> For the complete documentation index, see [llms.txt](https://docs.dinmo.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dinmo.io/integrations/data-sources/microsoft-fabric.md).

# Microsoft Fabric

Connect Microsoft Fabric Warehouse to DinMo with a dedicated service principal and technical schemas.

Connect a Microsoft Fabric Warehouse to DinMo with a dedicated Microsoft Entra service principal. DinMo reads the business data you authorize and stores its technical objects in five dedicated schemas in the same Warehouse.

{% hint style="info" %}
DinMo supports a **Fabric Warehouse SQL endpoint**. A Lakehouse SQL analytics endpoint is read-only and cannot host the technical objects DinMo requires.
{% endhint %}

## Before you begin

| Requirement     | What you need                                                                                                                    |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| Fabric resource | A workspace containing a **Warehouse**.                                                                                          |
| Authentication  | A dedicated Entra application with a client secret. Certificate and Managed Identity authentication are not currently supported. |
| Administration  | Access to configure Fabric tenant settings, Warehouse access, schemas, and SQL permissions.                                      |
| Network         | If outbound access is restricted, allow [DinMo's IP addresses](/security-and-privacy/networking.md).                             |

DinMo needs read access to the business schemas used by your models and write access to its technical schemas. Write access is required because DinMo materializes segments, computes changes between runs, and stores operational metadata inside your Warehouse.

## Configure Microsoft Fabric

### 1. Create a service principal

1. In the [Microsoft Entra admin center](https://entra.microsoft.com/), go to **Identity → Applications → App registrations**.
2. Select **New registration** and choose **Accounts in this organizational directory only**.
3. Give the application a recognizable name, such as `DinMo Fabric Integration`, and register it.
4. Copy the **Application (client) ID** and **Directory (tenant) ID**.
5. Under **Certificates & secrets**, create a client secret and copy its **Value**. The value is shown only once.

Record the secret's expiration date and rotate it before it expires. Updating the secret in Entra does not update the DinMo connection automatically.

### 2. Allow service principal access

Ask a Fabric administrator to open [Microsoft Fabric](https://app.fabric.microsoft.com/), then go to **Admin portal → Tenant settings → Developer settings** and enable **Service principals can use Fabric APIs**. If the setting is limited to security groups, add the service principal to an authorized group.

### 3. Choose an access model

| Setup      | Fabric access                                                                       | SQL access                                                                    | Recommended when                  |
| ---------- | ----------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | --------------------------------- |
| Standard   | Workspace **Contributor** role. Existing Member or Admin access also works.         | Inherited from the workspace role.                                            | You want the simplest setup.      |
| Restricted | Item-level **Read** when supported for service principals, or workspace **Viewer**. | Explicit grants on selected business schemas and the DinMo technical schemas. | You need tighter SQL permissions. |

Contributor is broader than DinMo's functional requirements because it applies read/write access across Warehouses in the workspace.

For restricted access:

1. Prefer item-level **Read** on the target Warehouse when it is available for service principals in your tenant.
2. Otherwise, use workspace **Viewer**. Viewer can read every Warehouse in the workspace, so use a dedicated workspace when that scope is too broad.
3. Have an administrator create the technical schemas and apply the SQL grants below.
4. Remove temporary Contributor access before testing. Reconnect to obtain a new access token after changing permissions.

### 4. Create the technical schemas

Run the following from the target Warehouse SQL endpoint with an account that can create schemas. If your editor does not support `GO`, run each `CREATE SCHEMA` statement separately.

```sql
CREATE SCHEMA dinmo_segments;
GO
CREATE SCHEMA dinmo_stats;
GO
CREATE SCHEMA dinmo_delta_storage;
GO
CREATE SCHEMA dinmo_predictions;
GO
CREATE SCHEMA dinmo_identity;
GO
```

Create all five schemas, even when Predictions or Identity Resolution is not enabled. DinMo validates their presence when testing the connection.

### 5. Apply restricted SQL permissions

Skip this step for the standard Contributor setup.

Run the following as a Warehouse administrator. Replace `DinMo Fabric Integration` with the service principal's exact display name and grant `SELECT` only on the business schemas used by DinMo models.

```sql
GRANT CREATE TABLE TO [DinMo Fabric Integration];
GRANT CREATE VIEW TO [DinMo Fabric Integration];

GRANT CONTROL ON SCHEMA::[dinmo_segments] TO [DinMo Fabric Integration];
GRANT CONTROL ON SCHEMA::[dinmo_stats] TO [DinMo Fabric Integration];
GRANT CONTROL ON SCHEMA::[dinmo_delta_storage] TO [DinMo Fabric Integration];
GRANT CONTROL ON SCHEMA::[dinmo_predictions] TO [DinMo Fabric Integration];
GRANT CONTROL ON SCHEMA::[dinmo_identity] TO [DinMo Fabric Integration];

GRANT SELECT ON SCHEMA::[your_business_schema] TO [DinMo Fabric Integration];
```

The database-level `CREATE TABLE` and `CREATE VIEW` grants complement schema-level `CONTROL`. Together they let DinMo manage objects only inside its technical schemas.

Do not run `CREATE USER ... FROM EXTERNAL PROVIDER`: Fabric Warehouse does not support it. The first successful `GRANT` or `DENY` creates the database principal automatically. See Microsoft's documentation for [granular SQL permissions](https://learn.microsoft.com/en-us/fabric/data-warehouse/sql-granular-permissions) and [service principal access](https://learn.microsoft.com/en-us/fabric/data-warehouse/service-principals).

## Connect DinMo

### 1. Collect the connection details

Open the Fabric Warehouse, copy its **SQL connection string**, and collect these values:

| DinMo field     | Value                                                                                                                 |
| --------------- | --------------------------------------------------------------------------------------------------------------------- |
| Server hostname | The hostname of the Warehouse SQL endpoint. Enter the hostname only, without `https://`, a port, or a trailing slash. |
| Port            | `1433`, unless the SQL connection string specifies another port.                                                      |
| Database        | The exact Warehouse name.                                                                                             |
| Tenant ID       | The Directory (tenant) ID from the Entra application.                                                                 |
| Client ID       | The Application (client) ID from the Entra application.                                                               |
| Client secret   | The secret **Value**, not its identifier.                                                                             |

### 2. Add the source

1. In DinMo, open **Workspace Settings → Sources**.
2. Select **Add New Source → Microsoft Fabric**.
3. Enter a source name and the connection details above.
4. Select **Save & Test**.

DinMo validates authentication, connectivity, database access, metadata access, and the presence of all five technical schemas. In each technical schema, it creates a temporary table and view, writes and reads test data, alters and renames the table, and then removes the temporary objects.

After the test succeeds, create or preview a model to confirm that the service principal can read the business tables and views required for your use case.

## Operate the connection

### Rotate the client secret

Before the current secret expires:

1. Create a new secret in Microsoft Entra.
2. Update the Fabric source in DinMo with the new secret value.
3. Run **Save & Test**.
4. Delete the previous secret only after validation succeeds.

### Monitor Fabric capacity

DinMo queries consume Fabric capacity. Consumption varies with data volume, query complexity, model frequency, and concurrency, so validate with a representative workload rather than a fixed estimate.

For the first production rollout, run representative model, segment, calculated-field, and activation jobs; record their times and row counts; then review the corresponding Warehouse background operations in the Fabric Capacity Metrics app. Service-principal activity appears under its application client ID. Account for Fabric's 24-hour smoothing before increasing concurrency.

See Microsoft's documentation on [Warehouse compute usage](https://learn.microsoft.com/en-us/fabric/data-warehouse/compute-capacity-smoothing-throttling) and [capacity throttling](https://learn.microsoft.com/en-us/fabric/enterprise/throttling).

## Troubleshooting

| Symptom                                                        | What to check                                                                                                                                                                                                                                                        |
| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Authentication or connection fails                             | Confirm the hostname format, port, exact Warehouse name, Tenant ID, Client ID, and current client secret value. Verify the tenant setting and Fabric access.                                                                                                         |
| A technical schema is missing                                  | Create the missing schema in the Warehouse configured in DinMo. All five schemas are required.                                                                                                                                                                       |
| The write test fails                                           | Confirm that the endpoint is a Warehouse, not a Lakehouse SQL analytics endpoint. For restricted access, verify database-level `CREATE TABLE` and `CREATE VIEW` plus `CONTROL` on all five technical schemas.                                                        |
| Business tables are unavailable                                | Grant `SELECT` on every business schema used by your DinMo models.                                                                                                                                                                                                   |
| The service principal is absent from `sys.database_principals` | This is expected with inherited workspace access. For restricted access, a successful explicit `GRANT` creates the principal. Permission changes can take time to propagate; reconnect before retesting.                                                             |
| The client secret expired                                      | Create a new secret, update the DinMo source, and run **Save & Test**.                                                                                                                                                                                               |
| `COPY INTO` or `OPENROWSET` fails                              | Ask a Fabric administrator to verify external storage access and the initialization requirements in Microsoft's [service principal guide](https://learn.microsoft.com/en-us/fabric/data-warehouse/service-principals#token-renewal-and-initialization-requirements). |

If the issue persists, keep the original Fabric SQL error and contact your DinMo account manager.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.dinmo.io/integrations/data-sources/microsoft-fabric.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.