Does Fabric Data agent support Managed Identity or Service Principal access for the AI Assistant API

[SyedAshraf2001]

I was able to access the Fabric Data Agent using "InteractiveBrowserCredential" in my Python code. However, this approach requires manual login, which I want to automate.

When I attempted to automate the authentication, I encountered the following error:

Error occurred: Error code: 400
{
'requestId': 'c5ac3b07-15fd-48c4-aa71-9c9a451912eb',
'errorCode': 'PrincipalTypeNotSupported',
'message': 'The operation is not supported for the principal type'
}

Is there an alternative way to authenticate programmatically without manual login? If so, could you please guide me through the correct approach?

[burakkaragoz · Accepted solution]

Hi @SyedAshraf2001 ,

Hello,

You mentioned that you need to log in manually with 'InteractiveBrowserCredential' when using Fabric Data Agent. When you want to automate this method, you get a “PrincipalTypeNotSupported” error. Here are the steps you can follow to solve this problem:

Use Managed Identity:

Create a Managed Identity in Azure.
Grant the Managed Identity access to the Fabric Data Agent.
Authenticate using ManagedIdentityCredential in your Python code.
Using Service Principal:

Create a Service Principal in Azure.
Grant the necessary permissions to the Service Principal.
Authenticate using ClientSecretCredential or CertificateCredential in your Python code.
Example Python code:

from azure.identity import ManagedIdentityCredential, ClientSecretCredential
from azure.fabric import FabricDataAgent

# Managed Identity ile kimlik doğrulama
credential = ManagedIdentityCredential()
agent = FabricDataAgent(credential=credential)

# Service Principal ile kimlik doğrulama
credential = ClientSecretCredential(tenant_id, client_id, client_secret)
agent = FabricDataAgent(credential=credential)

With these methods, you can automate the authentication process and eliminate the need for manual input.

[v-sgandrathi · Accepted solution]

Hi @SyedAshraf2001,

Based on the current state of Microsoft Fabric's support for authentication methods, the error you're encountering occurs because Fabric Data Agent does not yet support Managed Identity or Service Principal for non-interactive login. Here's the best approach to handle this situation:

Interactive Authentication (Current Supported Method):

Currently, the InteractiveBrowserCredential is the only method supported for authentication, but it requires manual login. This works for development purposes or occasional use but is not suitable for automation.

Microsoft Fabric is actively evolving, and support for Managed Identity or Service Principal authentication might be added in the future. You can monitor this feature’s availability

Since this is a significant limitation for automation scenarios, consider submitting feedback or a feature request to Microsoft Fabric via their official channels to ensure that support for Managed Identity or Service Principal is added for the Fabric Data Agent and related services.

Appreciate if you could share the feedback on our Microsoft Fabric Ideas. Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.
Fabric Ideas - Microsoft Fabric Community

Thanks for reaching out! If this answer was helpful, please consider marking it as Accepted Solution and giving a Kudos, it helps the community!

Thank you.

[Anshid_K]

Hi @v-sgandrathi ,

Is this feature available now? If not, is there any other ways to access fabric data agent from an Azure hosted web app? 

[v-sgandrathi]

Hi @SyedAshraf2001,

May I ask if you have gotten this issue resolved?

If it is solved, please mark the helpful reply or share your solution and accept it as solution, it will be helpful for other members of the community who have similar problems as yours to solve it faster.

Thank you.

[burakkaragoz · Accepted solution]

Hi @SyedAshraf2001 ,

Hello,

You mentioned that you need to log in manually with 'InteractiveBrowserCredential' when using Fabric Data Agent. When you want to automate this method, you get a “PrincipalTypeNotSupported” error. Here are the steps you can follow to solve this problem:

Use Managed Identity:

Create a Managed Identity in Azure.
Grant the Managed Identity access to the Fabric Data Agent.
Authenticate using ManagedIdentityCredential in your Python code.
Using Service Principal:

Create a Service Principal in Azure.
Grant the necessary permissions to the Service Principal.
Authenticate using ClientSecretCredential or CertificateCredential in your Python code.
Example Python code:

from azure.identity import ManagedIdentityCredential, ClientSecretCredential
from azure.fabric import FabricDataAgent

# Managed Identity ile kimlik doğrulama
credential = ManagedIdentityCredential()
agent = FabricDataAgent(credential=credential)

# Service Principal ile kimlik doğrulama
credential = ClientSecretCredential(tenant_id, client_id, client_secret)
agent = FabricDataAgent(credential=credential)

With these methods, you can automate the authentication process and eliminate the need for manual input.