Use a Service Principal
Download this notebook from: semantic-link-labs/notebooks/Service Principal.ipynb at main · microsoft/semantic-link-labs · GitHub
Install the latest .whl package
Check here to see the latest version.
%pip install semantic-link-labs
Requirements
App Registration
- Create an App Registration in the Azure Portal. Note down the 'Application (client) ID' as well as the 'Directory (tenant) ID'.
- Within 'Manage -> Certificates and secrets', create a new client secret. Copy this down as you will not be able to retrieve it later.
Key Vault
- Create an Azure Key Vault within the Azure Portal.
- Within 'Objects -> Secrets', create 3 secrets (for the ClientID, TenantID, ClientSecret).
Groups
- Create a new group within the Azure Portal. Make sure it is of type 'Security'.
- Add the app registered (service principal) as a member of this security group.
Fabric Admin Portal
- Add the security group to the setting 'Service principals can use Fabric APIs'.
- Add the security group to the setting 'Service principals can access read-only admin APIs'.
Here are additional instructions regarding admin read-only APIs. Make sure to read and follow these instructions.
For connecting to Azure Analysis Services (AAS) via Service Principal, add the Service Principal (app) as an admin the AAS instance either in the Azure Portal or using SSMS in this format: app:<clientid>@<tenantid>.
Authentication to retrieve the Key Vault secrets is made using the account which is executing the notebook so please make sure that this account has access to the Key Vault.
Import the library and obtain a TokenProvider using Azure Key Vault
import sempy_labs as labs from sempy_labs import admin, graph from sempy_labs.tom import connect_semantic_model key_vault_uri = '' # Enter your key vault URI key_vault_tenant_id = '' # Enter the key vault key to the secret storing your Tenant ID key_vault_client_id = '' # Enter the key vault key to the secret storing your Client ID (Application ID) key_vault_client_secret = '' # Enter the key vault key to the secret storing your Client Secret
Use a Service Principal to authenticate to functions
with labs.service_principal_authentication(
key_vault_uri=key_vault_uri,
key_vault_tenant_id=key_vault_tenant_id,
key_vault_client_id=key_vault_client_id,
key_vault_client_secret=key_vault_client_secret):
df = admin.list_capacities()
display(df)with labs.service_principal_authentication(
key_vault_uri=key_vault_uri,
key_vault_tenant_id=key_vault_tenant_id,
key_vault_client_id=key_vault_client_id,
key_vault_client_secret=key_vault_client_secret):
df = labs.list_subscriptions()
display(df)with labs.service_principal_authentication(
key_vault_uri=key_vault_uri,
key_vault_tenant_id=key_vault_tenant_id,
key_vault_client_id=key_vault_client_id,
key_vault_client_secret=key_vault_client_secret):
labs.suspend_fabric_capacity(
capacity='',
azure_subscription_id='',
resource_group='',
)Using wrapper functions for Microsoft Graph
with labs.service_principal_authentication(
key_vault_uri=key_vault_uri,
key_vault_tenant_id=key_vault_tenant_id,
key_vault_client_id=key_vault_client_id,
key_vault_client_secret=key_vault_client_secret):
df = graph.list_users()
display(df)Use a Service Principal to connect to the Tabular Object Model (also to Azure Analysis Services)
Note that the Service Principal must have at least read permission to the semantic model to which it is connecting. See here for more details.
dataset = '' # Enter the name of the semantic model workspace = None # Enter the name of the workspace (for Azure Analysis Serivces instance use this format: "asazure://.asazure.windows.net/")
with labs.service_principal_authentication(
key_vault_uri=key_vault_uri,
key_vault_tenant_id=key_vault_tenant_id,
key_vault_client_id=key_vault_client_id,
key_vault_client_secret=key_vault_client_secret):
with connect_semantic_model(dataset=dataset, workspace=workspace, readonly=True) as tom:
for t in tom.model.Tables:
print(t.Name)