Fabric Data Agent Authentication

Question

We authenticate to Azure AI Foundry Agent Service using the Azure AI Projects SDK and a Microsoft Entra Service Principal (ClientSecretCredential). The agent has a Fabric Data Agent connected as a tool. Does the Foundry Fabric tool invoke the Fabric Data Agent using the same Service Principal, or does it only support delegated user identity (OAuth/OBO)? If supported, what additional configuration is required?

Answer 1

Hi, the right authentication pattern depends on where the agent runs and whose permissions should govern the data request. For an interactive user experience, delegated OAuth preserves the user's Fabric permissions. For unattended service-to-service use, use a supported service principal or managed identity only if the Fabric item and API explicitly support it, then grant the minimum workspace/item permissions and test token audience/tenant carefully. Do not pass a user's refresh token into a hosted agent. If the current Data Agent preview exposes only user OAuth, that is a product limitation rather than something a custom Entra role can bypass; use an approved middle-tier API or wait for workload-identity support, and confirm the design with Fabric support before production.