## Set up Microsoft Fabric with Azure API Management URL: https://docs.atlan.com/apps/connectors/business-intelligence/microsoft-fabric/how-tos/set-up-microsoft-fabric-with-apim > Configure Azure API Management (APIM) as a gateway for Microsoft Fabric API traffic to connect with Atlan using managed identity authentication Configure Azure API Management (APIM) as a gateway so that Atlan can connect to Microsoft Fabric using managed identity authentication instead of a direct service principal. This setup is for customers who route Fabric API traffic through APIM. ## Prerequisites Before you begin, make sure you have: * Access to the Azure portal and an active Azure subscription * Permission to create resources in an Azure resource group * Fabric Administrator privileges in the Microsoft Fabric admin portal * Cloud Application Administrator or Application Administrator role in Microsoft Entra ID ## Create APIM service Create an Azure API Management service that acts as the gateway between Atlan and the Microsoft Fabric APIs. 1. Log in to the [Azure portal](https://portal.azure.com/). 2. Search for **API Management services** and select it. 3. Click **+ Create**. 4. Select your **Subscription** and **Resource group** (for example, `atlan-prod`). 5. Enter a **Name** for your APIM instance (for example, `atlan-fabric-apim-dev`). 6. Choose the **Region**, **Organization name**, and **Administrator email**. 7. Select the **Pricing tier** that meets your SLA requirements. 8. Click **Review + create**, then **Create**. Deployment typically takes 30–60 minutes. Azure sends a confirmation email to the administrator email address when it's complete. Once deployment completes, your APIM gateway URL follows this format: `https://.azure-api.net/fabric/v1` ## Enable system-assigned managed identity Enable a system-assigned managed identity on your APIM instance. This identity is used by APIM to obtain tokens from Microsoft Entra ID and call the Fabric and Power BI admin APIs on Atlan's behalf. 1. In the Azure portal, navigate to your APIM instance. 2. Click **Managed identities** in the left menu. 3. Under **System assigned**, set the **Status** toggle to **On**. 4. Click **Save**. 5. Copy and store the **Object (principal) ID** that appears—you'll need it when adding the APIM identity to workspaces and security groups. ## Define API endpoints in APIM Define the Fabric and Power BI API endpoints in your APIM instance, and configure inbound policies so that APIM uses managed identity authentication when forwarding requests. ### Import via OpenAPI spec You can add all API operations at once by uploading an OpenAPI specification file. #### Fabric APIs > *fabric-apis.yaml — see full content on the documentation site.* 1. Copy the specification and save it as `fabric-apis.yaml` on your machine. Replace `` with your APIM instance name. 2. In your APIM instance, click **APIs** in the left menu. 3. Click **+ Add API** and select **OpenAPI**. 4. Click **Select a file** and upload the `fabric-apis.yaml` file you saved. 5. Set the **Display name** to `Fabric APIs` and the **API URL suffix** to `fabric/v1`. 6. Click **Create**. #### Power BI API > *powerbi-api.yaml — see full content on the documentation site.* 1. Copy the specification and save it as `powerbi-api.yaml` on your machine. Replace `` with your APIM instance name. 2. Click **+ Add API** and select **OpenAPI**. 3. Click **Select a file** and upload the `powerbi-api.yaml` file you saved. 4. Set the **Display name** to `Power BI API` and the **API URL suffix** to `powerbi/v1.0`. 5. Click **Create**. ### Add API operations manually To add operations one by one, create two APIs with the following configuration and add each operation individually. #### Fabric APIs **API settings:** - **Display name:** `Fabric APIs` - **Web service URL:** `https://api.fabric.microsoft.com/v1` - **API URL suffix:** `fabric/v1` **Operations to add:** | Display name | Method | URL template | |---|---|---| | GetAdminItems | GET | `/admin/items` | | ListLakehouses | GET | `/workspaces/{workspace_id}/lakehouses` | | ListWarehouses | GET | `/workspaces/{workspace_id}/warehouses` | | ListDataPipelines | GET | `/workspaces/{workspace_id}/dataPipelines` | | ListSemanticModels | GET | `/workspaces/{workspace_id}/semanticModels` | | ListReports | GET | `/workspaces/{workspace_id}/reports` | | GetPipelineDefinition | POST | `/workspaces/{workspace_id}/dataPipelines/{pipeline_id}/getDefinition` | | GetSemanticModelDefinition | POST | `/workspaces/{workspace_id}/semanticModels/{model_id}/getDefinition` | | GetReportDefinition | POST | `/workspaces/{workspace_id}/reports/{report_id}/getDefinition` | | TriggerWorkspaceScan | POST | `/workspaces/getInfo` | | GetScanStatus | GET | `/workspaces/scanStatus/{scan_id}` | | GetScanResult | GET | `/workspaces/scanResult/{scan_id}` | | GetSQLToken | GET | `/token/sql` | | GetLROStatus | GET | `/operations/{operation_id}` | | GetLROResult | GET | `/operations/{operation_id}/result` | #### Power BI API **API settings:** - **Display name:** `Power BI API` - **Web service URL:** `https://api.powerbi.com/v1.0` - **API URL suffix:** `powerbi/v1.0` **Operations to add:** | Display name | Method | URL template | |---|---|---| | TriggerWorkspaceScan | POST | `/workspaces/getInfo` | | GetScanStatus | GET | `/workspaces/scanStatus/{scan_id}` | | GetScanResult | GET | `/workspaces/scanResult/{scan_id}` | | GetDataflows | GET | `/dataflows` | | GetDataflowDefinition | GET | `/myorg/groups/{workspace_id}/dataflows/{dataflow_id}` | | GetDataflowDefinitionAdmin | GET | `/dataflows/{dataflow_id}/export` | ## Apply managed identity policies Apply an inbound policy to each API so that APIM automatically obtains a managed identity token and forwards it as a `Bearer` token to the backend. ### Fabric APIs policy 1. In your APIM instance, click **APIs** and select the **Fabric APIs** API. 2. Click **All operations**. 3. In the **Inbound processing** section, click the **Policy editor** (``) icon. 4. Replace the default policy with the following: ```xml @("Bearer " + (string)context.Variables["fabric-token"]) ``` 5. Click **Save**. ### Fabric SQL token policy The `GetSQLToken` operation requires a separate policy because it returns a SQL access token (for Warehouse connections) directly from the managed identity, rather than forwarding to the Fabric backend. 1. Select the **Fabric APIs** API and click the **GetSQLToken** operation. 2. In the **Inbound processing** section, click the **Policy editor** (``) icon. 3. Replace the policy with the following: ```xml application/json @("{\"access_token\":\"" + (string)context.Variables["sql-token"] + "\",\"token_type\":\"Bearer\",\"expires_in\":3600}") ``` 4. Click **Save**. ### Power BI API policy 1. Select the **Power BI API** and click **All operations**. 2. In the **Inbound processing** section, click the **Policy editor** (``) icon. 3. Replace the policy with the following: ```xml @("Bearer " + (string)context.Variables["pbi-token"]) ``` 4. Click **Save**. ## Create security group in Microsoft Entra ID Create a security group in Microsoft Entra ID that includes the APIM managed identity. You'll use this group to grant access in the Fabric tenant settings. 1. In the Azure portal, navigate to **Microsoft Entra ID**. 2. Click **Groups** under the **Manage** section. 3. Click **+ New group**. 4. Set the **Group type** to **Security**. 5. Enter a **Group name** (for example, `fabric-apim`) and an optional description. 6. Click **No members selected**. 7. Search for your APIM instance by name (for example, `atlan-fabric-apim-dev`) and select it. 8. Click **Select**, then click **Create**. ## Configure Fabric tenant settings Grant the APIM managed identity permission to call Fabric admin APIs and access workspaces. ### Enable service principal access in Fabric By default, service principals can't interact with Fabric APIs. A Fabric Administrator must enable this setting before the APIM managed identity can be used. 1. Log in to [Microsoft Fabric](https://app.fabric.microsoft.com/home). 2. Click the **Settings** icon on the top panel. 3. Click **Admin Portal** under the **Governance and insights** section. 4. Select **Tenant settings** from the sidebar. 5. Under **Developer settings**, find **Service principals can use Fabric APIs**. 6. Set it to **Enabled**. 7. Under **Apply to**, select **Specific security groups** and add your `fabric-apim` security group. 8. Click **Apply**. ### Enable admin API access 1. In the same **Tenant settings** page, under **Admin API settings**, configure the following: * **Service principals can access read-only admin APIs**: * Set to **Enabled** * Add your `fabric-apim` security group under **Specific security groups** * Click **Apply** * **Enhance admin APIs responses with detailed metadata**: * Set to **Enabled** * Add your `fabric-apim` security group * Click **Apply** * **Enhance admin APIs responses with DAX and mashup expressions**: * Set to **Enabled** * Add your `fabric-apim` security group * Click **Apply** After making these changes, wait 15–30 minutes for the settings to propagate across Microsoft's services. ### Add APIM identity to workspaces :::note Workspace-level permissions are only required when **Scanner API Access is disabled** in the crawler. If you plan to use Scanner API mode, you can skip this step. See [Does enabling Scanner API Access affect which permissions are required?](https://docs.atlan.com/llms/connectors/microsoft-fabric/microsoft-fabric-integration/llms.txt) for details. ::: Grant the APIM managed identity access to each Fabric workspace you want Atlan to catalog. 1. Open the [Microsoft Fabric homepage](https://app.fabric.microsoft.com/home). 2. Navigate to **Workspaces** and open the workspace you want to catalog. 3. Click **Manage access**. 4. Click **Add people or groups**. 5. Search for the name of your APIM instance (for example, `atlan-fabric-apim-dev`). 6. Select it and assign the **Viewer** role. 7. Click **Add**. Repeat these steps for each workspace you want Atlan to access. ## Verify what Atlan accesses—and how to confirm it A common concern when granting a third-party tool access to your data platform is: **how do I know it's only reading metadata and not touching actual data?** With APIM in place, every API call Atlan makes passes through your gateway. This means you have full, independent visibility into what's being called and what's being returned—without relying on Atlan to tell you. Your security and governance teams can verify this at any time, on their own. There are three ways to do this, ranging from quick spot-checks to full audit trails: 1. **APIM Test tab**: Call any of Atlan's APIs yourself from the Azure portal and inspect the raw response 2. **APIM built-in Analytics**: A lightweight dashboard showing which APIs were called, when, and from where 3. **Application Data Exploration**: A detailed, real-time feed of every request, including the full request URL, response code, and response body All three confirm the same thing: Atlan only calls metadata APIs. The responses contain asset names, IDs, types, and states—not table rows, not column values, not any actual business data. ### APIM Test tab You don't need to wait for Atlan to run a crawl. You can call any of Atlan's APIs directly from the Azure portal and see exactly what they return. 1. In your APIM instance, click **APIs** in the left menu. 2. Select **Fabric Admin API**. 3. Click any operation—for example, **GetAdminItems**. 4. Click the **Test** tab. 5. Fill in any required parameters (for example, `workspaceId`). 6. Click **Send**. The response panel shows the full HTTP response: status code, all response headers, and the raw JSON body. You'll see entries like this: ```json { "id": "63ae6cfc-d263-4eb3-a439-b353a60ffb3a", "type": "Lakehouse", "name": "fabric_lakehouse", "state": "Active", "workspaceId": "d5179b08-03ca-474c-9849-e54596f0f992" } ``` Notice what's **not** here: no table rows, no column values, no business records. These are the same asset names and IDs you see in the Fabric admin portal. #### Use Trace to see full request lifecycle Instead of clicking **Send**, click **Trace**. This shows the complete internal lifecycle of the request through APIM: - **Inbound**: the request as it arrived at the gateway, including all headers, policies that ran (such as the managed identity token being fetched), and the final URL forwarded to the back end - **Back end**: the exact request that was sent to `api.fabric.microsoft.com` or `api.powerbi.com`, with all headers - **Outbound**: the response as it came back from the back end, before being returned to Atlan This is useful for confirming that the managed identity policy is working correctly and that requests are being routed to the right back end. ### APIM built-in Analytics APIM includes a built-in analytics dashboard that requires no additional setup. After Atlan runs a crawl, you can see a summary of all API activity at a glance. 1. In your APIM instance, click **Analytics** under the **Monitoring** section in the left menu. 2. If prompted, connect a Log Analytics workspace: - Click **Collect data from a resource** - Select an existing Log Analytics workspace or create a new one - Click **Save** - Allow 2–3 hours for data to begin appearing after first connecting The Analytics page shows: - **Timeline**: when requests were made during a crawl - **Geography**: where requests originated from - **APIs**: which specific APIs were called (Fabric APIs, Power BI API) - **Operations**: which operations within each API were used (for example, `GetAdminItems`, `GetScanResult`) - **Subscriptions**: which subscription key was used (useful to confirm all requests came from Atlan's subscription) The **Analytics (classic)** tab shows the same information using an older format built directly into APIM, with no Log Analytics workspace needed. It's scheduled to be retired in March 2027. ### Application Data Exploration (full audit trail) Application Data Exploration provides the deepest level of visibility: a complete, real-time audit trail of every single API request, including the full response body. This is what your security team needs to confirm, line by line, what Atlan retrieved from the Fabric APIs. #### Create workspace for log storage Application Data Exploration requires a Log Analytics workspace to store data. You can create a separate one to keep this data isolated. 1. In the Azure portal, search for **Log Analytics workspaces** and select it. 2. Click **+ Create**. 3. Select your **Subscription** and **Resource group**. 4. Enter a **Name** (for example, `atlan-fabric-apim-logs`). 5. Choose the same **Region** as your APIM instance. 6. Click **Review + create**, then **Create**. Data takes 2–3 hours to appear after the workspace is ready. #### Create application insights resource 1. In the Azure portal, search for **Application Data Exploration** and select it. 2. Click **+ Create**. 3. Select your **Subscription** and **Resource group**. 4. Enter a **Name** (for example, `atlan-fabric-apim-insights`). 5. Under **Log Analytics workspace**, select the workspace you just created (or create a new dedicated one to keep the data separate from other resources). 6. Click **Review + create**, then **Create**. #### Connect application data exploration to your APIM instance 1. Navigate to your APIM instance in the Azure portal. 2. Click **Application Data Exploration** under the **Monitoring** section in the left menu. 3. Click **+ Add**. 4. Select the Application Data Exploration resource you just created. 5. Enable the following: - **Enable default logging**: collects data for all APIs automatically. Keep this on. - **Add availability monitor**: periodically checks that your APIM gateway is reachable. Recommended for production. 6. Click **Create**. #### Configure logging to capture full request and response data By default, Application Data Exploration doesn't collect headers or response body payloads. You need to enable this explicitly to see the full picture. 1. In your APIM instance, click **APIs** in the left menu. 2. Select **All APIs** to configure globally (you can also override per API). 3. Click **Settings** and scroll to the **Application Data Exploration** section. Configure the following: - Set **Application Data Exploration** to **Enabled**. - Set **Destination** to your Application Data Exploration resource. - Set **Sampling (%)** to **100** to capture every request during initial verification. Reduce to 50 once satisfied; App Data Exploration uses statistical analysis so 50% is sufficient for ongoing monitoring. - Turn on **Always log errors** to capture all failed requests regardless of sampling rate. - Turn on **Log client IP** to log where each request originated from. - Set **Verbosity** to **Verbose** to capture full request and response data including headers and body. Switch to **Basic** for lower overhead once verification is complete. - Set **Correlation protocol** to **W3C** to enable end-to-end tracing so each crawl run can be followed as a single transaction chain across the gateway and back end. 4. Expand the **Additional settings** section and enable payload and header logging for all four points in the API lifecycle: - **Frontend request**: the request as it arrives at APIM from Atlan - **Frontend response**: the response APIM sends back to Atlan - **Back-end request**: the request APIM forwards to `api.fabric.microsoft.com` - **Back-end response**: the raw response from the Fabric API 5. Click **Save**. #### Inspect data after crawl After Atlan runs a crawl, navigate to your Application Data Exploration resource. Allow a few minutes for data to populate. ##### Performance view See every operation Atlan called. Go to **Investigate → Performance**. This lists every API operation that ran through your APIM gateway with operation name, average duration, and call count. Filter by time range to scope to a specific crawl. You'll see operations like: - `getadminitems`: fetches workspace asset inventory (names, IDs, types) - `getscanresult`: retrieves the scanner API result (workspace metadata) - `getsemanticmodeldefinition`: retrieves semantic model structure ##### Dependencies view See the exact back-end URLs called. Click the **Dependencies** tab. This shows the actual back-end URLs that APIM forwarded requests to, for example: - `Backend (https://api.fabric.microsoft.com): GET /v1/admin/items` - `Backend (https://api.fabric.microsoft.com): GET /v1/admin/workspaces/scanResult/{scan_id}` This confirms Atlan is only hitting Microsoft's official admin endpoints—not any data plane endpoints, not any storage or SQL endpoints, not any endpoint that returns row-level data. ##### End-to-end transaction details See the full response body for any individual request. Click any operation in the Performance view, then select a specific request to open the **End-to-end transaction details**. This shows: - The exact URL that was called - The HTTP response code - All request and response headers - The full **Response Body**: the raw JSON Atlan received The response body for a metadata API looks like this (asset names, IDs, and states—no data values): ```json { "id": "63ae6cfc-d263-4eb3-a439-b353a60ffb3a", "type": "Lakehouse", "name": "fabric_lakehouse", "state": "Active", "workspaceId": "d5179b08-03ca-474c-9849-e54596f0f992", "creatorPrincipal": { "id": "...", "type": "User" } } ``` ##### Application map Visualize how Atlan connects to back-end services. Go to **Application map** in the left menu. This shows a diagram of your APIM instance and all the back-end services it communicated with (Fabric API, Power BI API). It's a quick visual confirmation that Atlan's requests stayed within the expected boundaries. ##### Transaction search Search and filter all requests. Go to **Transaction search** to see all individual API calls. You can filter by time range, operation name, response code, and more. Click any entry to open the full end-to-end transaction detail. ## Next steps * [Crawl Microsoft Fabric](https://docs.atlan.com/llms/connectors/microsoft-fabric/crawl-microsoft-fabric/llms.txt): Discover and catalog your Microsoft Fabric workspaces and assets using the APIM connection ---