Forum Discussion

AyusmanBasu0604's avatar
AyusmanBasu0604
Icon for Helper II rankHelper II
8 months ago

Fabric Data Agent inaccessible from Azure WebApp using Foundry Agent

Hi Team,

I have a Fabric Data Agent as a knowledge tool being used in Foundry and the Foundry Agent is configured in a python SDK with Streamlit UI and called from an Azure WebApp App service. From Local VS Code it runs fine but from WebApp, it is unable to route and invoke the Fabric Data Agent. I have already added the Managed Identity of the WebApp Contributor access to the Fabric Data Agent and also at the Fabric Workspace Level. Still the issue remains same.

Is this a Fabric platform limitation?

admin
capacities
workspaces

9 Replies

  • deborshi_nag's avatar
    deborshi_nag
    Icon for Super User rankSuper User
    8 months ago

    Hello AyusmanBasu0604 

     

    It seems that the Fabric Data Agent in AI Foundry would need an end-user identity passthorugh as it does not support service principal or managed identifies. 

     

    It is explained in this doc reference

     

    Use Fabric Data Agent with Foundry Agents - Microsoft Foundry | Microsoft Learn

     

    When a user sends a query, the agent determines if it should use the Fabric data agent. If so, it uses the end user's identity to generate queries over data they have access to.

     

    You'd need to implement the on-behalf-of authentication in your Steamlit app and Python layer. 

     

    Hope this helps - please appreciate leaving a Kudos or accepting it as a Solution! 

    • v-dineshya's avatar
      v-dineshya
      Icon for Community Support rankCommunity Support
      7 months ago

      Hi AyusmanBasu0604 ,

      Thank you for reaching out to the Microsoft Community Forum.

       

      Hi deborshi_nag , Thank you for your prompt response.

       

      Hi AyusmanBasu0604 , Could you please try the proposed solution shared by deborshi_nag  ? Let us know if you’re still facing the same issue we’ll be happy to assist you further.

       

      Regards,

      Dinesh

  • ssrithar's avatar
    ssrithar
    Icon for Super User rankSuper User
    7 months ago

    Hi AyusmanBasu0604 ,

     

    You're encountering this issue because Microsoft Fabric Data Agents (used via Foundry) currently do not support authentication via Managed Identity or Service Principal. Instead, they require end-user identity passthrough using OAuth 2.0 on-behalf-of (OBO) flow.

     

    Why it works locally but fails on Azure WebApp:

     

    Locally (VS Code): You’re likely authenticated as your user identity, so Foundry can delegate the call on your behalf.

    On Azure WebApp: It's running under a Managed Identity, which is not supported by Fabric Data Agents as per current platform capabilities.

     

    Solution: Use OAuth 2.0 On-Behalf-Of (OBO) Flow

    To make this work from your Azure WebApp, you must:

    1. Authenticate the end-user (e.g., via Microsoft Entra ID login)

    2. Obtain an access token for Microsoft Graph with required scopes

    3. Use OBO flow in your backend Python/Streamlit app to:

      • Exchange the user token for a token that can access Fabric on the user's behalf

      • Pass this token to the Foundry agent call

     

    If this post helps, then please appreciate giving a Kudos or accepting as a Solution to help the other members find it more quickly.
    If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

     

  • AyusmanBasu0604's avatar
    AyusmanBasu0604
    Icon for Helper II rankHelper II
    7 months ago

    Hi deborshi_nag and ssrithar Thanks for the suggestions, I am trying with OBO Auth as the workaround even though it has it's own caveats: https://learn.microsoft.com/en-us/answers/questions/5706409/obo-auth-issue-aadsts500133-assertion-is-not-withi 

    v-dineshya As for Fabric supporting service principal or managed identifies, is there any ETA by when the Product Team plans for a release? I have read in several blogs, it's in the loop but that's how it's been for almost a year now. Is there a page where we can check the planned release date?