_tenant_id=key_vault_tenant_id, key_vault_client_id=key_vault_client_id, key_vault_client_secret=key_vault_client_secret): with connect_semantic_model(dataset=DatasetName, workspace=WorkspaceName, readonly=True) as tom: for t in tom.model.Tables: print(t.Name)

So i was using this to authenticate and was able to do some modifications on the Semantic Model.

This approach worked perfectly till few days ago, but now I am getting the error provided below. Has there been any change to the API or authentication process recently?

Additionally, is there an alternative way to authenticate via service principal and make modifications to the semantic model using sempy labs?

Thanks in advance, 
Dimitra

 

ERROR : 

INFO | No environment configuration found. 2025-09-04 15:47:04,201 | INFO | ManagedIdentityCredential will use IMDS 2025-09-04 15:47:04,202 | INFO | FabricAnalyticsTokenCredentials acquired a token from ServicePrincipalTokenProvider --------------------------------------------------------------------------- ImportError Traceback (most recent call last) Cell In[189], line 7 1 with labs.service_principal_authentication( 2 key_vault_uri=key_vault_uri, 3 key_vault_tenant_id=key_vault_tenant_id, 4 key_vault_client_id=key_vault_client_id, 5 key_vault_client_secret=key_vault_client_secret): ----> 7 with connect_semantic_model(dataset=DatasetName, workspace=WorkspaceName, readonly=True) as tom: 8 for t in tom.model.Tables: 9 print(t.Name) File ~/cluster-env/trident_env/lib/python3.11/contextlib.py:137, in _GeneratorContextManager.__enter__(self) 135 del self.args, self.kwds, self.func 136 try: --> 137 return next(self.gen) 138 except StopIteration: 139 raise RuntimeError("generator didn't yield") from None File ~/cluster-env/trident_env/lib/python3.11/site-packages/sempy_labs/tom/_model.py:5911, in connect_semantic_model(dataset, readonly, workspace) 5908 # initialize .NET to make sure System and Microsoft.AnalysisServices.Tabular is defined 5909 sempy.fabric._client._utils._init_analysis_services() -> 5911 tw = TOMWrapper( 5912 dataset=dataset, 5913 workspace=workspace, 5914 readonly=readonly, 5915 ) 5916 try: 5917 yield tw File ~/cluster-env/trident_env/lib/python3.11/site-packages/sempy_labs/tom/_model.py:124, in TOMWrapper.__init__(self, dataset, workspace, readonly) 122 import Microsoft.AnalysisServices.Tabular as TOM 123 from Microsoft.AnalysisServices import AccessToken --> 124 from sempy.fabric._token_provider import ( 125 create_on_access_token_expired_callback, 126 ConstantTokenProvider, 127 ) 128 from System import Func 130 token = self._token_provider(audience="pbi") ImportError: cannot import name 'create_on_access_token_expired_callback' from 'sempy.fabric._token_provider' (/home/trusted-service-user/cluster-env/trident_env/lib/python3.11/site-packages/sempy/fabric/_token_provider.py)

[v-ssriganesh]

Hi @dimitraga10_,
Thank you for reaching out to the Microsoft fabric community forum. There might be an issue with library compatibility. If there was a recent update, it could have introduced breaking changes. You can try reverting the sempy library to version 1.6.2

Check your service principal has Member or Contributor access to the workspace, Build permissions on the dataset, and Get/List secrets access in Key Vault.

Or use the stable sempy.fabric package with Fabric REST APIs for reliable SP authentication and dataset operations. See: Fabric REST API Docs.

If issue persists, consider authenticating through Microsoft Entra authentication or using the workspace identity to see if that resolves the issue.

Best regards,
Ganesh Singamshetty.