Permissions - Precisely Data Integrity Suite

Prerequisites

Before starting, confirm the following:

If these admin roles are held by different people in your organization, coordinate ahead of time.

Step 1 — Register the application in Microsoft Entra ID

1. Sign in to the Azure portal at https://portal.azure.com.
2. Navigate to Microsoft Entra ID > App registrations > New registration.
3. Provide a name (for example, dis-fabric-connector-sp).
4. Set Supported account types to Accounts in this organizational directory only (single tenant).
5. Leave Redirect URI blank — not needed for client credentials flow.
6. Click Register.
7. On the app's overview page, record the following values:
   • Application (client) ID — used as the connection's User parameter.
   • Directory (tenant) ID — used as the connection's tenant identifier.
8. In the left navigation, go to Certificates & secrets > Client secrets > New client secret.
9. Set an expiry period (recommended: 12 months; 24 months maximum). Record the secret's Value immediately — it is only shown once and is used as the Password parameter.

Step 2 — Grant access in Microsoft Fabric

After the application is registered in Microsoft Entra ID, it must be granted access to each target Microsoft Fabric workspace it needs to harvest metadata from.

This step requires workspace admin rights on the target workspace.

1. Open the target workspace in the Microsoft Fabric portal.
2. Click the ... (more options) menu next to the workspace name and select Manage access.

   Alternate path: select Settings gear > Permissions while inside the workspace.

3. Click + Add people or groups.
4. Add the user, service principal, or a security group to the workspace. When searching by name, use the app display name — the Fabric UI does not search by Client ID (GUID).
5. Assign the Contributor role (not Viewer) to allow access to workspace metadata.
6. Click Add.

Step 3 — Verify the configuration

Test the service principal's access using the token endpoint and a lightweight Fabric API call.

Request an access token

curl -X POST "https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id={clientId}" \
  -d "client_secret={clientSecret}" \
  -d "scope=https://api.fabric.microsoft.com/.default"

Replace {tenantId}, {clientId}, and {clientSecret} with the values from Step 1.

List accessible workspaces

curl -H "Authorization: Bearer {accessToken}" \
  "https://api.fabric.microsoft.com/v1/workspaces"

If the response includes the target workspace, the configuration is complete. If the workspace list is empty despite a valid token, the service principal was authenticated but has not been added to any workspace — return to Step 2.

RBAC roles and API permissions required

Setup summary

To function end-to-end, the service principal requires the following:

• An app registration in Microsoft Entra ID with a valid client secret.
• A workspace role assignment (Contributor or higher) on each target workspace.

Network connectivity

The Microsoft Fabric Warehouse connection uses the Azure SQL Default connectivity policy, which cannot be changed. Clients must allow outbound access to the following:

• TCP port 1433 (Azure SQL gateway IP addresses)
• TCP ports 11000–11999 (Azure SQL IP addresses in the region)