---
title: "Microsoft Service Principal"
slug: "microsoft-service-principal-1"
updated: 2026-07-14T10:19:16Z
published: 2026-07-14T10:19:16Z
canonical: "docs.dataddo.com/microsoft-service-principal-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dataddo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Service Principal

The Microsoft Service Principal authorizer lets Dataddo access Microsoft and Azure services with an application identity instead of a personal user account. You register an application in Microsoft Entra ID (formerly Azure Active Directory) and give Dataddo its credentials. Dataddo then requests short-lived access tokens from Microsoft on its own. There is no interactive sign-in and no dependency on any employee's account.

## How It Works

Dataddo uses the OAuth 2.0 client credentials flow. With the Client ID, Client Secret, and Tenant ID you provide, Dataddo requests an access token from Microsoft for the scopes you select. Tokens are short-lived and Dataddo refreshes them automatically. The client secret is stored encrypted.

## Register the Application in Azure

1. Sign in to the Azure Portal and open **Microsoft Entra ID**.
2. Go to **App registrations** and select an existing application or create a new one.
3. On the **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.
4. Open **Certificates & secrets**, create a new client secret, and copy its value right away. Azure shows the value only once.
5. Open **API permissions** and click **Add a permission**. Choose the Microsoft service you want to access and select the permissions its official API documentation requires.
6. If the selected permissions require it, grant admin consent.

Some services also require access on the resource itself. For example, add a role assignment on an Azure Storage account, or grant workspace access in Microsoft Fabric.

## Create the Authorizer in Dataddo

1. In Dataddo, go to **Authorizers** and click **Authorize New Service**.
2. Search for and select **Microsoft Service Principal**.
3. Fill in the fields:

| Field | Description |
| --- | --- |
| Client ID | The Application (client) ID from the app registration's Overview page. |
| Client Secret (Shared Key) | The value of the client secret you created under Certificates & secrets. |
| Tenant ID | The Directory (tenant) ID from the app registration's Overview page. |
| Scopes | The permissions (scopes) required by the Microsoft service you are connecting to, as specified in its official API documentation. |

1. Click **Save**. Dataddo immediately requests a token from Microsoft to validate the credentials. The authorizer is only created when they work.

## Where You Can Use It

One service principal authorizer can serve multiple Dataddo sources and destinations, including Microsoft Fabric, Azure Blob Storage, Azure Event Hubs, Microsoft SharePoint, and OneDrive.

## Troubleshooting

**Saving the authorizer fails with a token error**

- Check that the Client ID, Client Secret, and Tenant ID match the app registration exactly.
- Check that the client secret has not expired in Azure. Secrets have an expiry date; create a new one and update the authorizer if needed.
- Check that at least one valid scope is selected.

**The authorizer works, but the source or destination gets access denied**

- Check the app registration's API permissions and grant admin consent if required.
- Check that the application has access to the resource itself, for example the storage account role or the SharePoint site or Fabric workspace.