> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-docs-baton-kubernetes.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up a Microsoft Fabric connector

> C1 provides identity governance for Microsoft Fabric. Integrate your Fabric tenant with C1 for unified visibility and governance over workspace access.

C1 provides identity governance for Microsoft Fabric. Integrate your Fabric
tenant with C1 for unified visibility and governance over who has access to each
workspace.

## Capabilities

| Resource           | Sync                                                          | Provision |
| ------------------ | ------------------------------------------------------------- | --------- |
| Workspaces         | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Users              | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |
| Service principals | <Icon icon="square-check" iconType="solid" color="#c937ae" /> |           |

This connector is **read-only**: it syncs workspaces, the fixed workspace roles
(Admin, Member, Contributor, Viewer) as entitlements, and the user and service
principal role assignments through the Fabric Core REST API v1. It does not
provision changes back to Fabric.

## Gather Microsoft Fabric credentials

<Warning>
  You need a Microsoft Entra (Azure AD) administrator to register an application
  and a Fabric administrator to allow service principals to use the Fabric APIs.
</Warning>

<Steps>
  <Step>
    In the Azure portal, open **Microsoft Entra ID** > **App registrations** and
    register a new application (single tenant is sufficient). Note the
    **Directory (tenant) ID** and the **Application (client) ID** from the app's
    Overview page.
  </Step>

  <Step>
    Under the app's **Certificates & secrets**, create a new **client secret**
    and copy its value. It is shown only once.
  </Step>

  <Step>
    In the **Fabric admin portal** > **Tenant settings**, enable **Service
    principals can use Fabric APIs** and add the application (or a security group
    that contains it) to the allowed list. Grant the service principal at least
    Viewer access on the workspaces you want C1 to see.
  </Step>
</Steps>

## Configure the Microsoft Fabric connector

<Tabs>
  <Tab title="Cloud-hosted">
    Follow these instructions to use a built-in, no-code connector hosted by C1.

    <Steps>
      <Step>
        In C1, navigate to **Integrations** > **Connectors** and click **Add connector**.
      </Step>

      <Step>
        Search for **Microsoft Fabric** and click **Add**.
      </Step>

      <Step>
        Choose how to set up the new Microsoft Fabric connector.
      </Step>

      <Step>
        Set the owner for this connector.
      </Step>

      <Step>
        Click **Next**.
      </Step>

      <Step>
        Find the **Settings** area of the page and click **Edit**.
      </Step>

      <Step>
        Enter the Microsoft Fabric credentials:

        * **Tenant ID**: the Entra directory (tenant) ID.
        * **Client ID**: the Entra application (client) ID.
        * **Client secret**: the client secret created for the application.
        * **Entra login authority**: `https://login.microsoftonline.com` for the
          global Azure cloud, or your national-cloud authority host.
      </Step>

      <Step>
        Click **Save**.
      </Step>

      <Step>
        The connector's label changes to **Syncing**, followed by **Connected**. You can view the logs to ensure that information is syncing.
      </Step>
    </Steps>

    **Done.** Your Microsoft Fabric connector is now pulling access data into C1.
  </Tab>

  <Tab title="Self-hosted">
    Follow these instructions to run the Microsoft Fabric connector in your own
    environment.

    <Steps>
      <Step>
        Create a secret for the Entra application client secret.
      </Step>

      <Step>
        Configure the connector with the tenant ID, client ID, client secret,
        and the Entra login authority (`https://login.microsoftonline.com` for
        the global cloud).
      </Step>

      <Step>
        Deploy the connector using your standard self-hosted connector process.
      </Step>
    </Steps>

    **Done.** Your Microsoft Fabric connector is now pulling access data into C1.
  </Tab>
</Tabs>