Deploy a Fabric app with GitHub Actions
I followed every step from the documentation page and I cannot make it work. The Error I am receiving is: Deployment failed: Runtime settings sync failed: 403 Forbidden Details: Could not verify Build permission on semantic model '895b5565-1234-4cff-a0e0-5d322exxxxxx'. Ensure you have Build access, then re-add the connector. RootActivityId: 6c714e3a-f1f0-4989-85f3-978885985189 Diagnostic log: /home/runner/.rayfin/logs/2026-10-14T152715.236Z-up-56ba7c69-00ff-4450-b13d-0e5b3c4d9ede.log Tried with Service Principal ad a Contributor and as a Member name: Deploy to Fabric on: push: branches: [main] workflow_dispatch: inputs: force: description: 'Allow destructive schema changes that may result in data loss' required: false default: false type: boolean concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true permissions: contents: read jobs: deploy: name: Deploy to Fabric runs-on: ubuntu-latest defaults: run: # The Rayfin project (rayfin/rayfin.yml, package.json, bun.lock) lives here, not at the repo root working-directory: used-cars-app env: CLIENT_ID: ${{ secrets.CLIENT_ID }} TENANT_ID: ${{ secrets.TENANT_ID }} CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }} FABRIC_WORKSPACE_NAME: ${{ secrets.FABRIC_WORKSPACE_NAME }} steps: - name: Checkout repository uses: actions/checkout@v4 - name: Setup Node.js uses: actions/setup-node@v4 with: node-version: '20' - name: Setup Bun uses: oven-sh/setup-bun@v2 # Installs the app's build tools (vite, tsc) and the Rayfin CLI version pinned in bun.lock - name: Install dependencies run: bun install --frozen-lockfile # The CLI loads keytar, which links against libsecret even when it falls back to a plaintext token cache - name: Install libsecret run: sudo apt-get update && sudo apt-get install -y libsecret-1-0 # The runner has no OS keychain, so let the CLI cache its token in a file between steps - name: Login to Rayfin with service principal run: | npx rayfin login \ --service-principal \ --tenant "$TENANT_ID" \ --client-id "$CLIENT_ID" \ --client-secret "$CLIENT_SECRET" \ --encryption-fallback-enabled - name: Deploy to Fabric run: | EXTRA_ARGS="" if [[ "${{ inputs.force }}" == "true" ]]; then EXTRA_ARGS="$EXTRA_ARGS --force" fi npx rayfin up \ --workspace "$FABRIC_WORKSPACE_NAME" \ --yes \ --encryption-fallback-enabled \ $EXTRA_ARGSDeploy a Fabric app with GitHub Actions
1. The sample workflow doesn't run as written - The login step is missing line continuations: -t $TENANT_ID has no trailing \, so -u/-p never reach rayfin login. The run fails with "--client-id is required for service principal authentication". -p CLIENT_SECRET is also missing its $. - On ubuntu-latest, sign-in also needed libsecret-1-0 installed and --encryption-fallback-enabled (there's no OS keychain). Neither is mentioned. - The sample assumes the Rayfin project is at the repo root and never installs dependencies, although rayfin up builds the static site. A working-directory and an install step should be shown. 2. Service principal deploy fails for a Fabric app with a fabric-semanticmodel connector After fixing the above, sign-in, workspace resolution and item resolution all succeed, but the settings step fails: ❌ Deployment failed: Runtime settings sync failed: 403 Forbidden Details: Could not verify Build permission on semantic model '895b9183-5943-4cff-a0e0-5d322ed02c50'. Ensure you have Build access, then re-add the connector. RootActivityId: 2242ea58-00ee-4d2f-bfbf-0d4194be368d (also 2d4d50f1-b8d3-4efd-8071-6b03feda694e), 2026-10-14 - CLI: Microsoft/rayfin-cli 1.36.2. - Workspace role: the service principal is a Membet in the target workspace. - Model permission: the service principal already has Build on the semantic model (ReadWriteReshareExplore, confirmed with the Power BI REST API). - Same app as a user: the identical rayfin up succeeds when run interactively by a user. Questions: - Are service principal deployments supported for apps with a delegated fabric-semanticmodel connector? - If yes, which tenant setting or permission is missing? If no, please state it under "Considerations and limitations".
How to implement CI/CD for Lakehouse Delta table schemas and SQL Analytics Endpoint
Hi Microsoft Fabric Community, We have set up an automated CI/CD pipeline using Azure DevOps Repos, Git integration, and Microsoft's fabric-cicd Python library. Our current workflow is: 1. Feature workspaces are connected to Git feature branches. 2. A Pull Request merges changes into the dev branch. 3. Our Azure DevOps pipeline deploys Fabric items across target workspaces (dev → test → prod). The current behavior is: Control-plane items such as Notebooks, Data Pipelines, and Copy Jobs deploy and parameterize successfully. The Lakehouse item itself and its OneLake shortcut definitions also deploy as expected. However, Delta table schemas under /Tables and SQL Analytics Endpoint objects such as Views, Stored Procedures, and TVFs are not captured or deployed. Git integration appears to track the Lakehouse metadata but not the underlying Delta table structures or SQL Analytics Endpoint DDL. We have the following questions for the product team and community: Question 1 - Lakehouse Delta Table Schemas How can we implement automated CI/CD for Delta table creation and schema evolution across environments without requiring manual execution? Question 2 - SQL Analytics Endpoint Objects Since DACPAC / SqlPackage does not support the read-only SQL Analytics Endpoint, what is the recommended approach for implementing CI/CD for Views, Stored Procedures, and TVFs using Azure DevOps? Question 3 - Fabric Roadmap Are there plans on the Microsoft Fabric roadmap for native Git integration to track and synchronize SQL Analytics Endpoint objects directly alongside other workspace items? Any reference architectures, repository templates, recommended tools, or best practices for implementing this type of CI/CD workflow would be greatly appreciated. Thank you!
Issue during the deployment of a WH table from dev to test workspace
Hi, in a my Fabric solution, I've developed a data warehouse in a wh, existing also in a test workspace. I need to change the structure of some tables, by altering or adding columns. When I try to deploy the changed wh tables from the dev to test workspace using a deployment pipeline I've an error about an alter column issue. Now, how could I execute the changed tables deployment rightly? Is there a Fabric bug? I need to accomplish the deployment actions without any problems. Thanks
Unable to Configure Deployment Rules for a Direct Lake Semantic Model in Fabric
Hi Fabric Community, I’m facing an issue with Fabric Deployment Pipelines and would appreciate some guidance. I have a Power BI semantic model using Direct Lake mode, and I’m deploying it between two Microsoft Fabric workspaces. I am an Admin in both the source and target workspaces. However, when I open the Semantic model deployment rules, both Data source rules and Parameter rules are disabled/grayed out, as shown in the screenshots. I also confirmed that the tables in the semantic model are using Direct Lake storage mode using the TABLETRaits() DAX query. My questions are: Why are Data source rules and Parameter rules disabled for this semantic model? Is there any additional configuration required to enable these deployment rules? If deployment rules are not supported for this scenario, what is the recommended approach for changing the data source between environments? Any advice or explanation would be greatly appreciated. Thanks in advance!Fabric Warehouse Git commit fails with “Maximum commit size exceeded” potentially due to XMLA.json
Based on the Fabric Warehouse Git integration documentation, the XMLA.json file should be excluded from Git integration workflows. Fabric should exclude this file from commits and updates to prevent the default semantic model metadata from being unintentionally stored in Git. [learn.microsoft.com] However, it appears that XMLA.json, or the associated semantic model metadata, may still be getting processed on the Fabric side while calculating or preparing the commit. This potentially causes the commit to exceed the maximum allowed size. Any One Face Same Issue, how to avoid above issue & prevent XMLA.json file from getting processes while git commit ?Git Commit Issue
Hello Fabric Community, I have a workspace that is connected to my GitHub repo. I used a personal access token to integrate GitHub with Fabric. Initially, I created the token for only one day and committed my items to GitHub. When I connected my GitHub repo again with a new token, I was unable to commit the changes that had been made so far because I could not find any items pending to commit in the source control pane "Changes" tab. PFA. Please suggest a solution or let me know the proper way to integrate my changes into GitHub again. Thanks in advance for any insights or guidance!
DP-600 Voucher
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } Hi everyone, I recently passed the DP-700 Microsoft Fabric Data Engineer Associate certification and am now planning to take DP-600 (Microsoft Certified: Fabric Analytics Engineer Associate) while the Fabric concepts are still fresh in my mind. Unfortunately, I wasn't able to use a previous DP-600 voucher when I first received it as I wasn't ready for the exam at the time. I was wondering if anyone is aware of any current voucher opportunities for DP-600, or has an unused voucher that they won't be using and is transferable (if permitted by the voucher terms). Any guidance would be greatly appreciated. Thanks in advance! Regards, Amanul
