[Python] How to grant permissions to my application to use Microsoft Fabric services?

I have created an application following the steps in Microsoft's documentation:

Step 1: Register an Application in Azure AD

1. Go to Azure Portal: portal.azure.com
2. Navigate to Microsoft Entra ID (Azure AD) > App registrations.
3. Click + New registration and enter:
   • Name: (e.g., FabricAPIApp)
   • Supported account types: Select "Accounts in this organizational directory only".
4. Click Register.

Get Required Values

• Application (Client) ID → This is your APP_ID.
• Directory (Tenant) ID → You'll need this for authentication.
• Object ID (not directly needed for token retrieval, but used for permissions).

Step 2: Create a Client Secret (If Using Client Credentials)

1. In your registered app, go to Certificates & secrets.
2. Click + New client secret.
3. Set an expiration time (e.g., 1 year) and click Add.
4. Copy and save the Client Secret value (CLIENT_SECRET) securely.

Step 3: Set up the role


1- In Microsoft Fabric, go to the workspace and give to the user who going to use the API the role contributor.

Step 4: Get the access token


%pip install msal
import msal

CLIENT_ID = ""
CLIENT_SECRET= ""
AUTHORITY = "https://login.microsoftonline.com/<TENANT_ID>"
SCOPES = ["https://api.fabric.microsoft.com/.default"]

app = msal.ConfidentialClientApplication(
CLIENT_ID,
authority=AUTHORITY,
client_credential=CLIENT_SECRET
)

result = app.acquire_token_for_client(scopes=SCOPES)

if "access_token" in result:
access_token = result["access_token"]
print("[+] Token obtained.")
else:
print("[-] Error getting token:", result.get("error_description"))
exit()


The last step I'm trying is making a GET request to view my workspaces, but this comes up:

[+] Token obtained. [+] Response: {'value': []}

If I try other requests with different endpoints, I get a 401 error. I’ve been investigating, and this documentation https://learn.microsoft.com/en-us/rest/api/fabric/core/workspaces/get-workspace?tabs=HTTP says that my app needs to have this:

Required Delegated Scopes Workspace.Read.All or Workspace.ReadWrite.All

But I don’t know where to grant it. I tried from the Azure portal, in API permissions, but I can’t find anything related to Fabric. Does anyone have an idea?

I tried to search fabric service on https://aad.portal.azure.com/ > dashboard > my api > api permissions

The GET request:

headers = {
"Authorization": f"Bearer {access_token}",
"Content-Type": "application/json"
}

url = "https://api.fabric.microsoft.com/v1/workspaces"
response = requests.get(url, headers=headers)

if response.status_code == 200:
print("[+] Response:", response.json())
else:
print(f"[-] Error: {response.status_code} - {response.text}")


This is how the permissions panel looks, and I don't see "fabric" here --> https://www.youtube.com/watch?v=4NByBBdy11I

Continue reading...