{"id":104164,"date":"2024-10-16T17:00:00","date_gmt":"2024-10-16T17:00:00","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=104164"},"modified":"2024-10-16T20:30:26","modified_gmt":"2024-10-16T20:30:26","slug":"using-a-service-account-in-microsoft-fabric","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/business-intelligence\/microsoft-fabric\/using-a-service-account-in-microsoft-fabric\/","title":{"rendered":"Using a Service Account in Microsoft Fabric"},"content":{"rendered":"

Applications should never depend on user accounts for their own authentication. User accounts have unique security configurations, such as MFA and password expiration.<\/p>\n

Applications can’t manage this kind of unique configuration. When the user changes the password, for example, the application may stop.<\/p>\n

The solution for this is to give to the application their own identity. The application needs to be capable to use this kind of identity, which is called a Service Account.<\/p>\n

Service Accounts support in Fabric<\/h2>\n

Cloud connections in Fabric<\/a> support the usage of service accounts. After we publish our semantic models, we can link them with the cloud connections configured to use the service accounts.<\/p>\n

When creating a new cloud connection, Service Account is one of the authentication options. When we choose this option, we need to fill in the Tenant Id<\/strong>, Service Principal Id<\/strong> and Service principal key<\/strong>.<\/p>\n

\"A<\/p>\n

Creating a Service Account<\/h2>\n

Fabric and Azure environment are related by the same security system: a single directory managing all the authentication.<\/p>\n

In this directory, the process to create a service account is called App Registration<\/strong>: You will register an app in Azure Entra (former Azure Active Directory) and this app will become a user which can receive permissions.<\/p>\n

1: Navigate to “App registrations”<\/strong><\/p>\n

In Azure Portal, App Registrations is inside the Entra ID<\/strong> feature (former Azure Active Directory). You can reach it by searching on the top search box, or going to Entra Id and finding it in the left menu.<\/p>\n

2: Create a New App Registration<\/strong><\/p>\n

    \n
  • In the App registrations page, click on the “+ New registration” button at the top of the page.<\/li>\n<\/ul>\n

    \"A<\/p>\n

    3: Configure the App Registration<\/strong><\/p>\n

      \n
    • Name: Enter a name for your application. This name will help identify the app in your Azure portal.<\/li>\n
    • Click “Register” to complete the registration.<\/li>\n<\/ul>\n

      \"A<\/p>\n

      Step 4: Note Down Important Information<\/strong><\/p>\n

      After the app registration is created, you will be redirected to the app’s Overview page. Note the following key information:<\/p>\n

      Application (client) ID<\/strong>: This is a unique identifier for your app.<\/p>\n

      Directory (tenant) ID<\/strong>: This is the unique identifier for your Azure AD tenant.<\/p>\n

      5: Generate a Client Secret<\/strong><\/p>\n

        \n
      • In the left menu, go to “Certificates & secrets”.<\/li>\n
      • Under Client secrets, click “+ New client secret”.<\/li>\n<\/ul>\n

        \"A<\/p>\n

          \n
        • Provide a description and select the expiration period for the secret.<\/li>\n<\/ul>\n

          \"A<\/p>\n

            \n
          • Click “Add”.<\/li>\n<\/ul>\n

            \"A<\/p>\n

            Once created, copy the Value of the client secret immediately, as it will not be displayed again.<\/p>\n

            Service Account Configuration Values<\/h2>\n

            After following the steps to create a service account, you have the Tenant Id<\/strong>, Service Principal Id<\/strong> and Service principal key<\/strong> for the service account.<\/p>\n

            When creating a Cloud Connection in Fabric, these are the values you need to fill.<\/p>\n

            Enabling Service Accounts usage in Fabric<\/h2>\n

            Service Accounts in Fabric need to be enabled before they receive any permission.<\/p>\n

            For example, let’s imagine you would like to use a service account to connect to a lakehouse. The service account needs to receive access to the lakehouse. The first step is to enable service accounts to access Fabric resources.<\/p>\n

            If the service account will be used only for external connections, you may not need this, but usually you will need the service account to access Fabric resources as well.<\/p>\n

            In order to enable the access of the service account, you need to use Power BI\/Fabric admin portal. Inside the admin portal, locate the Service principals can use Fabric APIs<\/strong>. This option needs to be enabled.<\/p>\n

            \"A<\/p>\n

            Setting Permissions to the Service Account<\/h2>\n

            Defining the permissions to service accounts is like doing so for regular users. You can define it on workspace level or object level.<\/p>\n

            \"A<\/p>\n

            \"A<\/p>\n

            Summary<\/h2>\n

            Service accounts improve the security and stability of Fabric environment, removing the dependencies with user accounts<\/p>\n","protected":false},"excerpt":{"rendered":"

            Applications should never depend on user accounts for their own authentication. User accounts have unique security configurations, such as MFA and password expiration. Applications can’t manage this kind of unique configuration. When the user changes the password, for example, the application may stop. The solution for this is to give to the application their own……<\/p>\n","protected":false},"author":50808,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2,159164],"tags":[123648,158997,101611,4619],"coauthors":[6810],"class_list":["post-104164","post","type-post","status-publish","format-standard","hentry","category-blogs","category-microsoft-fabric","tag-data-platform","tag-microsoft-fabric","tag-power-bi","tag-security"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/104164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/users\/50808"}],"replies":[{"embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/comments?post=104164"}],"version-history":[{"count":1,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/104164\/revisions"}],"predecessor-version":[{"id":104174,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/posts\/104164\/revisions\/104174"}],"wp:attachment":[{"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/media?parent=104164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/categories?post=104164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/tags?post=104164"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.red-gate.com\/simple-talk\/wp-json\/wp\/v2\/coauthors?post=104164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}