credential management best practices?

Hi GQ00 ,

Failures happened because connections were still tied to the consultant’s expired identity. Restoring that account refreshed the tokens. The long‑term fix is to use a dedicated service account for all Fabric connections, document ownership, and audit regularly. That way, you won’t be at the mercy of individual user accounts disappearing.

Best practices to prevent this--

1. Use service accounts for connections-

Create a dedicated Entra ID account (e.g., [email protected]) with appropriate permissions.

Authenticate all Fabric connections (SharePoint, Lakehouse, Warehouse, etc.) using this account.

This way, connections don’t depend on personal identities that may leave the company.

2. Assign workspace roles carefully-

Make the service account a Contributor or Admin in the workspace so it can own and refresh connections.

Ensure multiple admins exist so you’re not locked out if one account is disabled.

3. Document connection ownership-

Maintain a list of which connections are tied to which identities.

Periodically audit connections in Manage Connections & Gateways to confirm they’re bound to the service account.

4. Automate monitoring-

Use Fabric’s monitoring/logging to detect authentication errors early.

Consider setting up alerts when pipelines or Dataflows fail due to credential issues.

Why did things start failingrandomly?

• Why did things start failing “randomly”?
  1. Hidden dependency on consultant’s identity: When the consultant originally created connections (to SharePoint, Gold Warehouse, etc.), those connections were bound to their Entra ID credentials. Even if you later re‑authenticated, Fabric sometimes caches or ties the “owner” of the connection to the original identity.

  2. Token expiry: Once the consultant’s account was inactive, the refresh tokens tied to that identity eventually expired. Pipelines and notebooks that were using those tokens stopped working, which explains the delayed/random failures.

  3. Different behavior across artifacts: Pipelines and notebooks could be “rescued” by recreating connections because they were re‑bound to a new identity. Dataflows, however, are more rigid — they often retain the original creator’s identity in metadata, so they kept failing until you reactivated the consultant’s account

Why did restoring the consultant’s user fix it--

By re‑enabling the consultant’s Entra ID and logging in, Fabric could refresh the expired tokens and validate the connections again. Essentially, you “revived” the identity that the Dataflows were still pointing to, so authentication succeeded.

If this helped, a kudos would mean a lot! It encourages contribute and keeps the community strong.

Thank You

Sunita

Hi  GQ00  Please check what user is the owner of all the Fabric items the Consultant created. Make sure the owner is an active Entra ID user. I would suggest using a service account. 

Steps to Take Ownership

1. Open your workspace and navigate to the Fabric item you need to take over.
2. Click the ellipsis (...) next to the item name and select Settings.
3. Go to the About tab and click Take over.

Hi GQ00, 

Another gotcha is taking over ownership of a pipeline is not enough to actually change the owner, you need to take over ownership from the settings menu, and then you need to make a change and save the pipeline for the owner to actually change. 

 

Hi GQ00 ,

This behavior usually happens because connections were originally created under a personal/consultant account, so when that identity expired, dependent pipelines and dataflows lost their authentication context. Restoring the consultant’s login temporarily revalidated those credentials, which is why things started working again.  

Best practice is to avoid personal accounts for production connections. Instead, create a dedicated service account (Entra ID user or managed identity) that owns and maintains all Fabric connections. That way, pipelines, dataflows, and notebooks remain stable even if individual users leave the organization. It also centralizes credential management and reduces the risk of random failures.  

Thanks,

Sai Teja 

Hi GQ00 

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.

Thank you.

Hi GQ00 

May I check if this issue has been resolved? If not, Please feel free to contact us if you have any further questions.

Thank you