Forum Discussion
Advocate IDetect/Capture whenever a Data Connection has been leveraged/activated
Hi MathieuSGA,
Thank you for the follow up.Based on my understanding, Microsoft Fabric does not currently provide an automatic tenant wide alert or log that explicitly indicates when a specific data connection for example, your ERP has been accessed. Historical monitoring at that level of granularity requires the use of existing monitoring APIs or audit logs.
Please consider the following steps which may assist in resolving the issue:
- Navigate to Monitor, then to Pipeline runs or Activity runs. Apply filters for the ERP outage time window and review the Copy activity details to confirm whether the ERP linked service or dataset was used.
- Query Pipeline Runs or Activity Runs using the Fabric REST API to retrieve start time, end time, and connection or dataset details.
- Request that the administrator check Purview, Unified Audit Logs, or Data Connection Auditing for events related to the ERP connection during the outage to obtain tenant level evidence across workspaces.
For further reference, please consult the following documentation:
Monitor Copy activity - Microsoft Fabric | Microsoft Learn
Activity Runs - Query By Pipeline Run - REST API (Azure Data Factory) | Microsoft Learn
Track user activities in Microsoft Fabric - Microsoft Fabric | Microsoft Learn
Data connection auditing for exfiltration protection | Microsoft LearnWe hope that the information provided will assist you in addressing the issue. If you have any further queries, please feel free to contact the Microsoft Fabric community.
Thank you.
Super UserHi MathieuSGA,
Is your intent to be able to see/audit every time a connection is used?
You can detect when a Data Factory “Copy data” activity leverages a specific Fabric data connection, but the right place to look depends on whether you want tenant-level auditing, workspace-level run telemetry, or custom, fine-grained logs.
- Workspace / pipeline level (most direct): Use the Monitoring hub to see pipeline and activity runs that used the connection. For automation, call Query Activity Runs on the pipeline run to capture source/sink details (including the connection/dataset behind the Copy). Monitoring hub · Monitor pipeline runs · Query Activity Runs example
- Tenant / admin level (auditing and exfiltration controls): If you’re asking “who used which connection and when,” enable and query Microsoft Purview (M365) unified audit logs for Fabric/Power BI events, and use Data connection auditing for exfiltration protection across pipelines, Dataflow Gen2, models, and datamarts. Access typically requires Fabric/Power BI admin roles. Track user activities in Fabric · Unified audit log overview · Data connection auditing
- If you need guaranteed, fine-grained capture per run (non-admin friendly): Add a tiny logging step in your pipeline (after Copy) to write pipelineRunId, activityRunId, connectionName, timestamps, and row counts to a Lakehouse/KQL table-this is reliable and queryable without admin APIs.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
Advocate IIf I might put a little bit of "behind the scene"-context:
we had service interruption from our ERP.
Since we are one of many services that get information from this ERP, we wanted to make sure that, around the moment the difficulty started, the data connection to our ERP was not leveraged, and that we were not responsible for bringing down the ERP.
If that additional explanation can bring some light to the situation, what would be your go-to solution ? (one fabric-based solution would be much appreciated ;D )
- tayloramy
Hi MathieuSGA,
So you're looking for historical monitoring to see what was running?
You'll need to use the admin APIs for that.If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.