Connections and credentials

Fabric credentials

A Fabric credential is the Microsoft Entra ID identity Kenseme signs in with when it talks to your Microsoft Fabric tenant. Every Fabric feature in Kenseme uses one, so an organization admin usually adds it before anyone binds an ontology to a lakehouse or picks a Fabric warehouse.

In the app: Settings › Organization Settings › External Credentials › Fabric Credentials

[screenshot]
The Microsoft Fabric Credentials page with one credential and its List Workspaces and Browse Lakehouses actions.

Before you start

  • You need the Admin role in the organization. See Roles in Kenseme.
  • Register an app in Microsoft Entra ID (or use a managed identity) and note its tenant ID and client (application) ID.
  • Give that identity access in Fabric. Add the service principal as a Member or Admin on each Fabric workspace Kenseme should reach. Your Fabric administrator may also need to allow service principals to use Fabric APIs in the tenant settings.

What uses a Fabric credential

Wherever Kenseme opens its Fabric browser, you pick a credential from the Fabric environment: list at the top. That includes:

If the organization has no credential, the Fabric browser says No Fabric credentials configured — add one under Organization Settings → Fabric Credentials.

Add a credential

  1. Open Organization Settings, go to the External Credentials tab, and click Fabric Credentials.
  2. Click Add Credential (or Add First Credential if the list is empty).
  3. Enter a Display Name. It’s optional, but it’s what people see in the Fabric environment: list, so name it after the tenant or purpose, such as Contoso Fabric (Prod). A credential without a name shows as Credential # and a number.
  4. Choose the Auth Mode: ClientSecret, Certificate, or ManagedIdentity.
  5. Enter the Tenant Id (GUID) and Client Id (GUID). Both must be GUIDs.
  6. Fill in the field for your auth mode (see the table below).
  7. Click Create. A toast confirms Fabric credential added successfully.
Auth mode Extra fields
ClientSecret Client Secret (required).
Certificate Certificate (PFX) — upload a .pfx or .p12 file (required) — and Certificate Password (optional).
ManagedIdentity User-Assigned MI Client Id (optional). Leave it blank to use the system-assigned identity of the host Kenseme runs on.

Note: The client secret and certificate are saved in a secure secret store. The page only keeps the metadata you see in the list, and you can’t view a secret after saving it. To change a secret, add a new credential and delete the old one.

Check that a credential works

Each row has two test actions. Neither changes anything in Fabric.

  • List Workspaces signs in with the credential and lists the Fabric workspaces it can see, with each workspace’s Display Name, Type, and Id.
    • Connection successful — found N workspaces. means it works.
    • Connection successful — no workspaces available means the sign-in worked but the service principal has no workspace roles yet. Add it as a Member or Admin on at least one workspace.
    • Could not list workspaces shows the reason, a request ID you can give to support, and the full error under Error details.
  • Browse Lakehouses opens the lakehouse browser with this credential so you can confirm it can reach a lakehouse and its tables. Selecting objects there only shows a confirmation message; nothing is saved.

The credentials list

Column What it shows
Display Name The name you gave the credential.
Auth Mode ClientSecret, Certificate, or ManagedIdentity.
Tenant Id The Entra tenant the credential signs in to.
Client Id The app registration or managed identity.
Updated When the credential was last changed.

A row marked Override is configured for your organization on the Kenseme host rather than on this page. It can be tested but not deleted here.

Delete a credential

Click the delete button on the row and confirm. The stored secret or certificate is deleted too, and this can’t be undone.

Kenseme refuses to delete a credential that a Fabric database connection still uses. The message names those connections: This credential is used by 1 database connection(s): Sales Lakehouse. Delete those connections first.

Warning: Only database connections are checked. A lakehouse binding environment that uses the credential stops being able to reach Fabric once the credential is gone. Re-point those environments to another credential before you delete it.

🚩 TODO: The page’s own subtitle says “Assign a credential to a schema on its settings tab”, but no schema settings screen offers a credential picker today. Confirm whether that line is stale.