Microsoft Fabric

​

Data we collect

• Catalog — the workspace’s databases (Warehouses and Lakehouse SQL endpoints), schemas, tables, views, columns, data types, and constraints. Fabric constraints (primary key / unique / foreign key) are informational (NOT ENFORCED) but are still read from metadata.
• SQL definitions — the T-SQL of views, stored procedures, and functions. Used for lineage and to detect references between objects.
• Table metrics — row counts and last-modified timestamps for anomaly detection, collected for the tables in scope (see Metrics scope below).
• Query history (recommended, on by default) — read from the workspace’s queryinsights system views for cost attribution and SQL / column-level lineage. Management-plane reads only — no per-query billing. Requires the service principal to have the Contributor (or higher) workspace role — see Give the service principal a role on the workspace.

​

Set up access

​

1. Register an Entra service principal

# Sign in to your tenant
az login --tenant <your-tenant>

# 1. Create the app registration
APP_ID=$(az ad app create \
  --display-name "coalesce-quality-fabric-scraper" \
  --sign-in-audience AzureADMyOrg \
  --query appId -o tsv)
echo "Client (application) ID: $APP_ID"

# 2. Create the service principal for that app
az ad sp create --id "$APP_ID"

# 3. Mint a client secret (the value is shown only once — store it securely)
az ad app credential reset \
  --id "$APP_ID" \
  --display-name "coalesce-quality" \
  --years 1 \
  --query "{clientId:appId, clientSecret:password, tenantId:tenant}" -o json

​

2. Allow service principals to use Fabric

1. Open the Fabric admin portal → Tenant settings → Developer settings.
2. Enable “Service principals can use Fabric APIs”.
3. We recommend scoping it to a security group that contains only this service principal, to keep the blast radius small.

​

3. Give the service principal a role on the workspace

​

4. (Optional) Least-privilege SQL grants for a Viewer

GRANT VIEW DEFINITION TO [coalesce-quality-fabric-scraper];   -- SQL definitions / lineage
GRANT SELECT          TO [coalesce-quality-fabric-scraper];   -- only if table metrics / samples are enabled

​

5. Network access

​

Input data in the Coalesce Quality UI

​

Integration name

​

SQL analytics endpoint

​

Default warehouse (optional)

​

Microsoft Entra service principal

• Application (client) ID — the Entra application (client) ID from step 1.
• Client secret — the service principal client secret. Stored encrypted and never displayed again in our UI.
• Directory (tenant) ID (optional) — only needed when the service principal lives in a different Entra tenant than the Fabric endpoint; inferred automatically when left blank.

​

Data collection

• Fetch query history (recommended, on by default) — reads the workspace’s queryinsights query history for cost attribution and SQL / column-level lineage. Management-plane reads only — no per-query billing. Needs the service principal on the Contributor (or higher) workspace role; a Viewer cannot read queryinsights. Databases without a queryinsights schema (Lakehouse SQL endpoints, Fabric SQL databases, mirrored databases) are skipped automatically.

​

Scope

• Catalog scope — which Warehouses, schemas, and tables are ingested into the catalog. Empty means everything is ingested.
• Metrics scope — which tables are scanned for metrics. Empty means metrics are collected for all ingested tables.

​

Personal access (user OAuth)

​

Register the OAuth app in Microsoft Entra

1. In the Entra admin center, open App registrations → New registration and give it a name, e.g. coalesce-quality-fabric-user-oauth.
2. Under Authentication → Add a platform → Web, add the Redirect URI(s) for the Coalesce Quality region(s) your members use, with no trailing slash:
   • EU: https://app.synq.io/auth/dwh-oauth/callback
   • US: https://app.us.synq.io/auth/dwh-oauth/callback
3. Under API permissions → Add a permission → APIs my organization uses, search for Azure SQL Database, choose Delegated permissions, and add user_impersonation (this is the https://database.windows.net/user_impersonation scope). No tenant-admin consent is required — it’s user-consentable, so each member consents once at sign-in.
4. Under Certificates & secrets → New client secret, create a secret and copy its value (shown only once).
5. Copy the Application (client) ID and the client secret.