SPN Access Map

All automated processes run under dedicated service accounts or service principal names (SPNs) -- never personal accounts. This eliminates the "bus factor" risk where a single person's absence, license change, or account deactivation could break production systems.

Identity Access Diagram

graph LR
    subgraph Identities
        PA["sp-fabric-platform-admin<br/>(Terraform SPN)"]
        DW["sp-fabric-data-worker<br/>(CI/CD SPN)"]
        ADM["geris_fabric_admin<br/>(Human admin)"]
        SVC["svc-powerplatform<br/>(Flow owner)"]
        MI["Function App MI<br/>(Managed Identity)"]
    end
    subgraph Resources
        WS[All Workspaces]
        KV[Key Vault]
        BLOB[Blob Storage]
        OL[OneLake]
        TF[Terraform State]
        SEM[Semantic Models]
        WH[Gold Warehouse]
    end
    PA -->|Admin| WS
    PA -->|Get Secrets| KV
    PA -->|Contributor| TF
    DW -->|Contributor| WS
    DW -->|Get Secrets| KV
    DW -->|Blob Data Contributor| BLOB
    DW -->|Read/Write| WH
    ADM -->|Admin| WS
    ADM -->|Owner| SEM
    ADM -->|Capacity Admin| WS
    SVC -->|Member Gold| WS
    MI -->|Write| OL
    MI -->|Get Secrets| KV

Identity Inventory

SPN Resource Access

sp-fabric-platform-admin

Used by Terraform to provision and manage Fabric workspaces, warehouses, lakehouses, and role assignments.

Auth method: Client secret stored in Key Vault. Pipelines fetch fabric-admin-tenant-id, fabric-admin-client-id, and fabric-admin-client-secret via AzureKeyVault@2 and set them as FABRIC_* environment variables.

sp-fabric-data-worker

Used by all CI/CD pipelines for dbt builds, security script execution, manifest storage, and function deployments.

Auth method: Azure DevOps service connection (fabric-ci-service-connection). All pipelines authenticate via AzureCLI@2 tasks which reuse the az session.

Key Rules

1. SPNs cannot own semantic models -- they lack Pro licenses. Use geris_fabric_admin@geris.nl for semantic model ownership and scheduled refresh.
2. svc-powerplatform@geris.nl is the only identity that should own Power Automate connections and flows in production.
3. Personal accounts retain workspace access for development but must not be the sole owner of any automated process.
4. svc-powerplatform needs Member on Gold -- the Power Automate SQL Server connector requires Member, not Viewer, for SQL endpoint access.

Key Vault Access

Single vault: kv-fabric-dbt-keys in resource group rg-fabric-dbt-platform.

Who can read secrets:

• sp-fabric-data-worker (Key Vault Secrets User role)
• Azure Function Managed Identity (Key Vault access policy)

Who can write secrets:

• IT administrators via Azure Portal
• sp-fabric-data-worker (Storage Account Contributor -- for blob operations, not KV writes)

Workspace Access Matrix

Note: sp-fabric-data-worker needs Contributor on CI workspace for dbt builds and on production Bronze for OneLake shortcut reads. Personal accounts retain Admin for development -- do NOT remove personal access before cutover is complete.

Credential Rotation Procedure

Service principal secrets expire after 1 year. Rotate before expiry to avoid CI/CD pipeline failures.

Affected SPNs:

• sp-fabric-data-worker -- backs fabric-ci-service-connection and Key Vault secret fabric-client-secret
• sp-fabric-platform-admin -- used for Terraform and workspace management

Rotation Steps for sp-fabric-data-worker

1. Create new secret in Entra ID:

   • Azure Portal > Entra ID > App registrations > sp-fabric-data-worker
   • Certificates & secrets > New client secret > Set expiry (1 year recommended)
   • Copy the new secret value immediately (it cannot be retrieved later)

2. Update Key Vault:

   • Azure Portal > kv-fabric-dbt-keys > Secrets > fabric-client-secret
   • New version > paste the new secret value > Create

3. Update Azure DevOps service connection:

   • Azure DevOps > Project Settings > Service connections > fabric-ci-service-connection
   • Edit > paste the new secret > Verify > Save

4. Verify pipelines:

   • Run infra-deploy, dbt-dev-build, and security-deploy manually
   • Check that all three complete without authentication errors

5. Delete old secret:

   • Return to Entra ID > App registrations > sp-fabric-data-worker > Certificates & secrets
   • Delete the previous (now-superseded) secret
   • Only delete after verifying all pipelines work with the new secret

6. Update calendar reminder:

   • Set a reminder for 11 months from today (1 month before new secret expires)

Rotation for sp-fabric-platform-admin

Follow the same steps, but update the secret wherever sp-fabric-platform-admin credentials are stored (Terraform backend config, any Azure DevOps service connections that reference this SPN).

Service Connection

To verify service connection health:

1. Azure DevOps > Project Settings > Service connections
2. Click fabric-ci-service-connection > Verify
3. If verification fails, check: SPN secret expiry, SPN permissions in Entra ID, Fabric tenant SPN API access setting

Related Pages

• RBAC Architecture -- 7-layer security overview
• Workspace Roles -- per-workspace role matrix
• Pipeline Architecture -- how pipelines authenticate