Fabric network remediate

Skill PatrickGallucci/fabric-skills/skills/fabric-network-remediate

Copilot, Claude AI Skills for Microsoft Fabric

Install

npx -y skills add PatrickGallucci/fabric-skills --skill fabric-network-remediate

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

16 stars16 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Diagnose and resolve Microsoft Fabric network performance issues including connectivity failures, latency, private endpoints, managed VNets, outbound access protection, gateway diagnostics, OneLake endpoint routing, service tag configuration, firewall allowlisting, DNS resolution, and Spark session startup delays. Use when remediate Fabric networking, slow Spark jobs, connection timeouts, private link errors, managed private endpoint approval, or capacity throttling.

The file declares its own license as Complete terms in LICENSE.txt. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

6.7 KB, as published. Nobody here has run it

Microsoft Fabric Network Performance remediate

Systematic toolkit for diagnosing and resolving network performance issues across Microsoft Fabric workloads including Spark, OneLake, Data Warehouse, Pipelines, and Dataflows.

When to Use This Skill

Fabric Spark sessions take longer than expected to start (>10 seconds)
Connection timeouts to external data sources from notebooks or pipelines
Managed private endpoint status shows Pending or Failed
DNS resolution returns public IPs instead of private IPs
Outbound access protection blocks required dependencies (PyPI, Conda)
On-premises data gateway connectivity failures
OneLake API calls returning 403 or timeout errors
Capacity throttling errors (HTTP 430)
Dataflow Gen2 staging failures behind firewalls
Cross-workspace environment attachment failures due to network mismatch

Prerequisites

PowerShell 7+ with Az module installed (Install-Module Az -Scope CurrentUser)
Fabric Admin or Workspace Admin role for network configuration changes
Azure portal access for Private Link Service and DNS zone management
Network access to run nslookup, Test-NetConnection, and Resolve-DnsName

Step-by-Step Workflows

Workflow 1: Diagnose Spark Session Startup Delays

Spark startup times vary based on networking configuration. Consult the reference table:

Scenario	Typical Startup Time
Default settings, no libraries	5-10 seconds
Default settings + library dependencies	5-10 sec + 30 sec-5 min
High traffic in region, no libraries	2-5 minutes
High traffic + library dependencies	2-5 min + 30 sec-5 min
Network security (Private Links/VNet)	2-5 minutes
Network security + library dependencies	2-5 min + 30 sec-5 min

Run the diagnostic script for automated assessment:

.\scripts\Test-FabricNetworkHealth.ps1 -WorkspaceId "<workspace-id>" -CheckType SparkStartup

When Private Links or Managed VNets are enabled, Starter Pools are unavailable and Fabric must create clusters on demand, adding 2-5 minutes to session start time.

Workflow 2: Validate Managed Private Endpoint Connectivity

Navigate to Fabric workspace Settings > Network security
Under Managed private endpoints, verify Status shows Approved
If Pending or Failed, see private-endpoint-remediate.md
Validate DNS routing from a Fabric Notebook:

nslookup sqlserver.corp.contoso.com

Confirm the returned IP is a private range (10.x.x.x or 172.x.x.x), not public.

Run the automated validation:

.\scripts\Test-FabricNetworkHealth.ps1 -WorkspaceId "<workspace-id>" -CheckType PrivateEndpoint

Workflow 3: Configure Firewall Allowlisting

Fabric requires specific endpoints and service tags. Run the firewall audit script:

.\scripts\Test-FabricNetworkHealth.ps1 -CheckType FirewallEndpoints

For the complete endpoint reference, see firewall-endpoints.md.

Key service tags for Azure Firewall / NSG rules:

Tag	Purpose	Direction
Power BI	Fabric core services	Both
DataFactory	Pipeline operations	Both
PowerQueryOnline	Dataflow processing	Both
SQL	Warehouse connectivity	Outbound
EventHub	Real-Time Analytics	Outbound
KustoAnalytics	Real-Time Analytics	Both

Workflow 4: Troubleshoot Outbound Access Protection

When outbound access protection is enabled, public repositories (PyPI, Conda) are blocked. To install libraries in secured environments:

Prepare a requirements.txt on a machine with internet access
Download packages and dependencies using pip:

pip download -r requirements.txt -d ./packages

Upload packages as custom libraries in the Fabric Environment
See outbound-access-guide.md for detailed steps

Workflow 5: Resolve Capacity Throttling (HTTP 430)

When all Spark VCores are consumed, new jobs receive HTTP 430 errors. Formula: 1 Capacity Unit = 2 Spark VCores.

Check current utilization in the Monitoring Hub
Cancel idle or stuck Spark sessions
Consider upgrading capacity SKU if sustained
Enable queueing for pipeline and Spark Job Definition workloads

For queue limits by SKU, see capacity-throttling.md.

remediate Quick Reference

Symptom	Likely Cause	First Action
Spark startup >2 min	Private Link/VNet enabled	Expected; Starter Pools unavailable
Connection timeout from Spark	Firewall blocking Fabric subnet	Open required ports (1433 for SQL)
DNS resolves to public IP	Private DNS zone not linked	Add A record pointing to private IP
MPE status = Failed	PLS rejected or deleted	Re-create MPE, verify PLS exists
HTTP 430 error	Capacity VCores exhausted	Cancel jobs or upgrade SKU
PyPI install blocked	Outbound access protection	Upload packages as custom libraries
Cross-workspace env fails	Network settings mismatch	Ensure same capacity and network config
OneLake API 403	Endpoint URL validation	Use `*.dfs.fabric.microsoft.com`