Forum Discussion
Creating a non-human connection between Power BI service and SharePoint Online List
Hi mestee ,
Thanks for reaching out to the Fabric Community Forum.
Microsoft documentation states that you can use a Service Principal for SharePoint Online List connections in Dataflow Gen2. To set this up, you need to create or configure a Service Principal in Microsoft Entra ID, configure the required permissions and connection settings for the Service Principal, and then set up the SharePoint connection in Fabric using Service Principal authentication. The SharePoint Online List connector documentation also confirms Service Principal as a supported authentication method and requires the Tenant ID, Client ID, and Client Secret or Key for connection setup.Additionally, according to Microsoft Learn documentation, Workspace Identity may be available as an authentication option for SharePoint connections, depending on the connector and scenario. Therefore, it's best to use the authentication methods and connector features currently documented for your specific Fabric workload.
Refer this docs -
https://learn.microsoft.com/en-us/fabric/data-factory/connector-sharepoint-online-list-dataflows
https://learn.microsoft.com/en-us/fabric/data-factory/connector-sharepoint-online-list-copy-activity
https://learn.microsoft.com/en-us/fabric/data-factory/service-principals
Hi mestee ,
Based on Microsoft documentation, an approach to limit access to selected SharePoint sites when using a Service Principal is to use the Microsoft Graph Sites.Selected permission instead of broader permissions such as Sites.Read.All. With Sites.Selected, access is granted only to the specific SharePoint sites assigned to the application. After configuring the permission in Microsoft Entra ID, the Service Principal must also be granted access to the required SharePoint site using Microsoft Graph or SharePoint PowerShell.
For a read only scenario, you can grant the application read access only to the SharePoint site containing the SharePoint Online List. Once the required Microsoft Graph permission and site-level access are configured, you can use the Tenant ID, Client ID, and Client Secret to set up the SharePoint Online List connection in Fabric/Power BI Service using Service Principal authentication.
Refer this docs -
Microsoft Graph permissions reference (Sites.Selected)
https://learn.microsoft.com/en-us/graph/permissions-reference#sitesselectedOverview of Selected permissions for SharePoint sites
https://learn.microsoft.com/en-us/graph/permissions-selected-overviewSharePoint Online List connector authentication with Service Principal
https://learn.microsoft.com/en-us/fabric/data-factory/connector-sharepoint-online-list-dataflowsService principals in Microsoft Fabric
https://learn.microsoft.com/en-us/fabric/data-factory/service-principals
Hi mestee ,
Thanks for reaching out to the Fabric Community Forum.
Microsoft documentation states that you can use a Service Principal for SharePoint Online List connections in Dataflow Gen2. To set this up, you need to create or configure a Service Principal in Microsoft Entra ID, configure the required permissions and connection settings for the Service Principal, and then set up the SharePoint connection in Fabric using Service Principal authentication. The SharePoint Online List connector documentation also confirms Service Principal as a supported authentication method and requires the Tenant ID, Client ID, and Client Secret or Key for connection setup.
Additionally, according to Microsoft Learn documentation, Workspace Identity may be available as an authentication option for SharePoint connections, depending on the connector and scenario. Therefore, it's best to use the authentication methods and connector features currently documented for your specific Fabric workload.
Refer this docs -
https://learn.microsoft.com/en-us/fabric/data-factory/connector-sharepoint-online-list-dataflows
https://learn.microsoft.com/en-us/fabric/data-factory/connector-sharepoint-online-list-copy-activity
https://learn.microsoft.com/en-us/fabric/data-factory/service-principals
Thank you for the information and the links.
Would you please point me to Microsoft documentation link for this:
"...configure the required permissions and connection settings for the Service Principal..."
I am looking for the Microsoft best practice/least-privilege approach to providing the appropriate read-only access for the Service Principal on the SharePoint site and list.
Thank you!Hi mestee ,
Based on Microsoft documentation, an approach to limit access to selected SharePoint sites when using a Service Principal is to use the Microsoft Graph Sites.Selected permission instead of broader permissions such as Sites.Read.All. With Sites.Selected, access is granted only to the specific SharePoint sites assigned to the application. After configuring the permission in Microsoft Entra ID, the Service Principal must also be granted access to the required SharePoint site using Microsoft Graph or SharePoint PowerShell.
For a read only scenario, you can grant the application read access only to the SharePoint site containing the SharePoint Online List. Once the required Microsoft Graph permission and site-level access are configured, you can use the Tenant ID, Client ID, and Client Secret to set up the SharePoint Online List connection in Fabric/Power BI Service using Service Principal authentication.
Refer this docs -
Microsoft Graph permissions reference (Sites.Selected)
https://learn.microsoft.com/en-us/graph/permissions-reference#sitesselectedOverview of Selected permissions for SharePoint sites
https://learn.microsoft.com/en-us/graph/permissions-selected-overviewSharePoint Online List connector authentication with Service Principal
https://learn.microsoft.com/en-us/fabric/data-factory/connector-sharepoint-online-list-dataflowsService principals in Microsoft Fabric
https://learn.microsoft.com/en-us/fabric/data-factory/service-principalsI have given Sites.Read.All permission to the SPN. Tried setting up the connection powerBI connections and gateways..but still just get below error
"Unable to create connection for the following reason: Invalid connection credentials.Details: The credentials provided for the SharePoint source are invalid. Satus code 400"
