agentsclimarketplace

Fabric auth

Skill wardawgmalvicious/claude-config/skills/fabric-auth

Personal Claude Code config — skills, subagents, hooks, and rules for Microsoft Fabric and Power BI workflows on Windows. Cherry-pickable, no semver.

Install
npx -y skills add wardawgmalvicious/claude-config --skill fabric-auth

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use when authenticating to Microsoft Fabric APIs — getting 401 Unauthorized errors, choosing token audience/scope for Fabric REST, Power BI REST, OneLake, Warehouse/SQL, KQL, XMLA, or Azure ARM, or running `az login` / `az account get-access-token` / `az rest` for Fabric. Covers the full token-audience table, the OneLake-only `storage.azure.com/.default` requirement, `az login` flow variants (--allow-no-subscriptions, --use-device-code, SPN cert, managed identity), `az rest --resource` requirement (Fabric URL is not a built-in Azure endpoint), JWT decoding for 401 debugging, and why using the wrong audience is the #1 cause of 401s.

SKILL.md

4.9 KB, as published. Nobody here has run it

Fabric authentication & token audiences

All Fabric operations require Microsoft Entra ID OAuth 2.0 bearer tokens. Using the wrong audience is the #1 cause of 401 errors.

Access TargetToken Audience / Scope
Fabric REST APIhttps://api.fabric.microsoft.com/.default
Power BI REST API (refresh, data sources, permissions, DAX)https://analysis.windows.net/powerbi/api/.default
OneLake (DFS/Blob)https://storage.azure.com/.default
Warehouse / SQL Endpoint / SQL Database (TDS)https://database.windows.net/.default
KQL / Kustohttps://kusto.kusto.windows.net/.default
XMLA Endpointhttps://analysis.windows.net/powerbi/api/.default
Azure Resource Managementhttps://management.azure.com/.default
az login
az account get-access-token --resource https://api.fabric.microsoft.com    # Fabric REST
az account get-access-token --resource https://database.windows.net        # SQL / TDS
az account get-access-token --resource https://analysis.windows.net/powerbi/api  # Power BI

Critical: OneLake ONLY accepts https://storage.azure.com/.default — using https://datalake.azure.net/ will fail.

az login flow variants

az login --allow-no-subscriptions --tenant <tid>     # Fabric tenant with no Azure subscription
az login --use-device-code --tenant <tid>            # headless / SSH / no-browser
az login --service-principal -u <appId> -p <secret> --tenant <tid>           # CI/CD with SPN secret
az login --service-principal -u <appId> --certificate /path/cert.pem --tenant <tid>   # SPN cert (preferred — no secret to rotate)
az login --identity                                  # system-assigned managed identity
az login --identity --username <clientId>            # user-assigned managed identity

Without --allow-no-subscriptions, Fabric-only tenants (no Azure subscription attached) get a confusing "No subscriptions found" error before any Fabric call runs.

az rest --resource requirement

api.fabric.microsoft.com is not a built-in Azure cloud endpoint, so az rest cannot derive the audience from the URL. Always pass --resource:

az rest --method get \
  --resource "https://api.fabric.microsoft.com" \
  --url "https://api.fabric.microsoft.com/v1/workspaces"

Without --resource, you get "Can't derive appropriate Azure AD resource from --url" — the single most common az rest Fabric error.

Decoding a token to debug 401s

When you get an unexpected 401, decode the JWT to see what audience the token actually has:

TOKEN=$(az account get-access-token --resource https://api.fabric.microsoft.com --query accessToken -o tsv)
echo "$TOKEN" | cut -d'.' -f2 | base64 -d 2>/dev/null | jq .

Compare the aud claim against the table above. Other useful claims: exp (Unix expiry), oid (principal object ID), tid (tenant ID).

TDS connection essentials (Warehouse / SQL Database)

When connecting via sqlcmd, ODBC drivers, or any TDS client:

ParameterValue
Port1433 (TCP, must be open outbound)
Initial Catalog / DatabaseItem display name (NOT the FQDN)
AuthenticationMicrosoft Entra ID only — SQL auth is not supported
EncryptionEncrypt=Yes required
Token audiencehttps://database.windows.net/.default
MARSNot supported — remove MultipleActiveResultSets from connection strings (or set to false)

Gotcha: Login failed... database not found usually means the connection string passed the FQDN as Initial Catalog instead of the workspace item display name. Allow *.datawarehouse.fabric.microsoft.com and *-pbidedicated.windows.net through any outbound firewall.

Reference

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.