Workspace identity and service principals: stop refreshing as a person
When the BI lead leaves, refresh dies. That is not a mystery. Every connection still running as their user is a time bomb.
Two non-human patterns
Workspace identity (Fabric): the workspace itself gets an identity you grant to sources (e.g. ADLS, Fabric items). Good default for in-platform reads. Fewer secrets in Key Vault.
Service principal: Entra app registration. Still required for many gateways, Azure SQL, and automation (CLI, REST, CI). Needs a secret or cert with rotation, and a security group that owns the app.
Do not mix “we use a SP” with the SP living in one person’s Azure portal favorites.
Least privilege
- SP or workspace identity gets access to the data source, not Contributor on the whole subscription
- Semantic model refresh: permission to read Gold, not write Bronze
- Pipeline identity ≠ report viewer identity. RLS test users stay humans
Gateway
On-prem sources still need a gateway. Run the gateway as a service account (gMSA if you can), not a named admin who logs into the box. Map dataset credentials to the SP/workspace identity on the cloud side; do not store the departing employee’s OAuth token.
Rotation runbook (one page)
- Owners: platform team group, not an individual
- Cert/secret expiry calendar (90 or 180 days)
- Dual-running window: new cred in Dev, then Test, then Prod
- Break-glass: named backup, not “ask Slack”
Detect the people still in the loop
Export connections / data source settings from the admin APIs or lineage. Filter credential type = OAuth2 with a user UPN. Those rows are your migration backlog.
Moving a tenant off personal refresh credentials without a Monday outage? Book a 30-minute call.