Microsoft Fabric: Changes to tenant admin setting that governs the access of service principals to public APIs

Microsoft Fabric will split the existing tenant admin setting for service principal access to public APIs into two settings: one for global APIs (disabled by default) and one for permission-based APIs (enabled by default). This change aims to enhance flexibility for developers while maintaining security. The transition will occur from mid-May to early June 2025. Existing configurations will be retained, and admins have until August 1, 2025, to opt out of automatic changes. Coming soon for Microsoft Fabric: We will split the existing tenant admin setting that currently controls access for service principals to all public APIs, into two tenant admin settings. After the split, the new tenant admin settings will be: Service principal access to global APIs: Controls access to “global” APIs that are not protected by any Fabric permission model, such as the creation of workspaces. This setting will retain the existing configuration and will be disabled by default. Setting name: Service principals can create workspaces, connections, and deployment pipelines. Service principal access to permission-based APIs: Controls access to APIs protected by the Fabric permission model, including managing existing workspaces and full CRUD (create, read, update, and delete) operations for workspace sub-folders and items. This setting will adopt the existing configuration of the current setting and will be enabled by default. Setting name: Service principals can call Fabric public APIs. Why are we introducing the change? For years, one tenant admin setting has governed the access of service principals to public APIs in Microsoft Power BI and then in Microsoft Fabric overall (see screenshot of the current setting). We originally introduced the single setting as a safeguard against potential misuse by multi-tenant app service principals, but as we have expanded into Fabric scenarios, we understand the need for a more flexible approach to unblock Fabric developers. When the current admin setting is set to disabled by default, developers are blocked. To enhance usability for Fabric developers while ensuring security and Fabric tenant admin control, we will split the existing setting into two settings. The current setting: View image in new tab Detailed plan and timelines Starting mid-May 2025 and […]

The post Microsoft Fabric: Changes to tenant admin setting that governs the access of service principals to public APIs appeared first on M365 Admin.