Forum Discussion

radekantoniuk's avatar
radekantoniuk
New Member
10 months ago
Solved

Expose GraphQL Fabric SQL endpoint to all tenant users

I have created a GraphQL from Fabric SQL views (no mutations) - that works perfectly fine using interactive credentials via the script snippet generated via the UI.What I need is to expose that GraphQL endpoint to everyone in my MS tenant.

From what I see in the documentation, I would need to grant an EntraID group containing all tenant users to this Fabric workspace, what I don't want to do.

Is there any other solution? 

Alternatively, I could generate CSV exports or somehow share the SQL views directly to all tenant users (or export to Lakehouse?)

 

Any ideas are welcome, just keep it simple 🙂 

 

security
  • V-yubandi-msft's avatar
    V-yubandi-msft
    10 months ago

    Hi radekantoniuk ,
    Adding to the tayloramy response.  currently there’s no native option in Fabric to expose GraphQL endpoints tenant wide without permissions. If building an app layer isn’t ideal, an easier workaround is to share the same data through a Lakehouse or scheduled CSV export, depending on how users need to consume it.

    Thanks for your prompt response tayloramy .

     

    Regards,
    Yugandhar.

5 Replies

  • tayloramy's avatar
    tayloramy
    Icon for Super User rankSuper User
    10 months ago

    Hi radekantoniuk, 

     

    I don't think there's any built in way to make the API accessible to the entire tenant.  How much experience do you have in making apps? You could grant API access to a service principal, and then bild a mid layer app that end users can use that uses the service principal's credentials.

     

    How are end users accessing the API? Is it through Fabric notebooks or another process?
    Might be able to use Fabric User Defined Functions as a wrapper as well. 

     

    If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

    • Anonymous's avatar
      Anonymous
      Not applicable
      10 months ago

      > How are end users accessing the API? Is it through Fabric notebooks or another process?
      > Might be able to use Fabric User Defined Functions as a wrapper as well. 

       

      I was looking at Fabric User Functions, but my impression is that they are like AWS Serverless Lambdas and that the same restriction would apply to them - the users that execute the function (that would fetch the records from GraphQL, transform to CSV and return the CSV as a content type) would need to be granted access to the Fabric Workspace where the function resides and to all resources it is using underneath (i.e. GraphQL and SQL database behind it). Am I wrong here?

       

      > You could grant API access to a service principal, and then bild a mid layer app that end users can use that uses the service principal's credentials.

      >> If building an app layer isn’t ideal, an easier workaround is to share the same data through a Lakehouse or scheduled CSV export, depending on how users need to consume it.

       

      I think that building an app is an overkill in this case (and in this organisation's layout).

      The goal here is to allow users from outside of Fabric Workspace where the Fabric SQL and GraphQL reside, to access the data via:

      - programmatic access -> Notebooks are fine

      - on-demand CSV download

       

      I can create the DataGen2 pipeline that would fetch the records even directly from SQL database and save them to Sharepoint as CSV but I wanted to avoid "scheduled" to refresh those files.

       

      Interestingly, I see that the SQL Query browser has the export to CSV, XLS and JSON feature built-in as download icons directly above the query results pane - this is exactly what I want to expose to users outside of this Fabric Workspace.

       

       

      • tayloramy's avatar
        tayloramy
        Icon for Super User rankSuper User
        10 months ago

        Hi Anonymous, 

         

        FOr UDFs, you can grant access to the UDF without granting access to your workspace. 

         

        IT sounds like you're on a path to a solution with the SQL queries. 

         

        Let is know if there's anything else we can help with. 

         

        If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

         

  • V-yubandi-msft's avatar
    V-yubandi-msft
    Icon for Community Support rankCommunity Support
    10 months ago

    Hi radekantoniuk ,
    Adding to the tayloramy response.  currently there’s no native option in Fabric to expose GraphQL endpoints tenant wide without permissions. If building an app layer isn’t ideal, an easier workaround is to share the same data through a Lakehouse or scheduled CSV export, depending on how users need to consume it.

    Thanks for your prompt response tayloramy .

     

    Regards,
    Yugandhar.

  • Anonymous's avatar
    Anonymous
    Not applicable
    10 months ago

    > IT sounds like you're on a path to a solution with the SQL queries. 

     

    Not really. The SQL queries CSV export are only available in the SQL browser as I said above. It's not possible to share this anyhow with external users - unless you meant something else?

     

    Right now I'm trying to create a DataGen2 flow that pulls the data from SQL db and simply converts all rows from the SQL view to CSV, but it fails validation with:

    Some queries (see names in the details below) have only columns whose types are not supported by the default destination.