## Set up Microsoft Fabric

URL: https://docs.atlan.com/apps/connectors/business-intelligence/microsoft-fabric/how-tos/set-up-microsoft-fabric

> Configure Microsoft Fabric authentication and permissions to connect with Atlan.

Configure Microsoft Fabric authentication and permissions to enable metadata extraction and lineage tracking with Atlan.

## Prerequisites

Before you begin, make sure you have:

* Access to Azure portal and Microsoft Fabric admin portal
* Cloud Application Administrator or Application Administrator role in Microsoft Entra ID
* Fabric Administrator privileges in Microsoft Fabric

## Register application in Microsoft Entra ID

Create an application registration to enable service principal authentication with Microsoft Fabric.

1. Log in to the [Azure portal](https://portal.azure.com/).
2. Search for **Microsoft Entra ID** and select it.
3. Click **App registrations** from the left menu.
4. Click **+ New registration**.
5. Enter a name for your client application and click **Register**.
6. From the Overview screen, copy and securely store:
 * **Application (client) ID**
 * **Directory (tenant) ID**
7. Click **Certificates & secrets** from the left menu.
8. Under **Client secrets**, click **+ New client secret**.
9. Enter a description, select an expiry time, and click **Add**.
10. Copy and securely store the client secret **Value**. The client secret value is only displayed once, so make sure to copy and store it securely before leaving this page.

## Create security group in Microsoft Entra ID

Create a security group to manage permissions for your application registration.

1. In the Azure portal, navigate to **Microsoft Entra ID**.
2. Click **Groups** under the Manage section.
3. Click **New group**.
4. Set the **Group type** to **Security**.
5. Enter a **Group name** and optional description.
6. Click **No members selected**.
7. Search for the application registration created earlier and select it.
8. Click **Select** and then **Create**.

## Configure service principal authentication

Grant the service principal the necessary permissions to access Microsoft Fabric resources. The required permissions depend on whether you plan to enable **Scanner API Access** when crawling.

### Enable developer settings

This setting permits the service principal to call Fabric public APIs. It's required for all crawl modes–the connector calls Fabric public APIs during the preflight check and workspace extraction regardless of whether Scanner API is enabled or disabled. Without this setting, authentication fails before any crawl path is reached. For more information, see [Developer admin settings](https://learn.microsoft.com/en-us/fabric/admin/service-admin-portal-developer) in the Microsoft Fabric documentation.

1. Log in to the [Fabric admin portal](https://app.fabric.microsoft.com/home).
2. Click the **Settings** icon on the top panel.
3. Click **Admin Portal** under the **Governance and insights** section.
4. Select **Tenant Settings** from the sidebar.
5. Scroll to **Developer settings**.
6. Expand **Service principals can call Fabric public APIs**.
7. Set the toggle to **Enabled**.
8. Under **Apply to**, select **Specific security groups**.
9. Add the security group you created in the [Create security group](#create-security-group-in-microsoft-entra-id) step.
10. Click **Apply**.

After making these changes, wait 15–30 minutes for the settings to take effect.

### Enable admin API access

These settings are required for all crawl modes.

1. Log in to the [Fabric admin portal](https://app.fabric.microsoft.com/home).
2. Click the **Settings** icon on the top panel.
3. Click **Admin Portal** under the **Governance and insights** section.
4. Select **Tenant Settings** from the sidebar.
5. Under **Admin API settings**, configure the following:

 * **Service principals can access read-only admin APIs**:
 * Set to **Enabled**
 * Add your security group under **Specific security groups**
 * Click **Apply**

 * **Enhance admin APIs responses with detailed metadata**:
 * Set to **Enabled**
 * Add your security group
 * Click **Apply**

 * **Enhance admin APIs responses with DAX and mashup expressions**:
 * Set to **Enabled**
 * Add your security group
 * Click **Apply**

After making these changes, you typically need to wait 15–30 minutes for the settings to take effect across Microsoft's services.

### Scanner API permissions

The **Enable Scanner API Access** toggle in the crawler workflow controls which APIs Atlan uses and which permissions are required.

#### Enable scanner API

Scanner API access is recommended for centralized admin setups. When enabled, Atlan uses only the Power BI Admin Scanner APIs (`POST /admin/workspaces/getInfo`) to extract metadata, eliminating the need for individual workspace permissions.

Required settings (configured in the [Enable admin API access](#enable-admin-api-access) section):
- **Service principals can access read-only admin APIs**: Enabled for your security group
- **Enhance admin APIs responses with detailed metadata**: Enabled for your security group

:::note Limitations when Scanner API is enabled
Report Pages, Report Visuals, and Pipeline Copy Activities aren't cataloged. End-to-end lineage stops at Semantic Models and doesn't extend to Report Pages or Visuals. See [Capabilities & limitations](https://docs.atlan.com/llms/connectors/microsoft-fabric/microsoft-fabric-integration/llms.txt) for details.
:::

#### Disable scanner API

When Scanner API Access is **disabled**, Atlan uses both admin and non-admin APIs for full catalog coverage. **Workspace-level permissions are required** in addition to the admin API settings configured in the [Enable admin API access](#enable-admin-api-access) section.

### Assign workspace permissions

Required only when **Scanner API Access is disabled**.

1. Open the [Microsoft Fabric homepage](https://app.fabric.microsoft.com/home).
2. Navigate to **Workspaces** and select the workspace you want to access from Atlan.
3. Click **Manage Access**.
4. Click **Add people or groups**.
5. Enter the name of your service principal where it says **Enter name or email**.
6. Choose **Viewer** as the role.
7. Click **Add**.

Repeat these steps for each workspace you want Atlan to access.

## Next steps

* [Crawl Microsoft Fabric](https://docs.atlan.com/llms/connectors/microsoft-fabric/crawl-microsoft-fabric/llms.txt): Discover and catalog your Microsoft Fabric workspaces and assets

---