M↓ View as Markdown ↗

Microsoft Fabric¶

Actian AI Analyst connects directly to your Microsoft Fabric data warehouse using a service principal from your Microsoft Entra ID tenant. Fabric connections support service principal authentication only.

Availability

Who can do this: members with the Edit capability in the active Workspace. If your organization has turned on Restrict connection management, you also need the Manage organization capability.
Plan: Studio lists only the connectors that your organization's plan and your deployment include. If Microsoft Fabric is missing from the list, ask your administrator.
Deployment: Actian SaaS and self-managed deployments.

To connect Microsoft Fabric, you:

Create an app registration in Microsoft Entra ID.
Note its tenant and client IDs.
Create a client secret.
Grant the service principal read access to your Fabric warehouse.
Allow AI Analyst's IP addresses through any network rules on your Fabric endpoint.
Add the connection in Studio.

Read-only access depends on the service principal

Fabric has no read-only session that AI Analyst can switch on, so the service principal's permissions are the only safeguard. The connection form shows: This Connector cannot enforce read-only access itself. Supply a warehouse user that is limited to read-only privileges. See Read-only access.

1. Create an app registration in Microsoft Entra ID¶

Go to the Azure portal → Microsoft Entra ID → App registrations.
Click New registration.
- Name: can be anything, for example actian-analyst-fabric-access.
- Supported account types: Single tenant.
- Redirect URI: leave blank.

2. Note your tenant and client IDs¶

After you create the app, copy:

Directory (tenant) ID
Application (client) ID

You need these later for the AI Analyst connection form.

3. Create a client secret¶

In your app registration, go to Certificates & secrets.
Under Client secrets, click New client secret.
Add a description (for example actian-analyst-fabric-secret) and choose an expiry period.
Copy the Value (not the Secret ID) immediately and store it securely. You can't view the value again once you leave the page.

Tip

When the secret expires, the connection stops working. Create a new secret before then and update the connection's credentials in Studio. See Manage connections.

4. Grant the service principal read access¶

Run the following commands in your Fabric warehouse to grant read access:

CREATE USER [<service-principal-name>] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [<service-principal-name>];

Replace <service-principal-name> with your app registration's display name.
Grant only db_datareader, or SELECT on the specific schemas you want to expose.
Don't grant db_owner or any role that can write. AI Analyst never needs them.

5. Allow AI Analyst to reach Fabric¶

If network rules restrict access to your Fabric SQL endpoint, allow inbound connections on port 1433 from AI Analyst's outbound IP addresses:

Actian SaaS: when your deployment publishes its outbound addresses, the Setup help panel next to the connection form lists them under Which IPs to allow. If the panel doesn't list any addresses, contact Actian support for them.
Self-managed deployment: allow the outbound addresses of your own AI Analyst installation.

See Network access for details.

6. Add the connection in Studio¶

In Studio, open Connections, click + (Add connection) and choose Microsoft Fabric under Warehouses.
Under Connection details, enter a Name. This is how the connection appears in AI Analyst. Names must be unique among the connections you can see. See Connections and Workspaces. Optionally add a Description.
Optionally, tick Private to this Workspace so that only the active Workspace can see and use the connection. See Who can see the connection.

Under Credentials, fill in the fields:

Field	Value
Host	Your Fabric warehouse SQL endpoint hostname (ends with `.datawarehouse.fabric.microsoft.com`)
Port	`1433` by default
Database	The Fabric warehouse name
Tenant ID	Directory (tenant) ID from step 2
Client ID	Application (client) ID from step 2
Client secret	Secret value from step 3
SSL mode	Require by default. See SSL mode.

Instead of typing each field, you can click Paste a connection string, paste a string such as Server=tcp:host.datawarehouse.fabric.microsoft.com,1433;Database=warehouse;User ID=client-id@tenant-id;Password=client-secret;Encrypt=True, and click Fill the form. Studio reads User ID as the client ID (and tenant ID after @) and Password as the client secret. Nothing is sent until you test the connection.

Click Test connection. When the test succeeds, Schemas appears and lists the schemas the service principal can see. dbo is selected if it exists.
The preselected schema (dbo) is exposed by default. To change it, select the schemas to expose for browsing and model authoring. Changing the selection resets the test, so click Test connection again afterwards. Your selection is kept. If nothing is preselected because dbo doesn't exist, select at least one schema before you save.
Click Save connection. The button stays disabled until a test succeeds and the connection has a name.

Studio opens the new connection. Credentials are encrypted at rest and are never shown again after saving. To browse tables, re-test the connection or update credentials later, see Manage connections.

SSL mode¶

The SSL mode options behave as follows for Fabric:

SSL mode	Encrypts the connection	Verifies the server certificate
Disable	No	No
Require (default)	Yes	Yes
Require (no verify)	Yes	No
Verify CA	Yes	No. It behaves like Require (no verify).
Verify full	Yes	Yes

Keep the default Require unless you have a specific reason to change it. If your endpoint uses a certificate that AI Analyst can't verify, Require (no verify) keeps the connection encrypted without verifying it. Uploading a CA certificate or a client certificate is not supported.

Who can see the connection¶

A new connection is attached to the Workspace you are working in.

Organization connection (default): an organization admin can attach it to other Workspaces later.
Private to this Workspace: only this Workspace can see or use it. An organization admin can later share it with the whole organization. A shared connection can't be made private again.

See Connections and Workspaces.

Next steps¶

Before people can ask questions about this data:

Create Models on the tables you want to analyse.
Add the Models to an AI Analyst.

You can also monitor the connection's health.

Troubleshooting¶

Message after Test connection or Save connection	Likely cause and fix
Fill in … before testing the connection	A required field is empty. Fill in the fields it names.
Authentication failed (if shown)	Check the Tenant ID, Client ID and Client secret. Make sure you copied the secret's Value, not its ID, and that it hasn't expired.
Could not connect	Studio shows this when it can't classify the failure. Click the message to expand the driver's detail. An "Invalid client secret" or `AADSTS` message means a wrong or expired secret, or a wrong Tenant ID or Client ID.
Could not reach the warehouse	Check the Host and Port, and any network rules on your Fabric endpoint (step 5).
Could not establish a secure connection	The SSL settings don't match the server. See SSL mode.
This warehouse user cannot see those objects (if shown)	Run the grants in step 4 for the service principal.
The test succeeds but Schemas doesn't appear	The service principal can't see any schema in this warehouse. Check the grants in step 4. The request to list schemas can also fail after the test (a brief error appears). Click Test connection again.
Warehouse host is not allowed	The host is a private or blocked address, doesn't resolve, or includes a protocol, path or port. Use a publicly reachable host name, or on a self-managed deployment ask your operator to allow the private range. See Network access.
A connection with this name already exists	Choose a different Name. This message appears after you click Save connection.