Clarification needed on "end users" requirement for Azure AI Foundry Agent with Fabric data agent integration

Question

Clarification needed on "end users" requirement for Azure AI Foundry Agent with Fabric data agent integration

Durjan Hussain 155

Hello Microsoft team,

I'm implementing Azure AI Foundry Agent Service with Microsoft Fabric data agent integration and need clarification on the prerequisites section in the documentation (https://learn.microsoft.com/en-us/azure/ai-foundry/agents/how-to/tools/fabric?pivots=portal#prerequisites).

Question 1: What does "end users" mean in this context?

The documentation states: "Developers and end users have at least Azure AI User RBAC role" and "Developers and end users have at least READ access to the Fabric data agent and the underlying data sources it connects with."

Does "end users" refer to:

The actual humans interacting with the application UI?
The application/service making API calls to Azure AI Foundry?
Both?

Question 2: Service Principal and Managed Identity support

Can I use the following authentication methods instead of user accounts:

Service Principal with appropriate RBAC roles assigned?
System-assigned Managed Identity (for an Azure Container App)?
User-assigned Managed Identity?

If yes, what specific roles/permissions need to be assigned to these identities?

Question 3: Azure Container App scenario with logged-in users

My specific use case:

Application running in Azure Container Apps
Users authenticate via Azure AD (with proper permissions to Fabric data)
Application needs to call Azure AI Foundry Agent on behalf of the authenticated user

Should I:

Pass the user's token directly to Azure AI Foundry (maintaining user identity)?
Use the container app's managed identity with some form of identity passthrough?
Use On-Behalf-Of (OBO) flow to exchange user token for AI Foundry token?

Current Issue: I can successfully call the Fabric data agent when authenticated as my user account directly, but I'm getting connection errors when trying to use service principal authentication, even though the service principal has Admin role in the Fabric workspace.

Any guidance on the proper authentication flow for container-hosted applications would be greatly appreciated.

Thanks!

Manas Mohanty 9,655 Reputation points Microsoft External Staff Moderator

2025-08-28T12:19:21.35+00:00
Hi Durjan Hussain

Here are answer to your queries

1. What Does “End Users” Mean in This Context?

In the context of Azure AI Foundry Agent with Fabric data agent integration, “end users” refers to:

Actual humans interacting with the application UI, such as employees using a chatbot or dashboard powered by AI agents.

Applications/services making API calls to Azure AI Foundry on behalf of those users.

Both developers and end users must have the Azure AI User RBAC role and READ access to the Fabric data agent and its underlying data sources

2. Service Principal and Managed Identity Support

Yes, you can use Service Principals and Managed Identities (both system-assigned and user-assigned) for authentication instead of user accounts. However, the following conditions must be met:

Assign the Azure AI User role to the identity.

Grant READ access to the Fabric data agent and connected data sources.

Ensure the identity has access to the OneLake workspace if grounding AI agents on enterprise data.

3. Azure Container App Scenario with Logged-In Users

For your scenario—an Azure Container App with Azure AD-authenticated users—the recommended approach is:

Use the On-Behalf-Of (OBO) flow to exchange the user's Azure AD token for a token that Azure AI Foundry can use. This maintains user identity and ensures proper access control

Avoid using the container app’s managed identity alone unless the app is acting independently of user context.

Passing the user's token directly is technically possible but less secure and scalable than OBO.

Current Issue: Service Principal Connection Errors

Even though your service principal has Admin role in the Fabric workspace, connection errors may occur due to:

Missing Azure AI User role assignment (You might need to add your container app as Azure AI user role)

Misconfigured **network or identity passthrough settings (**container has to be in same virtual network and region)

You might want to verify these settings and consider using the OBO flow if the service principal is acting on behalf of users.

Note: Adding fabric data is a preview feature

References

[1] How to use the data agents in Microsoft Fabric with Azure AI Foundry ...

[2] https://learn.microsoft.com/en-us/azure/ai-foundry/agents/how-to/tools/fabric?pivots=portal#prerequisites

Thank you

1 answer

Your answer

Answer 1

Hello Durjan Hussain,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you would like to clarify needs on "end users" requirement for Azure AI Foundry Agent with Fabric data agent integration.

Regarding your explanation:

About what does "End Users" mean In Azure AI Foundry + Fabric integration, "end users" refers to:
- Human users interacting with the agent via UI or chat.
- Service identities (e.g., managed identity or service principal) making API calls.
Both must have:
- Azure AI User RBAC role. READ more about access to the Fabric data agent and its underlying data sources - https://learn.microsoft.com/en-us/azure/ai-foundry/agents/overview
Yes, you can use:
- Service Principal which must be assigned:
- Cognitive Services User role on the AI Foundry resource - https://learn.microsoft.com/en-us/azure/ai-foundry/agents/concepts/standard-agent-setup
- Azure AI User role on the project - https://microsoft.github.io/build-your-first-agent-with-azure-ai-agent-service-workshop/
- Requires custom subdomain for Microsoft Entra ID authentication - https://learn.microsoft.com/en-us/azure/ai-foundry/agents/concepts/standard-agent-setup
- System/User-Assigned Managed Identity also must be assigned:
- Azure AI User role on the AI Foundry project - https://microsoft.github.io/build-your-first-agent-with-azure-ai-agent-service-workshop
- Reader role on the Fabric workspace and data sources - https://learn.microsoft.com/en-us/azure/ai-foundry/agents/overview
- But, role assignment must use the Object ID of the identity, not the App ID as stated in this doc - https://learn.microsoft.com/en-us/azure/ai-foundry/agents/concepts/standard-agent-setup
In reviewing Azure Container App scenario with Logged-In users, I will recommend flow: On-Behalf-Of (OBO):
- Exchange the user's Azure AD token for a token to call Azure AI Foundry.
- Maintains user identity and enforces data access control.
- You'll see more steps to implement OBO Flow in this doc: - https://learn.microsoft.com/en-us/azure/ai-foundry/agents/overview
If you're getting connection errors with service principal:
- Ensure custom subdomain is configured.
- Assign Cognitive Services User role to Object ID of service principal.
- Wait for RBAC propagation (up to 5 minutes).
- Use correct token format: Bearer <token> in Authorization header.
- See more details here - https://learn.microsoft.com/en-us/azure/ai-foundry/agents/concepts/standard-agent-setup

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Share via

Clarification needed on "end users" requirement for Azure AI Foundry Agent with Fabric data agent integration

1 answer

Your answer