Fabric gives operations agents an identity—but borrows the creator’s authority

Microsoft Fabric’s operations agent has its own Microsoft Entra identity, but it does not have an independent permission set. Microsoft’s documentation says each agent is provisioned as a specialized service principal for visibility and audit attribution, while queries and approved actions run through an On-Behalf-Of flow using the creator’s authorization.

That distinction is easy to miss, and it changes how teams should review an agent before production.

Identity answers “who acted?”

Microsoft’s operations-agent setup documentation says an agent appears as a first-class entity in the Entra admin center. Its activity can therefore be distinguished from a human session, and its identity is not tied to the continued existence of an anonymous runtime.

The same page says the agent monitors its source by running an explicit query for each rule every five minutes. Teams can inspect and test those generated queries before starting the agent. This makes the agent identity useful for inventory and attribution: administrators can name the agent, see that it exists and associate monitored queries with the automation.

Authority still answers “what could it do?”

The authorization boundary is different. Microsoft says operations agents run in delegated mode with the creator’s permissions. Its actions documentation adds that a message recipient can approve a recommendation, but the eventual action still executes on behalf of the creator. Changing the Teams recipient does not transfer or narrow the execution authority.

That matters because the agent can do more than notify. Microsoft documents actions that run Fabric notebooks, pipelines and user-defined functions, as well as Power Automate flows. The practical blast radius is therefore determined by the creator account plus whatever those downstream items can reach—not merely by who receives the approval card.

Microsoft’s limitations page makes the inheritance explicit: queries and actions use the creator’s credentials. It also says the agent supports one data source at a time, requires timestamped data and expires unapproved actions after three days.

Review both sides of the contract

A production review should treat identity and authority as separate records. Keep the Entra agent identity in the inventory and audit trail, but separately record the creator account, its workspace access and every notebook, pipeline or flow the agent may invoke. Re-run that review whenever the creator’s role changes.

The useful test is not only “Can we identify this agent after an incident?” It is also “Which human account determines what this agent can query and execute today?” Fabric answers the first with a dedicated identity and the second with delegated creator authority. Deployments need controls for both.