Azure AI Foundry with Fabric Data Agent using Managed Identity

Hi AshwithBhatt, 

You’re running into an auth mismatch.

When you test the Fabric Data Agent inside Fabric/Azure AI Foundry, it runs under your user identity and can read whatever your Entra user can read. But when your Azure Function calls the Azure AI Foundry Agents API, it’s using the Function’s managed identity (or an app identity), which isn’t a user. The Fabric tool in Azure AI Foundry is designed to use the end user’s identity via On-Behalf-Of (identity passthrough), so a headless call from MI/SPN typically fails with “can’t access the database.” See: “Use the Microsoft Fabric data agent (preview)” (the tool “uses the end user’s identity” and supports identity passthrough), and “Create a Fabric data agent (preview)” (data access “runs under your Microsoft Entra ID user identity”; SPN automation is a separate scenario and not covered).

Suggestion:
Switch to a delegated/OBO flow.
Have your frontend sign in the user (MSAL). Send the user’s token to your Function, and use an On-Behalf-Of exchange to call the Azure AI Foundry Agents API. This lets the Fabric tool query as that user, honoring their Fabric permissions. Docs: AI Foundry + Fabric tool with identity passthrough.

If you must use a non-interactive identity (MI/SPN):
Today, that’s not how the Fabric tool is meant to be consumed; it expects a user identity. Community thread confirms MI/SPN for this path isn’t supported yet: community post.
Workaround is to skip Data Agent and call Fabric sources directly with an SPN where supported (e.g., Fabric Data Warehouse has SPN support: announcement, docs).

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, please mark this as the solution.

You could also consider using one of the MCP servers.  Auditing limitations will apply.