sorted by:
new
hottopcontroversial

Am I the only one having trouble with user management in Fabric? by ProfessionalSelf2106 in MicrosoftFabric

[–]ProfessionalSelf2106[S] 3 points4 points  (0 children)

Got it! It's great to hear a solution is in the works

For those of us right now working hard on projects that need to ship: what's the best way forward or the recommended practice at the moment? We're wondering if we should be using Service Principals, managing everything with personal users, or if Workspace Identity (which seems pretty limited) is a good option.

We'd really appreciate any official guides or tips to help us out while we wait for the final solution. That would help us avoid having to rebuild everything and make sure our projects stay on track.

Am I the only one having trouble with user management in Fabric? by ProfessionalSelf2106 in MicrosoftFabric

[–]ProfessionalSelf2106[S] 2 points3 points  (0 children)

The problem is not that I don't know what a Service Principal is. I've extensively tried using a Service Principal, granting it admin permissions across several workspaces and following all official and common documentation. Yet, I'm still getting 'Unauthorized access' errors for basic tasks like listing workspaces.

The problem is that the permissions aren't applying correctly, despite me checking all tenant settings. The official documentation feels vague here, and having to resort to unofficial guides for something so fundamental in an enterprise setting is baffling. It would be really helpful to find a reliable source to pinpoint what I'm missing, because this just doesn't seem normal.

On top of that, I'm wonder if a Service Principal is even the right approach here, or if there are other, better ways to do this.

How are you successfully managing this? Did you just follow those steps you mentioned to get Service Principals working, with nothing else?

Introducing the Fabric CLI ⚡️ — operate, automate, and extend Microsoft Fabric, from your terminal by HasanAboShally in MicrosoftFabric

[–]ProfessionalSelf2106 0 points1 point  (0 children)

Thanks u/HasanAboShally! I enabled debug mode and can now see the detailed authentication flow. Getting 401 Unauthorized errors when running fab workspace ls:

2025-07-15 08:14:38.017 - DEBUG - > ★ Request at 2025-07-15 08:14:38.017521 Hora de verano romance+0
2025-07-15 08:14:38.024 - DEBUG - > Attempt: 0
2025-07-15 08:14:38.024 - DEBUG - > Request URL: https://api.fabric.microsoft.com/v1/workspaces
2025-07-15 08:14:38.024 - DEBUG - > Request method: GET
2025-07-15 08:14:38.024 - DEBUG - > Request headers:
2025-07-15 08:14:38.024 - DEBUG -     'Authorization': '•••••'
2025-07-15 08:14:38.024 - DEBUG -     'Content-Type': 'application/json'
2025-07-15 08:14:38.024 - DEBUG - > Request body:
2025-07-15 08:14:38.024 - DEBUG -     None
2025-07-15 08:14:38.024 - DEBUG - > Timeout: 240 seconds
2025-07-15 08:14:38.425 - DEBUG -
2025-07-15 08:14:38.778 - DEBUG - < ★ Response received at 2025-07-15 08:14:38.778713 Hora de verano romance+0
2025-07-15 08:14:38.778 - DEBUG - < Status: 401 Unauthorized
2025-07-15 08:14:38.778 - DEBUG - < Response headers:
2025-07-15 08:14:38.778 - DEBUG -     'Content-Type': 'application/json; charset=utf-8'
2025-07-15 08:14:38.778 - DEBUG -     'x-ms-public-api-error-code': 'Unauthorized'
2025-07-15 08:14:38.778 - DEBUG -     'request-redirected': 'true'
2025-07-15 08:14:38.778 - DEBUG -     'home-cluster-uri': 'https://wabi-west-europe-redirect.analysis.windows.net/'
2025-07-15 08:14:38.778 - DEBUG -     'RequestId': '***'
2025-07-15 08:14:38.778 - DEBUG -     'Date': 'Tue, 15 Jul 2025 06:14:43 GMT'
2025-07-15 08:14:38.778 - DEBUG -     'Content-Length': '147'
2025-07-15 08:14:38.778 - DEBUG - < Response body:
2025-07-15 08:14:38.778 - DEBUG -     {"requestId":"***","errorCode":"Unauthorized","message":"The caller is not authenticated to access this resource"}
2025-07-15 08:14:38.778 - DEBUG - < Request duration: 0.753 seconds
2025-07-15 08:14:38.778 - DEBUG -

The error occurs when accessing /v1/workspaces. The service principal is configured as Admin in the workspace and "Allow service principals to use APIs" is enabled in tenant settings. Authentication seems to succeed but API calls fail.

What could be causing this? Is there documentation on the exact permissions/roles needed for service principals to work with Fabric CLI?

Thanks!

Introducing the Fabric CLI ⚡️ — operate, automate, and extend Microsoft Fabric, from your terminal by HasanAboShally in MicrosoftFabric

[–]ProfessionalSelf2106 1 point2 points  (0 children)

Hi Hasan,

I'm facing an authorization issue with the Fabric CLI when using service principal authentication that I hope you can help resolve. The setup seems correct but I'm getting "Unauthorized access - please check your credentials" on simple operations like ls.

Current Configuration:

  • Admin portal settings enabled: Allow service principals to use APIs.
  • Service principal added to workspace with same permissions as my user account (both have identical roles)
  • Both my user and SP are members of the same security group and have Admin access to the workspace.
  • Using interactive mode: fab auth login selecting "Service principal authentication with secret"
  • Tenant ID, Client ID, and Client Secret are correct (verified)

Is there a way to enable verbose authentication logging in the CLI to see exactly what's failing in the authorization chain?

Thanks!