Use a service principal to authenticate Azure DevOps to Fabric deployment pipelines
Implement lifecycle management in Fabric
AnswerCorrect answer: A — A service principal provides a secure, non-interactive identity for Azure DevOps pipelines to authenticate to the Fabric REST API and run deployment pipelines.
You have a Fabric workspace named Workspace1. You plan to integrate Workspace1 with Azure DevOps. You will use a Fabric deployment pipeline named deployPipeline1 to deploy items from Workspace1 to higher environment workspaces as part of a medallion architecture. You will run deployPipeline1 by using an API call from an Azure DevOps pipeline. You need to configure API authentication between Azure DevOps and Fabric. Which type of authentication should you use?
67% of anonymous learners picked answer A.
Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
Service principals are the supported, non-interactive identity for automating Fabric REST API calls from CI/CD systems such as Azure DevOps pipelines.
To run a Fabric deployment pipeline from an Azure DevOps pipeline via the Fabric REST API, you authenticate with a service principal, which provides a secure, non-interactive identity for automation without user credentials.
Using a Microsoft Entra username and password (interactive, not automation-friendly) or a workspace identity, which governs in-workspace resource access rather than cross-service API authentication.
Community Discussion (8 comments)
hebertorosillo👍 3Selected: B
Microsoft Entra supported identities This API supports the Microsoft identities listed in this section. Identity Support User Yes Service principal and Managed identities Only Power BI Items are supported . ref https://learn.microsoft.com/en-us/rest/api/fabric/core/deployment-pipelines/deploy-stage-content?tabs=HTTP
henryphchan👍 3Selected: A
A service principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources. It provides a secure, non-interactive way for Azure DevOps pipelines to authenticate and interact with Fabric APIs without needing user credentials.
prabhjot👍 1Selected: A
to interact with azure services and devops to implement automation, service principal is most commonly used
h2o_molecule👍 1Selected: A
Here's a brief overview of the options: Service principal: Provides a secure and scalable method for authenticating and authorizing access between Azure DevOps and other services. Ideal for automation and integration scenarios. Microsoft Entra username and password: Less secure and not recommended for automated processes. Managed private endpoint: Used for secure, private connectivity between services, but not specifically for authentication in this context. Workspace identity: Not typically used for cross-service API authentication in Azure DevOps integration scenarios.
robertlavigne👍 3Selected: B
https://learn.microsoft.com/en-us/rest/api/fabric/core/deployment-pipelines/deploy-stage-content?tabs=HTTP The above documentation shows that the deploy pipeline API can only use a service principal to deploy PowerBI content. Since we are deploying content related to a medallion architecture we will need to use user based authentication. Workspace ID is for fabric to reach out to other things which isn't what we want. And a managed private-endpoint is not relevant.
viskas👍 3Selected: A
To configure API authentication between Azure DevOps and Fabric, a service principal is the recommended approach. Workspace identity: Workspace identities are a feature within Fabric itself. They are used to control access to resources within the Fabric workspace. While relevant for managing access within Fabric, they don't directly facilitate authentication with external services like Azure DevOps.
Meir👍 4Selected: A
See https://learn.microsoft.com/en-us/answers/questions/2074603/run-pipeline-via-azure-function-by-rest-api
mixonfreddy👍 2Selected: D
Use of service principal is discouraged
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Log in to comment, report an error, or add a note about this question.
Expert Analysis
Why the Answer Is Correct
The Fabric deployment pipelines REST API supports Microsoft Entra user, service principal, and managed identities, but the API reference notes that managed identities are supported only for Power BI items. For deploying non-Power BI Fabric content (such as lakehouses, notebooks, and pipelines in a medallion architecture) from an Azure DevOps pipeline, a service principal is the recommended non-interactive authentication method, as it avoids embedding user credentials in automation.
Why the Other Options Are Wrong
Option B (Entra username and password) is interactive and unsuitable for unattended automation. Option C (managed private endpoint) is a networking construct, not an authentication identity. Option D (workspace identity) is used by Fabric items to access data resources within the platform, not to authenticate external CI/CD systems calling the Fabric API.
Community Comment Notes
Community voting favors A (60 vs 30). Multiple comments cite the deployment-pipelines REST API doc and explain that service principal is the automation-friendly identity, while managed identities are limited to Power BI items in that API.