Adding the fabric data Agent into fabric Apps

Martin Kafka 40 Reputation points
2026-09-15T06:57:41.56+00:00

I have a Fabric app hosting a React SPA in the portal, and a Data Agent in the same workspace (afe0f50c-8c5b-45e1-81e5-b2837be40462).

What works: a service principal with workspace access calls the Data Agent fine — verified, answers in ~17s. In local dev a dev-server middleware holds the secret and proxies the call.

What doesn't: after publish the app is static, so there's no server to hold the secret. The browser inside the Fabric iframe can't acquire an Entra token (Sessions are opaque—your app shouldn't inspect the underlying tokens), so the call has nowhere to run.

What I tried:

  • Fabric App functions → rayfin up fails with 400 Invalid settings detected: Functions are not supported yet (rayfin-cli 1.34.0 and 1.35.0; the message comes from the backend, not the CLI)
  • Native Fabric UDF → also an Entra-authenticated endpoint, so the SPA still needs a token
  • Rayfin connectors → catalog only covers SQL / warehouse / semantic model

Two questions:

  1. Is there any supported way to do this today without standing up a backend outside Fabric?
  2. Are Fabric App functions (or any in-Fabric compute for app backends) planned, and roughly when? If it's far out, I'll stop waiting and build externally.I have a Fabric app hosting a React SPA in the portal, and a Data Agent in the same workspace. What works: a service principal with workspace access calls the Data Agent fine — verified, answers in ~17s. In local dev a dev-server middleware holds the secret and proxies the call. What doesn't: after publish the app is static, so there's no server to hold the secret. The browser inside the Fabric iframe can't acquire an Entra token (Sessions are opaque—your app shouldn't inspect the underlying tokens), so the call has nowhere to run. What I tried:
    • Fabric App functions → rayfin up fails with 400 Invalid settings detected: Functions are not supported yet (rayfin-cli 1.34.0 and 1.35.0; the message comes from the backend, not the CLI)
    • Native Fabric UDF → also an Entra-authenticated endpoint, so the SPA still needs a token
    • Rayfin connectors → catalog only covers SQL / warehouse / semantic model
    Two questions:
    1. Is there any supported way to do this today without standing up a backend outside Fabric?
    2. Are Fabric App functions (or any in-Fabric compute for app backends) planned, and roughly when? If it's far out, I'll stop waiting and build externally
Azure Functions
Azure Functions

An Azure service that provides an event-driven serverless compute platform.

0 comments
Answer accepted by question author
Tejaswini Billakurthi 760 Reputation points Microsoft External Staff Moderator
2026-09-16T11:25:21.8133333+00:00

Hi @Martin Kafka ,

Thank you for reaching out to Microsoft Q & A !

Based on the documented Fabric Apps capabilities, your understanding of the authentication limitation is reasonable.

Fabric Apps provides static frontend hosting and managed Fabric services, including authentication, database, and generated GraphQL APIs. Deployed applications use Fabric SSO (Microsoft Entra ID) for authentication.

For the Data Agent scenario, Microsoft documents service principal authentication using the client credentials flow. Since the service principal credentials are used to acquire the Microsoft Entra access token, they should not be placed in the published React SPA. The practical architecture is to keep the credential and token acquisition in a trusted server-side component and have the React SPA call that backend.

Regarding Fabric App Functions, I couldn't find public Microsoft documentation that provides a committed availability date or roadmap timeline for this capability. Since your deployment is explicitly returning "Functions not supported", I would recommend designing the current solution around the capabilities available today rather than relying on a particular future availability date.

For your requirement, using an external backend such as Azure Functions or another trusted server-side service is therefore the appropriate approach rather than exposing service principal credentials in the Fabric-hosted SPA.

References:

Please "Upvote the Answer" if this information helped you. This will help us and others in the community as well.

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Zoha Fatima 510 Reputation points
    2026-09-15T15:15:06.92+00:00

    Hi Martin,

    Based on the currently documented Fabric capabilities, I don’t see a supported in-Fabric backend option that solves this exact scenario today.

    Service-principal authentication is supported for Fabric Data Agents, but the client-credentials flow requires a client secret/credential. That credential should not be placed in a React SPA, so the Data Agent call needs to run from a trusted server-side component. Your local middleware is effectively providing that missing backend.

    The “Functions are not supported yet” response you are receiving also appears consistent with the capability not currently being available rather than a rayfin CLI configuration problem.

    For production, I would therefore use an external backend such as Azure Functions or another server-side service to hold the service-principal credential and proxy the Data Agent calls.

    Regarding an ETA for Fabric App functions/in-Fabric backend compute, I could not find a publicly committed Microsoft release date. I would not design around an assumed timeline until Microsoft publishes it on the Fabric roadmap.

    Thank you, and feel free to respond back for more assistance.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.