Adding the fabric data Agent into fabric Apps

Question

Adding the fabric data Agent into fabric Apps

Martin Kafka 20

I have a Fabric app hosting a React SPA in the portal, and a Data Agent in the same workspace (afe0f50c-8c5b-45e1-81e5-b2837be40462).

What works: a service principal with workspace access calls the Data Agent fine — verified, answers in ~17s. In local dev a dev-server middleware holds the secret and proxies the call.

What doesn't: after publish the app is static, so there's no server to hold the secret. The browser inside the Fabric iframe can't acquire an Entra token (Sessions are opaque—your app shouldn't inspect the underlying tokens), so the call has nowhere to run.

What I tried:

Fabric App functions → rayfin up fails with 400 Invalid settings detected: Functions are not supported yet (rayfin-cli 1.34.0 and 1.35.0; the message comes from the backend, not the CLI)
Native Fabric UDF → also an Entra-authenticated endpoint, so the SPA still needs a token
Rayfin connectors → catalog only covers SQL / warehouse / semantic model

Two questions:

Is there any supported way to do this today without standing up a backend outside Fabric?
Are Fabric App functions (or any in-Fabric compute for app backends) planned, and roughly when? If it's far out, I'll stop waiting and build externally.I have a Fabric app hosting a React SPA in the portal, and a Data Agent in the same workspace. What works: a service principal with workspace access calls the Data Agent fine — verified, answers in ~17s. In local dev a dev-server middleware holds the secret and proxies the call. What doesn't: after publish the app is static, so there's no server to hold the secret. The browser inside the Fabric iframe can't acquire an Entra token (Sessions are opaque—your app shouldn't inspect the underlying tokens), so the call has nowhere to run. What I tried:
- Fabric App functions → rayfin up fails with 400 Invalid settings detected: Functions are not supported yet (rayfin-cli 1.34.0 and 1.35.0; the message comes from the backend, not the CLI)
- Native Fabric UDF → also an Entra-authenticated endpoint, so the SPA still needs a token
- Rayfin connectors → catalog only covers SQL / warehouse / semantic model
Two questions:
1. Is there any supported way to do this today without standing up a backend outside Fabric?
2. Are Fabric App functions (or any in-Fabric compute for app backends) planned, and roughly when? If it's far out, I'll stop waiting and build externally

Tejaswini Billakurthi 435 Reputation points Microsoft External Staff Moderator

2026-09-16T11:25:21.8133333+00:00
Hi @Martin Kafka ,

Thank you for reaching out to Microsoft Q & A !

Based on the documented Fabric Apps capabilities, your understanding of the authentication limitation is reasonable.

Fabric Apps provides static frontend hosting and managed Fabric services, including authentication, database, and generated GraphQL APIs. Deployed applications use Fabric SSO (Microsoft Entra ID) for authentication.

For the Data Agent scenario, Microsoft documents service principal authentication using the client credentials flow. Since the service principal credentials are used to acquire the Microsoft Entra access token, they should not be placed in the published React SPA. The practical architecture is to keep the credential and token acquisition in a trusted server-side component and have the React SPA call that backend.

Regarding Fabric App Functions, I couldn't find public Microsoft documentation that provides a committed availability date or roadmap timeline for this capability. Since your deployment is explicitly returning "Functions not supported", I would recommend designing the current solution around the capabilities available today rather than relying on a particular future availability date.

For your requirement, using an external backend such as Azure Functions or another trusted server-side service is therefore the appropriate approach rather than exposing service principal credentials in the Fabric-hosted SPA.

References:

Use service principal authentication with Fabric data agent https://learn.microsoft.com/en-us/fabric/data-science/data-agent-service-principal

What is Fabric Apps (Preview)? https://learn.microsoft.com/en-us/fabric/apps/overview

Please "Upvote the Answer" if this information helped you. This will help us and others in the community as well.

1 answer

Your answer

Tejaswini Billakurthi 435 Reputation points Microsoft External Staff Moderator

2026-09-16T11:25:21.8133333+00:00

Hi @Martin Kafka ,

Thank you for reaching out to Microsoft Q & A !

Based on the documented Fabric Apps capabilities, your understanding of the authentication limitation is reasonable.

Fabric Apps provides static frontend hosting and managed Fabric services, including authentication, database, and generated GraphQL APIs. Deployed applications use Fabric SSO (Microsoft Entra ID) for authentication.

For the Data Agent scenario, Microsoft documents service principal authentication using the client credentials flow. Since the service principal credentials are used to acquire the Microsoft Entra access token, they should not be placed in the published React SPA. The practical architecture is to keep the credential and token acquisition in a trusted server-side component and have the React SPA call that backend.

Regarding Fabric App Functions, I couldn't find public Microsoft documentation that provides a committed availability date or roadmap timeline for this capability. Since your deployment is explicitly returning "Functions not supported", I would recommend designing the current solution around the capabilities available today rather than relying on a particular future availability date.

For your requirement, using an external backend such as Azure Functions or another trusted server-side service is therefore the appropriate approach rather than exposing service principal credentials in the Fabric-hosted SPA.

References:

Use service principal authentication with Fabric data agent https://learn.microsoft.com/en-us/fabric/data-science/data-agent-service-principal

What is Fabric Apps (Preview)? https://learn.microsoft.com/en-us/fabric/apps/overview

Please "Upvote the Answer" if this information helped you. This will help us and others in the community as well.

Answer 1

Hi Martin,

Based on the currently documented Fabric capabilities, I don’t see a supported in-Fabric backend option that solves this exact scenario today.

Service-principal authentication is supported for Fabric Data Agents, but the client-credentials flow requires a client secret/credential. That credential should not be placed in a React SPA, so the Data Agent call needs to run from a trusted server-side component. Your local middleware is effectively providing that missing backend.

The “Functions are not supported yet” response you are receiving also appears consistent with the capability not currently being available rather than a rayfin CLI configuration problem.

For production, I would therefore use an external backend such as Azure Functions or another server-side service to hold the service-principal credential and proxy the Data Agent calls.

Regarding an ETA for Fabric App functions/in-Fabric backend compute, I could not find a publicly committed Microsoft release date. I would not design around an assumed timeline until Microsoft publishes it on the Fabric roadmap.

Thank you, and feel free to respond back for more assistance.