The Microsoft Service Principal authorizer lets Dataddo access Microsoft and Azure services with an application identity instead of a personal user account. You register an application in Microsoft Entra ID (formerly Azure Active Directory) and give Dataddo its credentials. Dataddo then requests short-lived access tokens from Microsoft on its own. There is no interactive sign-in and no dependency on any employee's account.
How It Works
Dataddo uses the OAuth 2.0 client credentials flow. With the Client ID, Client Secret, and Tenant ID you provide, Dataddo requests an access token from Microsoft for the scopes you select. Tokens are short-lived and Dataddo refreshes them automatically. The client secret is stored encrypted.
Register the Application in Azure
- Sign in to the Azure Portal and open Microsoft Entra ID.
- Go to App registrations and select an existing application or create a new one.
- On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.
- Open Certificates & secrets, create a new client secret, and copy its value right away. Azure shows the value only once.
- Open API permissions and click Add a permission. Choose the Microsoft service you want to access and select the permissions its official API documentation requires.
- If the selected permissions require it, grant admin consent.
Some services also require access on the resource itself. For example, add a role assignment on an Azure Storage account, or grant workspace access in Microsoft Fabric.
Create the Authorizer in Dataddo
- In Dataddo, go to Authorizers and click Authorize New Service.
- Search for and select Microsoft Service Principal.
- Fill in the fields:
| Field | Description |
|---|---|
| Client ID | The Application (client) ID from the app registration's Overview page. |
| Client Secret (Shared Key) | The value of the client secret you created under Certificates & secrets. |
| Tenant ID | The Directory (tenant) ID from the app registration's Overview page. |
| Scopes | The permissions (scopes) required by the Microsoft service you are connecting to, as specified in its official API documentation. |
- Click Save. Dataddo immediately requests a token from Microsoft to validate the credentials. The authorizer is only created when they work.
Where You Can Use It
One service principal authorizer can serve multiple Dataddo sources and destinations, including Microsoft Fabric, Azure Blob Storage, Azure Event Hubs, Microsoft SharePoint, and OneDrive.
Troubleshooting
Saving the authorizer fails with a token error
- Check that the Client ID, Client Secret, and Tenant ID match the app registration exactly.
- Check that the client secret has not expired in Azure. Secrets have an expiry date; create a new one and update the authorizer if needed.
- Check that at least one valid scope is selected.
The authorizer works, but the source or destination gets access denied
- Check the app registration's API permissions and grant admin consent if required.
- Check that the application has access to the resource itself, for example the storage account role or the SharePoint site or Fabric workspace.