Get started with Microsoft Fabric authentication

Quick start: sign in as yourself

For a normal interactive login, you need:

• a work or school Microsoft account that can sign in to your organization’s Fabric portal;
• your organization’s Microsoft Entra tenant ID;
• access to at least one Fabric workspace or item; and
• sometimes, a client ID supplied by your administrator.

You do not need a client secret, certificate, or manually copied access token for this first setup.

Sys.setenv(FABRICQUERYR_TENANT_ID = "<your-tenant-id>")

library(fabricQueryR)

Sys.setenv(FABRICQUERYR_CLIENT_ID = "<your-client-id>")

workspaces <- fabric_workspaces()

workspaces
workspace <- workspaces[[1L]]
workspace$displayName
workspace$id

items <- workspace$items()
items
item <- items[[1L]]
item$displayName
item$type
item$id

file.edit("~/.Renviron")

FABRICQUERYR_TENANT_ID=<your-tenant-id>
FABRICQUERYR_CLIENT_ID=<your-client-id>

Sys.getenv("FABRICQUERYR_TENANT_ID")
Sys.getenv("FABRICQUERYR_CLIENT_ID")

Make sure Fabric access has been granted

‘fabricQueryR’ cannot grant Fabric permissions. The signed-in account must already be able to access the relevant workspace, item, and data.

For an initial test, ask a workspace administrator to do one of the following:

1. add your account to the Fabric workspace, normally with the least-privileged role that supports your task; or
2. share the specific Fabric item with your account and grant any additional data permission it needs.

Workspace visibility and data access are not always the same permission. For example, a semantic model normally needs Read and Build access, while OneLake data can require an additional data permission. If discovery works but a read does not, ask the item owner which permission that workload requires.

First-login troubleshooting

These are the most common starting problems:

If a cached login is using the wrong account, retry once without reading or writing the cache:

workspaces <- fabric_workspaces(
  auth_args = list(use_cache = FALSE)
)

For R running on a remote machine where no local browser can open, use a device code:

workspaces <- fabric_workspaces(
  auth_args = list(auth_type = "device_code")
)

R prints a code and a Microsoft sign-in address. Open that address in any browser, enter the code, and sign in with the intended account.

How authentication works

‘fabricQueryR’ uses ‘AzureAuth’ to sign in to Microsoft Entra. Most functions accept the same authentication arguments:

• tenant_id identifies the organization;
• client_id identifies the application;
• token supplies an existing token or token-provider function; and
• auth_args customizes automatic sign-in.

Most interactive users only need the tenant ID. ‘AzureAuth’ opens a browser or uses device-code login, caches the resulting token, and refreshes it when needed. ‘fabricQueryR’ chooses the correct token audience for each Fabric service.

Leave token = NULL for automatic sign-in. When you supply token, it becomes responsible for authentication and auth_args is not used. See ?fabric_workspaces and the ‘AzureAuth’ authentication scenarios for the complete argument details. Supply the bearer token exactly as issued: leading, trailing, or embedded whitespace and control characters are rejected rather than trimmed or sent in an HTTP header.

A bearer-token string and an AzureAuth::AzureToken each represent one OAuth audience. ‘fabricQueryR’ binds either form to the first service audience that uses it and stops before reusing it for a different service. For example, an operation that resolves a Fabric item and then reads OneLake needs both Fabric and Azure Storage tokens. Supply the function’s storage_token or sql_token argument when available, or pass an audience-aware token-provider function that returns the appropriate token for its audience argument. Automatic sign-in already acquires and caches a separate token for each audience.

Treat endpoint URLs as credential boundaries

Prefer discovered objects when a method or function accepts them. When discovery cannot provide an invocation endpoint, copy the complete URL from the Fabric portal. These routes keep both the service address and the Fabric item identity visible to the caller.

A custom host, including one fronted by your organization through Azure API Management or another gateway, is an explicit opt-in. ‘fabricQueryR’ refuses to acquire and forward its normal Fabric credential automatically; supply token as a bearer token or token-provider function. Use a custom endpoint only when your organization controls the host, and use a token issued for the gateway’s intended audience. Set audience explicitly when the token provider uses that argument to acquire the gateway credential.

HTTPS and URL-shape validation reject malformed endpoint input, but do not prove that your organization owns the hostname, that the gateway forwards a request safely, or that a supplied token has the correct audience. Confirm those properties with the gateway owner before sending credentials or data.

Choosing an advanced authentication method

If the quick start works and you are using R interactively, you can continue using it. Choose one of the options below only when the way R runs requires it.

Advanced: authentication for automation

Automated code cannot wait for a person to complete a browser login. A service principal is an application identity that can sign in on its own. It requires a dedicated app registration and a secret or certificate, and the service principal itself must be granted access in Fabric.

workspaces <- fabric_workspaces(
  tenant_id = Sys.getenv("FABRICQUERYR_TENANT_ID"),
  client_id = Sys.getenv("FABRICQUERYR_CLIENT_ID"),
  auth_args = list(
    password = Sys.getenv("FABRIC_CLIENT_SECRET"),
    auth_type = "client_credentials"
  )
)

Set Fabric permissions by workload

Getting a token proves an identity; it does not grant access to Fabric data. For a production workflow, check three layers:

1. the tenant setting allows that identity type to use the API;
2. the user or application can access the workspace or item; and
3. the workload-specific data permission allows the requested operation.

Use the least-privileged role that supports the task. Fabric’s workspace-role documentation explains the standard roles; each workload guide lists its additional access requirements.

Signing out (token cache)

‘AzureAuth’ stores cached user tokens in its user-specific ‘AzureR’ data directory, never in the package project. Use AzureAuth::list_azure_tokens() to inspect the cache and remove only the relevant token with AzureAuth::delete_azure_token(). Use AzureAuth::clean_token_directory() for signing out of every cached ‘AzureR’ session.