Forum Discussion

safrasmusthafa's avatar
safrasmusthafa
Frequent Visitor
7 months ago
Solved

fabric git with vs code

I have the Fabric and Data Engineering extensions in VS Code, which allow me to add Fabric items like notebooks and warehouses and push them directly to a Fabric workspace. Instead, I want to restric...
CICD
  • v-veshwara-msft's avatar
    v-veshwara-msft
    7 months ago

    Hi safrasmusthafa ,

    Thanks for the follow up and thanks svenchio for providing your valuable guidance on this.

    Below is some more detail on the pattern that was mentioned, since there is no native way to block direct publish from VS Code when a user has edit access to a Fabric workspace.

     

    The main idea is to separate development work from controlled deployment.

    You can create one or more Git enabled dev or sandbox workspaces. In these workspaces, developers have full edit access. They can create Fabric items such as notebooks, pipelines, lakehouses, and warehouses using VS Code or the Fabric portal, and then push their changes to feature branches in Git or Azure DevOps. These workspaces are used only for development and are not meant for production.

     

    In parallel, you maintain a single integration or production workspace. In this workspace, regular users do not have edit access. This prevents direct changes from VS Code, the portal, or APIs.

    Updates to the integration workspace happen only through Git integration. Usually, this workspace is linked to a protected branch like main, and updates are done using UpdateFromGit, either by a small set of admins or through automation using a service principal.

    With this setup, developers can work freely, but the controlled workspace can only be updated through Git.

     

    svenchio , please confirm if this matches what you meant, or add any corrections or extra details if needed.

     

    Hope this helps, please reach out for further assistance.
    Thank you.

deborshi_nag's avatar
deborshi_nag
Super User
7 months ago

Hi safrasmusthafa 

 

Unfortunately there isn’t a VS Code–specific switch to “force Git-only” publishing. The Fabric VS Code extensions can create/update items and also push directly to a Fabric workspace whenever the signed-in user has sufficient Fabric permissions. To block direct publishes, you need to enforce this at the Fabric workspace / tenant governance layer, not in VS Code.

 

You have the following workarounds:

 

1) Use Workspace roles to block direct publishing

Give developers Viewer access on target workspaces (e.g., DEV/UAT/PROD) and reserve Contributor/Member/Admin for your CI/CD service principal or release managers only. Viewers can’t create/modify items or publish; they can still see items for reference. This forces changes to flow through Git + pipelines.

 

2) Enforce tenant admin settings for Git integration and item creation

In the Admin portal → Tenant settings, you can:

  • Enable Git integration (Azure DevOps or GitHub) for specific groups.
  • Disable or scope “Users can create Fabric items” for production-facing capacities/workspaces, so only CI/CD identities can create there. (This doesn’t stop item creation in sandboxes you allow.)

3) Connect workspaces to Git and funnel changes via CI/CD

Use Fabric’s Git integration (Workspace settings → Git integration) to sync with Azure DevOps/GitHub. Restrict the connect/disconnect/switch-branch actions to Workspace Admins, and allow Contributors only to commit to Git (not publish to workspace). Combine with deployment pipelines so only pipeline runs publish into controlled workspaces.

 

4) Service principal–based publishing

Publish to Fabric through service principals in pipelines. Assign the SP Contributor/Member on target workspaces; end users remain Viewer there. SPs can call the Fabric REST APIs or deployment pipelines to create/update items as part of releases, while users cannot.

 

Hope this helps - please appreciate leaving a Kudos or accepting as a Solution!