Runing Notebooks under SPN

[wojciech]

Hi,

Does anyone know whether it's possible to run Fabric notebooks under the security context of a Service Principal (SPN), either:

• Directly via a scheduler

• Within a pipeline activity

• Via an API

I've found a few resources but haven't come across a definitive answer on whether it's supported - and if it is, what the preferred method would be.

Can anyone advise?

Thanks,
WJ

[v-achippa · Accepted solution]

Hi @wojciech,

Thank you for reaching out to Microsoft Fabric Community.

Currently running notebooks directly under an SPN context or running notebooks standalone using SPN is not supported. Notebooks always run under the identity of the user or the pipeline that triggers them.

The supported approach is to use the notebook in a Fabric pipeline and then trigger the pipeline using the Fabric REST API using SPN authentication.

• Create a pipeline that includes the notebook as an activity.
• Assign permissions to the Service Principal on the Fabric workspace like Contributor role or higher.
• Use the REST API to trigger the pipeline run using an AAD access token for the SPN.

If this post helps in resolving the issue, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it! 

Thanks and regards,

Anjan Kumar Chippa

[youdao4]

Thank you for the clear explanation, Anjan 🙌
Using the pipeline approach with SPN and REST API makes sense now. I’ll try triggering the notebook via Fabric pipeline as suggested and make sure the SPN has the necessary permissions.

Appreciate the detailed steps and clarification!

[yashaswi_raj]

Hi @v-achippa , Currently we have a
1)  ADF managed identity which has been given contributor access over the Fabric workspace where my fabric pipeline is.
2) We are using Fabric Rest API to call the fabric pipeline from adf using web activity and managed identity authenntication .
3) we see that the Fabirc Pipeline runs under the Managed identity context but the fabric notebook withing it , still takes the authentication of the person who last saved the fabric pipeline.

so it doesn't works according to your solution , please tell if i am wrong?

[v-achippa]

Hi @yashaswi_raj,

Thank you for reaching out to Microsoft Fabric Community.

Yes currently while a pipeline can be triggered using a Service Principal or Managed Identity, any notebook activity inside it will still run under the identity of the user who last saved the pipeline, this is by design in fabric.
If you need notebooks to run fully under a Service Principal or Managed Identity context, that is not supported yet. I recommend submitting your detailed feedback and ideas through Microsoft's official feedback channels. Feedback submitted through these channels is frequently reviewed by the product teams and can contribute to meaningful improvements.

Fabric Ideas - Microsoft Fabric Community

Thanks and regards,

Anjan Kumar Chippa

[wojciech]

 Thanks @v-achippa for claryfying... much appreciated