Forum Discussion

dimitraga10_'s avatar
dimitraga10_
New Member
11 months ago
Solved

Issues Authenticating via Service Principal in Fabric Notebook to Connect on Semantic Model

 

Hello everyone,

I’m facing an issue with a notebook I recently created on Fabric. I was using a service principal (SP) for authentication to connect to the semantic model and perform certain actions. However, I’m encountering unexpected behavior in my latest run, where errors that I was expecting no longer appear.

The notebook I’m referencing is from the semantic-link-labs/notebooks/Service Principal.ipynb at main · microsoft/semantic-link-labs · GitHub, specifically the Service Principal example. Here is the code I’m using:

 

 
with labs.service_principal_authentication( key_vault_uri=key_vault_uri, key_vault_tenant_id=key_vault_tenant_id, key_vault_client_id=key_vault_client_id, key_vault_client_secret=key_vault_client_secret): with connect_semantic_model(dataset=DatasetName, workspace=WorkspaceName, readonly=True) as tom: for t in tom.model.Tables: print(t.Name)

 

So i was using this to authenticate and was able to do some modifications on the Semantic Model.

This approach worked perfectly till few days ago, but now I am getting the error provided below. Has there been any change to the API or authentication process recently?

Additionally, is there an alternative way to authenticate via service principal and make modifications to the semantic model using sempy labs?

Thanks in advance, 
Dimitra
 
ERROR : 
INFO | No environment configuration found. 2025-09-04 15:47:04,201 | INFO | ManagedIdentityCredential will use IMDS 2025-09-04 15:47:04,202 | INFO | FabricAnalyticsTokenCredentials acquired a token from ServicePrincipalTokenProvider --------------------------------------------------------------------------- ImportError Traceback (most recent call last) Cell In[189], line 7 1 with labs.service_principal_authentication( 2 key_vault_uri=key_vault_uri, 3 key_vault_tenant_id=key_vault_tenant_id, 4 key_vault_client_id=key_vault_client_id, 5 key_vault_client_secret=key_vault_client_secret): ----> 7 with connect_semantic_model(dataset=DatasetName, workspace=WorkspaceName, readonly=True) as tom: 8 for t in tom.model.Tables: 9 print(t.Name) File ~/cluster-env/trident_env/lib/python3.11/contextlib.py:137, in _GeneratorContextManager.__enter__(self) 135 del self.args, self.kwds, self.func 136 try: --> 137 return next(self.gen) 138 except StopIteration: 139 raise RuntimeError("generator didn't yield") from None File ~/cluster-env/trident_env/lib/python3.11/site-packages/sempy_labs/tom/_model.py:5911, in connect_semantic_model(dataset, readonly, workspace) 5908 # initialize .NET to make sure System and Microsoft.AnalysisServices.Tabular is defined 5909 sempy.fabric._client._utils._init_analysis_services() -> 5911 tw = TOMWrapper( 5912 dataset=dataset, 5913 workspace=workspace, 5914 readonly=readonly, 5915 ) 5916 try: 5917 yield tw File ~/cluster-env/trident_env/lib/python3.11/site-packages/sempy_labs/tom/_model.py:124, in TOMWrapper.__init__(self, dataset, workspace, readonly) 122 import Microsoft.AnalysisServices.Tabular as TOM 123 from Microsoft.AnalysisServices import AccessToken --> 124 from sempy.fabric._token_provider import ( 125 create_on_access_token_expired_callback, 126 ConstantTokenProvider, 127 ) 128 from System import Func 130 token = self._token_provider(audience="pbi") ImportError: cannot import name 'create_on_access_token_expired_callback' from 'sempy.fabric._token_provider' (/home/trusted-service-user/cluster-env/trident_env/lib/python3.11/site-packages/sempy/fabric/_token_provider.py)
 
 
Need Help
Show and Tell
  • v-ssriganesh's avatar
    v-ssriganesh
    11 months ago

    Hello Anonymous,
    Thank you for the update. We sorry the issue persists. Based on recent Microsoft documentation, service principal authentication is supported for semantic link functions, including TOM interactions via connect_semantic_model, but it requires using the updated authentication methods introduced in semantic link version 0.12.0 or later (released around September 2025). The original service_principal_authentication approach may be incompatible due to library changes, which could explain the ImportError from mismatched versions.

    Recommended Steps:

    • Install the latest semantic link version with !pip install -U semantic-link-sempy and restart your notebook kernel.
    • Switch to set_service_principal or Azure SDK TokenCredential to set credentials, then use connect_semantic_model for TOM access. For non-interactive runs, no extra config is needed if triggered by SP.
    • Confirm your SP has ReadWrite permissions on the semantic model (via XMLA endpoint enabled) for modifications like creating partitions.
    • Once connected via TOM, you can add partitions to tables in the model and save changes. This works on Import mode semantic models.

    If the error continues after updating, it may be a version mismatch. consider pinning to 0.12.0 specifically.

    For detailed guidance:

     

    Best regards,
    Ganesh Singamshetty

6 Replies

  • v-ssriganesh's avatar
    v-ssriganesh
    Community Support
    11 months ago

    Hi dimitraga10_,
    Thank you for reaching out to the Microsoft fabric community forum.     There might be an issue with library compatibility. If there was a recent update, it could have introduced breaking changes. You can try reverting the sempy library to version 1.6.2

    Check your service principal has Member or Contributor access to the workspace, Build permissions on the dataset, and Get/List secrets access in Key Vault.

    Or use the stable sempy.fabric package with Fabric REST APIs for reliable SP authentication and dataset operations. See: Fabric REST API Docs.

    If issue persists, consider authenticating through Microsoft Entra authentication or using the workspace identity to see if that resolves the issue.

     

    Best regards,
    Ganesh Singamshetty.

  • v-ssriganesh's avatar
    v-ssriganesh
    Community Support
    11 months ago

    Hello dimitraga10_,

    We hope you're doing well. Could you please confirm whether your issue has been resolved or if you're still facing challenges? Your update will be valuable to the community and may assist others with similar concerns.

    Thank you.

  • v-ssriganesh's avatar
    v-ssriganesh
    Community Support
    11 months ago

    Hello dimitraga10_,

    Hope everything’s going great with you. Just checking in has the issue been resolved or are you still running into problems? Sharing an update can really help others facing the same thing.

    Thank you.

  • v-ssriganesh's avatar
    v-ssriganesh
    Community Support
    11 months ago

    Hello dimitraga10_, 

    Could you please confirm if your query has been resolved by the provided solutions? This would be helpful for other members who may encounter similar issues.

     

    Thank you for being part of the Microsoft Fabric Community.

    • Anonymous's avatar
      Anonymous
      Not applicable
      11 months ago

      Hello v-ssriganesh 

      Thank you .
      Unfortunately, I was not able to resolve the issue. I also cannot use an API, as the main objective is to create partitions on an Import Semantic Model.

      I haven’t seen any updates from Microsoft regarding the limitation that connect_semantic_model cannot work with a service principal. In fact, the official documentation indicates that these should work together.

      If anyone has experience with connecting to a semantic model via a service principal, I would greatly appreciate guidance on how to do this.

      Thank you!

      • v-ssriganesh's avatar
        v-ssriganesh
        Community Support
        11 months ago

        Hello Anonymous,
        Thank you for the update. We sorry the issue persists. Based on recent Microsoft documentation, service principal authentication is supported for semantic link functions, including TOM interactions via connect_semantic_model, but it requires using the updated authentication methods introduced in semantic link version 0.12.0 or later (released around September 2025). The original service_principal_authentication approach may be incompatible due to library changes, which could explain the ImportError from mismatched versions.

        Recommended Steps:

        • Install the latest semantic link version with !pip install -U semantic-link-sempy and restart your notebook kernel.
        • Switch to set_service_principal or Azure SDK TokenCredential to set credentials, then use connect_semantic_model for TOM access. For non-interactive runs, no extra config is needed if triggered by SP.
        • Confirm your SP has ReadWrite permissions on the semantic model (via XMLA endpoint enabled) for modifications like creating partitions.
        • Once connected via TOM, you can add partitions to tables in the model and save changes. This works on Import mode semantic models.

        If the error continues after updating, it may be a version mismatch. consider pinning to 0.12.0 specifically.

        For detailed guidance:

         

        Best regards,
        Ganesh Singamshetty