The step that stalls Fabric data tools isn’t the tool. It’s the identity. Fabric’s SQL endpoints take no SQL logins, so an unattended tool needs an Entra ID service principal, and three different admins usually hold the three permissions it needs.
Here are Microsoft’s documented steps, checked November 3, 2026.
1. Register the app (Entra administrator)
From Register a Microsoft Entra app and create a service principal:
- Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.
- Go to Entra ID > App registrations > New registration. Name it for the tool, such as
testgen-fabric-reader, and choose Accounts in this organizational directory only. - From the app’s overview page, copy the Directory (tenant) ID and Application (client) ID.
- Under Certificates & secrets, add a credential. Microsoft recommends a certificate from a trusted certificate authority. For a New client secret, pick a duration and copy the value right away: it’s shown only once.
Registering the app creates its service principal. Store the secret in a vault, not in a pipeline file.
2. Allow service principals in Fabric (Fabric administrator)
From Fabric’s developer admin settings:
- Create a security group, such as
fabric-service-principals, and add the service principal. - In tenant settings, under developer settings, enable Service principals can call Fabric public APIs for that group.
That setting is enabled by default for new customers, but it’s scoped to security groups, so check that your principal’s group is allowed. Older Microsoft pages and TestGen’s docs call it “Service principals can use Fabric APIs.” A separate setting, disabled by default for new customers, lets service principals create workspaces, connections, and deployment pipelines. A read-only tool doesn’t need it.
3. Add it to the workspace (workspace admin)
In the Fabric workspace, choose Manage access, add the service principal, and pick a role. Microsoft’s service principal guide says a workspace Administrator can grant this. Give it the smallest role the tool documents and only the workspaces it should read.
4. Connect the tool
| Field | Value |
|---|---|
| Server | The workspace’s SQL connection string, port 1433 |
| Database | The lakehouse or warehouse name |
| Authentication | Microsoft Entra service principal |
| User name | Application (client) ID |
| Password | The client secret |
| Tenant | Directory (tenant) ID, where the tool asks for it |
SQL Server Management Studio 19 and later use exactly these fields. If you get “Authentication was successful, but the database was not found,” check the database name: since May 2026, a connection without one goes to master, per Microsoft’s connectivity page.
For DataOps TestGen
TestGen’s Access Requirements for Microsoft OneLake are the principal from step 1, the tenant setting from step 2, and Contributor or higher on the workspace in step 3. No item-level permissions are needed. TestGen then runs only SELECT statements through the SQL analytics endpoint, against both lakehouse and warehouse tables.
Send your Fabric admin this page with the three asks. Then follow the Fabric warehouse answer or the OneLake setup answer, and install from the Microsoft Fabric or OneLake page. Open source is free for one connection.