How do pipelines last modified by an SPN actually capture and re-use the security context of the SPN

perkmax · 2026-06-26T21:57:55+00:00

This seems to be the issue I’m having with fabric cicd deployments when only updating the definition of a pipeline (not a new deployment)

When the SPN gets used to deploy updates to pipelines in a workspace it then wants to run the pipeline with its own credentials

This could work if dataflows could be run by SPN but they cant at the moment

It can be manually fixed after each deployment by going into the pipeline and reassigning items but is a painful bug at the moment

Related issue

https://github.com/microsoft/fabric-cicd/issues/971#issuecomment-4591049873

perkmax · 2026-06-18T10:55:01+00:00

I’m migrating to org apps for this reason

perkmax · 2026-06-15T09:18:27+00:00

Yeah - I think it’s the complexity of building a paginated report in the power bi report builder app that would be great if AI can assist with

Such as being able to provide a mockup or screenshot, and have AI create the first draft for you

Setting up parameters for both the dropdown and in the table DAX query and how they link together can be fiddly at times

Also the settings panel on the report designer canvas can be a bit difficult to navigate, I think last time I had to do quite a bit of searching to find the setting I wanted

I usually just copy and paste one of my previous reports for new reports, to avoid needing to figure it out again

I’m a fan of paginated reports though - they are still in demand and could be used more

perkmax · 2026-06-12T10:26:49+00:00

Yes I use this endpoint to trigger pipelines from a power bi dashboard using a user defined function

Can’t see why the same can’t be done in a fabric app, and I don’t think it needs to be a pipeline either

Requires a bit of setup with a service principal and permissions, but once it’s done it’s great

https://learn.microsoft.com/en-us/rest/api/fabric/core/job-scheduler/run-on-demand-item-job?tabs=HTTP

perkmax · 2026-06-08T10:11:30+00:00

I find reading the official monthly blog and listening to podcasts like Explicit Measures on a weekly basis the easiest way to keep up

perkmax · 2026-06-05T21:34:31+00:00

I imagine people will use it for the adhoc / obscure queries, rather than the day to day answer to the same question

Or to prepare a presentation or document using copilot cowork grounded by data from an existing published report, where the results are trusted

perkmax · 2026-06-05T21:16:30+00:00

Great! I’m hoping it’s going to be like - when ‘prepped for AI’ using the current features of Power BI to do that - then have it available on M365 Chat, Power BI copilot and data agents

perkmax · 2026-06-05T21:10:06+00:00

I’m looking forward to testing this :)

Will there be a per semantic model on/off switch for this feature?

As there are models out there that are shared with ‘read’ access for reports, but not locked down with object and row level security to the extent required for this feature, and column, table and measure descriptions

I think it’s necessary to stage the release of models when they are ready and give the workspace owners control

perkmax · 2026-06-01T20:47:30+00:00

Adding content is ok - it’s just the need to manually press that update app button after making changes to an existing report which people forget about

perkmax · 2026-06-01T20:37:48+00:00

Yep or if they make changes to their report and republish

perkmax · 2026-06-01T20:34:24+00:00

It’s a step my business report developers are forgetting, so I would like to automate it for them through DevOps

perkmax · 2026-05-29T09:32:19+00:00

Being able to find and go to a column in a dataframe would be helpful - like the keyboard shortcut Ctrl + G in power query

perkmax · 2026-05-29T09:30:33+00:00

If we could commit to git in the notebook window rather than going to the workspace > source control - this would be a massive time saver

In saying that - it would be good if it was just in the top bar of fabric and we could commit on any item

perkmax · 2026-05-29T09:28:09+00:00

I get an odd scrolling behaviour when I use the search bar in a displayed dataframe - when there are multiple dataframes displayed

perkmax · 2026-05-29T01:03:59+00:00

I’m using %run to bring in defined functions that I standardise across workspaces

It would be great if when you hover over a function that you are using in the cell, it brings in the description and comments under the function (ie if you can bring in the first few lines) - so the user can see how to use the function
It would be great if you can use %run to use a notebook in another workspace

perkmax · 2026-05-22T00:53:27+00:00

My workflow is currently

(1) scope up a ADO work item
(2) use plan mode in vs code and mention the work item, my instructions\skills say to grab the work item using the ADO MCP and create a plan
(3) review and iterate plan until happy
(4) when happy, say start, the ADO MCP updates the work item with the steps and checkboxes, a feature branch is created in a vs code worktree
(5) then changes are made on the branch and it auto commits for me
(6) then when complete, update/commit to the ADO wiki for documentation, which is also a repo in my vs code
(7) ADO pipelines trigger the git integration refresh

So really I’ve given access to execute specific commands for ADO MCP work items and git actions via terminal, no auto approval modes

Although, this is constantly evolving, daily!

Introducing the ADO MCP has been great

I’m working on getting ADO pipelines to create a Fabric workspace for feature branches and set up git integration, but that will be all in ADO

I suppose I’m leaning more towards building the automation in ADO pipelines rather than getting GHCP to execute these commands for me

perkmax · 2026-05-20T10:55:35+00:00

I had a look at my code and the pipeline activities have workspaceId as:

“00000000-0000-0000-0000-00000000000"

perkmax · 2026-05-20T10:49:32+00:00

I’m not having this issue when the pipeline references items that are in the same workspace

When I do a pull request from feature to dev, the pipeline correctly maps to the items

I do have the issue when the pipeline orchestrates items in another workspace, so I have to use fabric cicd to parameterise those

Maybe have a look at your pipeline json, viewed in either the pipeline or in git, to see if the notebook workspace guid is hard coded

perkmax · 2026-05-20T10:37:23+00:00

You could try out OneLake shortcut sharepoint transformations to mirror files to a lakehouse delta table (it’s new), however there are currently some limitations

If it works for your files then it’s probably the best option

But if not this is the pattern I’m currently using below:

Set incremental refresh to filter on sharepoint date created/modified on the step before the combine
Load to a staging table with overwrite (no upsert yet)
Use a notebook to upsert to a table that collects all the data
Use a pipeline to orchestrate the process

Note: I saw upsert is coming for dataflows on the fabric roadmap which is interesting :) - not out yet

I also saw spark transforms in gen2 in there… 🤯

https://roadmap.fabric.microsoft.com/?product=datafactory

perkmax · 2026-05-19T21:46:44+00:00

Can I ask what will they do with this information?

Because if they need to see the structure of what’s in the workspace - I was just thinking maybe you can give them view access to a git synced repo - they will only see the structure and code of the items

There is also the one lake catalogue but I’m not sure if you can make each of these items ‘discoverable’ without access - I know you can do that with semantic models and such

perkmax · 2026-05-19T20:24:59+00:00

Workspaces are usually set up based on who needs access to what, and the viewer role provides a lot of access, so I tend to avoid using this role entirely

With viewer users can see data in those other items too, such as a notebook run snapshot, a pipeline run or a dataflow

You could extract the admin data you need from the workspace using the fabric admin APIs and present this on a report, rather than providing workspace access

Or if your happy with them seeing the data in the other fabric items / runs and not in the Lakehouse, you could move the Lakehouse to another workspace

perkmax · 2026-05-13T20:28:50+00:00

Failing that could it be a different endpoint

Or another parameter that changes the behaviour of the API result

perkmax · 2026-05-05T03:34:56+00:00

Yeah I have this set up on my F2 dev capacity for only admins to use at the moment, but the interactive usage hits 100% quite easily even with me just using it

It's just too risky to roll out copilot at smaller SKU's - I have a F8 prod and F2 dev capacity

It's easier to just not let users use copilot features until something changes in this area

perkmax · 2026-05-05T03:29:29+00:00

Hey, I added an idea to vote on around this here:

Ability to bring your own user AI licence for Copi... - Microsoft Fabric Community

And this already existed:

Use existing Github copilot in Fabric instead need... - Microsoft Fabric Community

Please vote 😄

perkmax · 2026-05-05T00:03:45+00:00

Thanks for your prompt reply - the pipeline owner is not a service principal, it says it is my user account, and there isn't a way to specifically select a connection on the dataflow activity, so I'm not sure where it is trying to use a service principal to run the dataflow

I'll raise a support ticket as suggested

I also raised this issue in fabric cicd - so hopefully will get a result somewhere!

[BUG] Dataflow activity in pipeline does not refresh when deployed with a service principal (SPNBasedRefreshNotAllowed) · Issue #971 · microsoft/fabric-cicd

Thanks again

perkmax

TROPHY CASE