...
Version | Date | Description | Contributor |
V0.1 |
| Initial document | COLOMBANI Théo |
V0.2 |
| Added to the wiki | COLOMBANI Théo |
V0.3 |
| Added Shortcut specific guidelines (section 4) Added authentification part to be set up (section 5) | COLOMBANI Théo |
| Table of Contents | ||
|---|---|---|
|
...
This guide focuses on the two recommended enterprise patterns:
- Identity
identity : To use workspace identity authentication for OneDrive or SharePoint shortcuts, you need to grant your workspace identity access to the OneDrive or SharePoint site.
Service Principal :To use service principal authentication, register an application in Microsoft Entra ID and create a client secret. Then, grant the service principal access to your SharePoint site using Microsoft Graph. The service principal needs at least read permission on the SharePoint site
Service Principal
...
2. Summary — Workspace Identity vs Service Principal
| Info |
|---|
| Criteria | Workspace Identity | Service Principal |
|---|---|---|
| Definition | Fabric-managed identity (auto-created service principal) | Entra ID application identity |
| Credential management | Fully managed (no secrets) | Requires secret or certificate |
| Setup complexity | Low | Medium |
| Governance control | Limited to Fabric scope | Full control via Entra ID |
| SharePoint authorization | Requires explicit site access | Requires explicit site access |
| Security risk | Low (no credential exposure) | Medium (secret lifecycle) |
| Cross-platform usage | Limited | Strong (usable across services) |
| Lifecycle | Tied to workspace | Independent lifecycle |
| Recommended usage | Simplicity / low ops | Enterprise governance / control |
...
3.2 Configuration Steps (Shortcut context)
| Info |
|---|
- Create a Workspace Identity in Fabric
- Workspace settings → Workspace Identity
- Requires admin role
- Retrieve the identity in Entra ID
- Same name as workspace
- Copy Application ID
- Grant access to SharePoint site
- Add the identity to the site permissions
- Minimum: read access
- Create the Shortcut
- Select Workspace Identity as authentication method
...
4.2 Configuration Steps (Shortcut context)
| Info |
|---|
- Create an App Registration in Entra ID
- Generate:
- Client ID
- Client Secret or Certificate
- Generate:
- Assign API permissions
- SharePoint / Graph permissions
- Prefer Sites.Selected
- Grant access to SharePoint site
- Explicitly authorize the Service Principal
- Required in addition to API permissions
- Configure authentication in Fabric
- Select Service Principal in Shortcut
- Provide credentials
...