Fabric Warehouse

Fabric Warehouse is in Preview in the connection wizard: it signs in with Microsoft Entra ID as a service principal and has not yet been proven against a live Fabric warehouse, so check its tables and query results before relying on them. Connect with the server from its SQL connection string, the warehouse’s name and a Microsoft Entra ID service principal.

1. In DataSquares, open Data Sources and choose Connect Source. The Connect a data source page opens.

2. Pick Fabric Warehouse on that page (search or browse by category).

3. Fill in the connection details below, then test the connection and save.

Before you start

Fabric Warehouse’s SQL endpoint takes only Microsoft Entra ID sign-in (“SQL Authentication isn’t supported”, Microsoft’s Warehouse connectivity), so DataSquares signs in as a service principal: an app registered in your organization’s Microsoft Entra ID, with a client secret. Set it up once, with an Entra ID role that may register applications (at least Cloud Application Administrator) and a workspace Admin in Fabric.

Create the service principal

1. Sign in to the Microsoft Entra admin center, browse to Entra ID > App registrations and select New registration.

2. Name the app (for example DataSquares reader), keep Accounts in this organizational directory only and select Register. It needs no redirect URI.

3. On the app’s Overview page, copy the Directory (tenant) ID and the Application (client) ID: the form’s Tenant ID and Client ID.

4. Open Certificates & secrets > Client secrets > New client secret, give it a description and a duration, and select Add. Copy its Value at once, because Entra ID shows it only this one time (not its Secret ID): the form’s Client secret.

The service principal needs no role in an Azure subscription: what it may read comes from Fabric, below. A Fabric administrator must also let service principals use Fabric: Service principals can use Fabric APIs, in the tenant settings of the Fabric Admin portal (Microsoft’s Service principals in Fabric Data Warehouse).

Give the service principal a workspace role

The service principal needs a role in the workspace that holds the warehouse. A workspace Admin opens the workspace’s Manage access, adds the app by its name and picks the role. Viewer is enough: it connects to every warehouse in the workspace and reads all of their tables and views with T-SQL. Contributor, Member and Admin also let it change them, which DataSquares never needs (Workspace roles in Fabric Data Warehouse).

To keep it to one warehouse, share that warehouse with it instead of giving it a role. Shared with Read all data using SQL, it reads every table and view of that warehouse. Shared with no additional permissions, it can only connect, and reads just the tables a workspace Admin, Member or Contributor grants it in the warehouse, one GRANT SELECT ON <table> TO <service principal name> each. A grant only adds to what a role or a share already allows, so it cannot narrow a Viewer or a Read all data using SQL share (Share your warehouse). Microsoft’s Service principals in Fabric Data Warehouse says a warehouse can be shared with a service principal, but its Share your warehouse page still says sharing a warehouse directly with one is not supported: if the share dialog does not offer the app, give it the workspace role.

Connection details

Field	What to enter
Server	The host name from the warehouse’s SQL connection string: in Fabric, open the warehouse’s Settings and select the SQL connection string page. It looks like <unique identifier>.datawarehouse.fabric.microsoft.com. Enter the host name alone: a tcp: prefix, a port or a path is refused.
Warehouse	The warehouse’s name as Fabric shows it (for example NYC Taxi), without the server.
Port	1433, fixed: the SQL endpoint listens on no other port, so the form shows it and does not ask.
Tenant ID	The Directory (tenant) ID from the app registration’s Overview page, or your tenant’s domain (contoso.onmicrosoft.com).
Client ID	The Application (client) ID from the same page: a GUID.
Client secret	The secret’s Value, not its Secret ID. Stored encrypted and never shown again. When you edit the source, leave it empty to keep the stored secret; a source moved to another server needs the secret entered again.

There is no username, password or TLS switch: the endpoint refuses SQL authentication, and the connection is always encrypted, with the endpoint’s certificate verified. Test Connection signs in the way every query does: DataSquares sends the secret only to Microsoft Entra ID, for a token for the warehouse, and the warehouse receives the token. A DataSquares server you run yourself must reach the endpoint on TCP port 1433 and Microsoft Entra ID (login.microsoftonline.com) on port 443.

What Preview means

The Fabric Warehouse connector is new, and it is in Preview until it has been proven on a real warehouse. Its sign-in was tested against a scripted SQL endpoint that plays Fabric’s side of the Microsoft Entra ID exchange, with the same SQL Server driver every query uses, but it has not been run against a live Fabric warehouse yet. Until it has, check the tables a new source lists and the results of its first queries against what Fabric shows before you rely on them. The Preview label goes once it passes that run.

Pipelines and exports

A Fabric Warehouse source works in models, dashboards, reports and the SQL editor. Two things do not use it yet:

• Pipelines cannot read from it or write to it. The pipeline worker signs in to SQL Server-family databases with a username and password, so a step on a Fabric Warehouse connection is refused before it connects, with A pipeline cannot read from a Fabric Warehouse connection yet (or write to) and the reason. See What Extract can pull from.
• Complete exports of a table or matrix are refused for it, because no complete read of a Fabric warehouse has been reviewed and run yet; bounded Document sections exports run. See background report exports.

Common errors

What Test Connection or Update Source shows	What to check
Microsoft Entra ID did not sign the service principal in — check the tenant ID, the client ID and the client secret, and that the secret has not expired.	Microsoft Entra ID refused the sign-in: a wrong tenant ID or client ID, the secret’s Secret ID entered instead of its Value, or a secret past its duration. Create a new secret and enter it in the source’s edit form.
Microsoft Entra ID could not be reached to sign the service principal in — DataSquares must be able to reach login.microsoftonline.com over HTTPS.	DataSquares got no answer from Microsoft Entra ID, so the tenant ID, the client ID and the secret were never checked, and a new secret will not help. A DataSquares server you run yourself must reach login.microsoftonline.com on port 443; then test again.
The warehouse did not accept the service principal — check the server, the warehouse name, and that the service principal has a role in the workspace.	The Server is not the host name from this warehouse’s SQL connection string, the Warehouse is not a warehouse at that server (enter its name alone, without the server), the service principal has neither a role in the workspace nor a share of the warehouse, or the Fabric tenant settings do not allow service principals.
Fabric Warehouse connection requires: tenantId, clientId, clientSecret	A field is empty. A source saved before Fabric Warehouse signed in this way has none of the three: edit it and enter them. In the edit form, Test Connection tests what the form holds, so it needs the client secret entered; Update Source keeps the stored one when the field is left empty.
Enter the client secret again: a stored client secret is kept only while the server stays the one it was saved with.	Shown by Update Source: the edit changed the Server and left the secret empty. The token the secret buys is sent to the server, so a new server needs the secret entered again.

Related

• Connector catalog — everything DataSquares connects to.
• Quickstart — from connection to shared dashboard.