Which permissions (entra id or fabric) are required for service principal authentication? #52

LowerKees · 2025-10-28T10:16:11Z

LowerKees
Oct 28, 2025

My team wants to use a service principal and the fabric cli to start Fabric Jobs from our CI/CD pipeline.

Currently, I'm testing with a service principal/app reg which has admin permission on a target workspace. However, when running the scripts I'm running into 'Unauthorized' errors.

The output differs across commands. The 'pwd' command is showing output, but isn't very useful:

{
    "name": "Unknown",
    "type": ".Tenant",
    "id": "9ecxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
    "local_path": "/agent/_work/31/s"
}

Other commands like fab exists <name>.Workspace, fab exists <name>.Workspace/<notebook_name>.Notebook and fab get <name>.Workspace -q . are all failing, resulting in the message [Unauthorized] Access is unauthorized.

The command fab api workspaces fails and returns the message that the caller is not authenticated.

{
  "status_code": 401,
  "text": {
    "requestId": "65c4246e-ba71-4a25-8e3e-020f8c9b6132",
    "errorCode": "Unauthorized",
    "message": "The caller is not authenticated to access this resource"
  }
}

Could you let me know which permissions are required to set in Entra ID (if any) and what permissions get evaluated when doing requests with the fab cli?