Set up Microsoft Fabric

✦TL;DR

Configure Microsoft Fabric authentication and permissions to connect with Atlan. The Microsoft Fabric connector is generally available, and Atlan is available in the Microsoft Marketplace and is Microsoft Azure co-sell eligible.

||

Your AI can read this via Docs MCPcurl -fsSL "https://docs.atlan.com/install-docs-mcp" | bashConnect

Configure Microsoft Fabric authentication and permissions to enable metadata extraction and lineage tracking with Atlan.

Prerequisites

Before you begin, make sure you have:

• Access to Azure portal and Microsoft Fabric admin portal
• Cloud Application Administrator or Application Administrator role in Microsoft Entra ID
• Fabric Administrator privileges in Microsoft Fabric

Register application in Microsoft Entra ID

Create an application registration to enable service principal authentication with Microsoft Fabric.

1. Log in to the Azure portal.
2. Search for Microsoft Entra ID and select it.
3. Click App registrations from the left menu.
4. Click + New registration.
5. Enter a name for your client application and click Register.
6. From the Overview screen, copy and securely store:
   • Application (client) ID
   • Directory (tenant) ID
7. Click Certificates & secrets from the left menu.
8. Under Client secrets, click + New client secret.
9. Enter a description, select an expiry time, and click Add.
10. Copy and securely store the client secret Value. The client secret value is only displayed once, so make sure to copy and store it securely before leaving this page.

Create security group in Microsoft Entra ID

Create a security group to manage permissions for your application registration.

1. In the Azure portal, navigate to Microsoft Entra ID.
2. Click Groups under the Manage section.
3. Click New group.
4. Set the Group type to Security.
5. Enter a Group name and optional description.
6. Click No members selected.
7. Search for the application registration created earlier and select it.
8. Click Select and then Create.

Configure service principal authentication

Grant the service principal the necessary permissions to access Microsoft Fabric resources. The required permissions depend on whether you plan to enable Scanner API Access when crawling.

Enable developer settings

This setting permits the service principal to call Fabric public APIs. It's required for all crawl modes–the connector calls Fabric public APIs during the preflight check and workspace extraction regardless of whether Scanner API is enabled or disabled. Without this setting, authentication fails before any crawl path is reached. For more information, see Developer admin settings in the Microsoft Fabric documentation.

1. Log in to the Fabric admin portal.
2. Click the Settings icon on the top panel.
3. Click Admin Portal under the Governance and insights section.
4. Select Tenant Settings from the sidebar.
5. Scroll to Developer settings.
6. Expand Service principals can call Fabric public APIs.
7. Set the toggle to Enabled.
8. Under Apply to, select Specific security groups.
9. Add the security group you created in the Create security group step.
10. Click Apply.

After making these changes, wait 15–30 minutes for the settings to take effect.

Enable admin API access

These settings are required for all crawl modes.

1. Log in to the Fabric admin portal.

2. Click the Settings icon on the top panel.

3. Click Admin Portal under the Governance and insights section.

4. Select Tenant Settings from the sidebar.

5. Under Admin API settings, configure the following:

   • Service principals can access read-only admin APIs:

     • Set to Enabled
     • Add your security group under Specific security groups
     • Click Apply

   • Enhance admin APIs responses with detailed metadata:

     • Set to Enabled
     • Add your security group
     • Click Apply

   • Enhance admin APIs responses with DAX and mashup expressions:

     • Set to Enabled
     • Add your security group
     • Click Apply

After making these changes, you typically need to wait 15–30 minutes for the settings to take effect across Microsoft's services.

Scanner API permissions

The Enable Scanner API Access toggle in the crawler workflow controls which APIs Atlan uses and which permissions are required.

Enable scanner API

Scanner API access is recommended for centralized admin setups. When enabled, Atlan uses the Power BI Admin Scanner APIs (POST /admin/workspaces/getInfo) to extract most metadata in bulk.

Required settings (configured in the Enable admin API access section):

• Service principals can access read-only admin APIs: Enabled for your security group
• Enhance admin APIs responses with detailed metadata: Enabled for your security group

Workspace permissions are still required in this mode. The Scanner APIs don't return lakehouse and warehouse tables and columns, so Atlan reads them from each lakehouse and warehouse directly. See Assign workspace permissions.

Limitations when Scanner API is enabled

Report Pages, Report Visuals, and Pipeline Copy Activities aren't cataloged. End-to-end lineage stops at Semantic Models and doesn't extend to Report Pages or Visuals. Dataflow Gen2 (CI/CD) items are cataloged without entity columns or lineage unless you also assign the Contributor role on their workspaces (see What Atlan extracts by workspace role). See Capabilities & limitations for details.

Disable scanner API

When Scanner API Access is disabled, Atlan uses both admin and non-admin APIs for full catalog coverage. Workspace-level permissions are required in addition to the admin API settings configured in the Enable admin API access section.

Assign workspace permissions

A workspace role is required in both modes, whether Scanner API Access is enabled or disabled. The role you choose determines what Atlan extracts from the workspace.

1. Open the Microsoft Fabric homepage.
2. Navigate to Workspaces and select the workspace you want to access from Atlan.
3. Click Manage Access.
4. Click Add people or groups.
5. Enter the name of the security group you created in Create security group, or of your service principal, where it says Enter name or email.
6. Choose the role based on what you want Atlan to extract from the workspace. See What Atlan extracts by workspace role:
   • Choose Contributor if you need report pages and visuals; pipeline, shortcut, mirrored database, or Dataflow Gen2 (CI/CD) lineage; semantic model tables when Scanner API Access is disabled; or Spark runtime lineage from a Runtime Lineage item in this workspace.
   • Choose Viewer if lakehouse, warehouse, and mirrored database tables and columns are enough, along with semantic model tables and their lineage to lakehouse and warehouse tables when Scanner API Access is enabled.
7. Click Add.

Repeat these steps for each workspace you want Atlan to access.

tip

Adding the security group instead of the service principal makes later changes easier. For example, if you replace the service principal, you only update the group's members, not each workspace.

What Atlan extracts by workspace role

Atlan only reads metadata, but Fabric controls access to some of it through workspace roles:

• Tables, views, and columns: Atlan reads lakehouse, warehouse, and mirrored database tables, views, and columns from each item's SQL analytics endpoint. The Scanner APIs don't return them, and the endpoint requires a workspace role.
• Definitions and shortcut targets: Fabric returns semantic model, report, pipeline, mirrored database, and Dataflow Gen2 (CI/CD) definitions, and where shortcuts point, only to identities that can edit the item. No admin API returns them.

The following table shows what Atlan extracts from a workspace, depending on the crawl identity's role on it. With a lower role, the crawl still succeeds, but Atlan extracts less from that workspace.

Capability	No role ¹	Viewer	Contributor
Catalog Workspace items (lakehouses, warehouses, mirrored databases, semantic models, reports, dashboards, dataflows, pipelines)	✅ Scanner API enabled only	✅ Available	✅ Available
Catalog Lakehouse and Warehouse tables, views, and columns	❌ Not available	✅ Available	✅ Available
Catalog Mirrored database tables, views, and columns	❌ Not available	✅ Available	✅ Available
Catalog Semantic Model tables, columns, and measures	✅ Scanner API enabled only	✅ Scanner API enabled only	✅ Available
Catalog Report Pages and Visuals ²	❌ Not available	❌ Not available	✅ Available
Catalog Dataflow Gen2 (CI/CD) entity columns	❌ Not available	❌ Not available	✅ Available
Lineage: Lakehouse/Warehouse/Mirrored database → Semantic Model	❌ Not available	✅ Scanner API enabled only	✅ Available
Lineage: Semantic Model → Report Page or Visual ²	❌ Not available	❌ Not available	✅ Available
Lineage: Pipeline Copy Activity ²	❌ Not available	❌ Not available	✅ Available
Lineage: Dataflow Gen2 (CI/CD) → destination lakehouse or warehouse table	❌ Not available	❌ Not available	✅ Available
Lineage: source table → OneLake shortcut table	❌ Not available	❌ Not available	✅ Available
Lineage: source table → mirrored database table ⁴	❌ Not available	❌ Not available	✅ Available
Catalog Notebooks and Spark jobs ³	❌ Not available	✅ Available	✅ Available
Lineage: Notebook Spark job (table and column) ³	❌ Not available	✅ Available	✅ Available

¹ When Scanner API Access is disabled, Atlan doesn't crawl a workspace where the crawl identity has no role. In either mode, the crawl identity needs a role on at least one workspace, or the preflight check fails.

² Available only when Scanner API Access is disabled. See Scanner API permissions.

³ Requires Extract Spark runtime lineage in the crawler, in either mode. Atlan reads lineage events from the workspace that contains the Runtime Lineage item, which needs the Contributor role. With this option on, every crawled workspace needs the Viewer or Contributor role; if a workspace has no role, the crawl fails. See Set up Spark runtime lineage.

⁴ For supported mirroring sources. With the Viewer role, Atlan catalogs the mirrored database's tables and columns but might not show its Mirroring source or draw upstream lineage. See Mirrored database lineage.

Next steps

• Crawl Microsoft Fabric: Discover and catalog your Microsoft Fabric workspaces and assets
• Set up Spark runtime lineage: Capture lineage from notebook Spark jobs before crawling