Using Solely DevOps as the deployment source, what is the best approach to automate deployment

[0_0]

I'm attempting to automate the deployment from DevOps to Fabric, I've read 2 relatively similar scenarios: 1 of which claimed that the usage of PAT's is the best approach as of now since we are unable to call upon UpdateFromGit using a service principal and another approach which contradicted the first approach and claimed that usage with service principals was the ideal sitation.

There's 2 samples of code which I've made to push from DevOps to Fabric:

Service Principal Approach:

trigger: none

pool:
  vmImage: 'windows-latest'

variables:
- group: your-keyvault-variable-group-name

steps:
- task: PowerShell@2
  displayName: 'Update Power BI Workspace from Git'
  inputs:
    targetType: 'inline'
    script: |
      $clientId = "$(fabric-client-id)"
      $clientSecret = "$(fabric-client-secret)"
      $tenantId = "$(fabric-tenant-id)"
      $workspaceId = "$(fabric-workspace-id)"
      $organization = "$(System.TeamFoundationCollectionUri)"
      $project = "$(System.TeamProject)"
      $repoId = "$(Build.Repository.ID)"
      $branch = "refs/heads/main"

      Write-Host "Fetching latest commit hash from branch: $branch"

      $authHeader = @{
        Authorization = "Bearer $env:SYSTEM_ACCESSTOKEN"
      }

      $commitUri = "$organization$project/_apis/git/repositories/$repoId/refs?filter=$branch&api-version=7.0"
      $commitResponse = Invoke-RestMethod -Uri $commitUri -Headers $authHeader -Method Get
      $commitHash = $commitResponse.value[0].objectId

      Write-Host "Latest commit hash: $commitHash"

      $body = @{
        grant_type    = "client_credentials"
        client_id     = $clientId
        client_secret = $clientSecret
        scope         = "https://api.fabric.microsoft.com/.default"
      }

      $tokenResponse = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Body $body
      $accessToken = $tokenResponse.access_token

      $headers = @{
        Authorization = "Bearer $accessToken"
        "Content-Type" = "application/json"
      }

      $body = @{
        remoteCommitHash = $commitHash
        conflictResolution = @{
          conflictResolutionType = "Workspace"
          conflictResolutionPolicy = "PreferWorkspace"
        }
        options = @{
          allowOverrideItems = $true
        }
      }

      $jsonBody = $body | ConvertTo-Json -Compress -Depth 10

      $uri = "https://api.fabric.microsoft.com/v1/workspaces/$workspaceId/git/updateFromGit"
      Write-Host "Calling Fabric API: $uri"
      $response = Invoke-RestMethod -Uri $uri -Method Post -Headers $headers -Body $jsonBody

      Write-Host "Response: $($response | ConvertTo-Json -Depth 10)"
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)

PAT Approach:

trigger: none

pool:
  vmImage: 'windows-latest'

variables:
- group: credentials

steps:
- task: PowerShell@2
  displayName: 'Update Power BI Workspace from Git'
  inputs:
    targetType: 'inline'
    script: |
      $commitHash = "$(Build.SourceVersion)"
      Write-Host "Using commit hash: $commitHash"

      $pat = "$(demo-dev-2025)"
      $headers = @{
        Authorization = "Bearer $pat"
        "Content-Type" = "application/json"
      }

      $body = @{
        remoteCommitHash = $commitHash
        conflictResolution = @{
          conflictResolutionType = "Workspace"
          conflictResolutionPolicy = "PreferWorkspace"
        }
        options = @{
          allowOverrideItems = $true
        }
      }

      $jsonBody = $body | ConvertTo-Json -Compress -Depth 10

      $uri = "https://api.fabric.microsoft.com/v1/workspaces/$(PBI_WORKSPACE_ID)/git/updateFromGit"
      Write-Host "Calling Fabric API: $uri"
      $response = Invoke-RestMethod -Uri $uri -Method Post -Headers $headers -Body $jsonBody

      Write-Host "Response: $($response | ConvertTo-Json -Depth 10)"

Any references in using whichever approach is greatly appreciated.

Thanks!

[yaronprigal · Accepted solution]

Hi, 

Check this article: https://learn.microsoft.com/en-us/fabric/cicd/git-integration/git-automation?tabs=user%2CADO

The SPN is the valid approach.

There is a support for SPN in case your git provider is GitHub.

The support for ADO will be released in couple of weeks.

[v-menakakota · Accepted solution]

Hi  @0_0 ,

Thanks for reaching out to the Microsoft fabric community forum. 

I would also take a moment to thank @yaronprigal   , for actively participating in the community forum and for the solutions you’ve been sharing in the community forum. Your contributions make a real difference

Yes, using a Service Principal (SPN) is the recommended and more secure approach for automating deployments in Fabric.

As of now, SPN-based UpDateFromGit works well with GitHub, but support for Azure DevOps Git repos via SPN is still pending. So if you're using Azure DevOps, you'll need to rely on a Personal Access Token (PAT) for now until SPN support is officially rolled out.

Best Regards, 
Menaka.
Community Support Team  

[v-menakakota]

Hi @0_0 ,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster. 

Thank you. 

[v-menakakota]

Hi @0_0 ,

May I ask if you have resolved this issue? If you still have any questions or need more support, please feel free to let us know. We are more than happy to continue to help you. 
 

Thank you,

Community Member.

[v-menakakota]

Hi @0_0 ,

I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We’re always here to support you.

Thank you,
Community Member.

[yaronprigal · Accepted solution]

Hi, 

Check this article: https://learn.microsoft.com/en-us/fabric/cicd/git-integration/git-automation?tabs=user%2CADO

The SPN is the valid approach.

There is a support for SPN in case your git provider is GitHub.

The support for ADO will be released in couple of weeks.