> For the complete documentation index, see [llms.txt](https://docs.decube.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.decube.io/warehouses/microsoft-fabric.md).

# Microsoft Fabric (BETA)

Microsoft Fabric integrates with decube through a service principal, giving your team metadata visibility and governance coverage over Fabric workspaces directly in the data catalog.

## Supported Capabilities

{% tabs %}
{% tab title="Supported Capabilities" %}
**General**

* **Metadata** — metadata extraction and display of asset information (tables, columns, schemas). Types collected: Schema, Table, Column
  {% endtab %}

{% tab title="Not Supported" %}
**General**

* Profiling
* Preview
* Data Quality
* External Table
* Stored Procedure
  {% endtab %}
  {% endtabs %}

{% hint style="warning" %}
The connector may be rate-limited when scanning more than 1,000 workspaces.
{% endhint %}

## Connection Requirements

Connecting Fabric requires credentials you generate in Microsoft Entra ID:

* `Tenant ID`
* `Client ID`
* `Client Secret`

<figure><img src="/files/yj9WnmcGq2hAGhFYuEdq" alt=""><figcaption></figcaption></figure>

### Prerequisites

1. Access to Microsoft Entra ID to create service principals.
2. A Microsoft Fabric-enabled workspace.
3. Admin access (Fabric Administrator role) to change tenant settings.

### Creating a service principal and security group

1. Go to **Microsoft Entra ID**. Under the **Manage** tab on the left, select **App Registrations**.
2. Click **New Registration** at the top of the page.

<figure><img src="/files/y2Qd3c7Otp37LfukttbE" alt=""><figcaption></figcaption></figure>

3. Enter `decube` as the name, then click **Register**.
4. On the **Overview** tab, note the `Client ID` and `Tenant ID` — you'll need these when configuring the connector in decube.

<figure><img src="/files/1g5UY1An9O4pFhJSoj3W" alt=""><figcaption></figcaption></figure>

5. On the left tab, click **Certificates & secrets**, then **New client secret**. Set the description to `decube client secret` and the expiry date to align with your contract term.

<figure><img src="/files/DLocKnd7TMOEG7C9cxKF" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
Copy the client secret value immediately and store it somewhere secure, such as Azure Key Vault. Microsoft Entra ID doesn't display it again, and you'll need it to register the connector in decube.
{% endhint %}

6. Return to the Microsoft Entra ID main page and click **Groups** on the left, then **New Group**.

<figure><img src="/files/jtD5iSR7J3sEg1rHTCMS" alt=""><figcaption></figcaption></figure>

7. Set the group type to **Security**.
8. Click **Members**, then search for the service principal you created (`decube`).
9. Click **Select** to add the service principal to the group.
10. Click **Create**. You now have the Tenant ID, Client ID, and Client Secret needed for the integration.

### Granting the service principal access to Microsoft Fabric

1. On the Microsoft Fabric workspace page, click the **Settings** gear icon in the top-right corner, then select **Admin Portal** under **Governance and Insights**.
2. In the Admin Portal, select **Tenant Settings** in the left sidebar.
3. Search for **Service principals can call Fabric public APIs**.
4. Enable the setting and select **Specific security groups**, then add the group you created earlier.

<figure><img src="/files/LBxAMd0jnoDH9wd16G3r" alt=""><figcaption></figcaption></figure>

5. Enable the following settings as well, under **Admin API**:

* **Service principals can access read-only admin APIs**
* **Enhance admin APIs responses with detailed metadata**
* **Enhance admin APIs responses with DAX and mashup expressions**

### Granting Workspace Access to the Service Principal

Please follow these steps for all of the Workspaces that you want ingested. A user with `Contributor` permissions on the workspace is required to perform this step.

1. In the Microsoft Fabric portal, select `Workspaces` from the left sidebar to view available workspaces.
2. Hover over the workspace name that you want ingested and select the `...` ellipsis menu that appears. Click `Workspace access`. (Alternatively, if you are already inside the workspace, you can select `Manage access` in the top right corner).

<figure><img src="/files/JRTV6afiBDs4aZ0jvZE9" alt=""><figcaption></figcaption></figure>

3. The `Manage access` panel will open on the right side of the screen. Click `Add people or groups`. In the search field, search for the name of the service principal created earlier (in this case, `decube`).
4. Change the access role drop down to `Contributor`, then finally, click on `Add`.

<figure><img src="/files/HMIWkiXmylCPuLoJopnX" alt=""><figcaption></figcaption></figure>