Audit Fabric connections before you put agents on top of them

Microsoft Fabric administrators now have a better way to answer a deceptively hard question: is a shared connection actually in use, or is it merely still configured?

The new Connection Recency metadata exposes two different signals. LastBoundDateTime records when a connection was most recently linked to a Fabric item. LastCredentialUsedDateTime records when a workload most recently used the connection’s credentials. The fields are intended for governance and investigation rather than real-time monitoring.

That distinction matters before teams expand natural-language and agentic access to a Fabric estate. A connection can remain bound to an item that runs every day, or it can be newly linked and never execute. Treating “old” and “unused” as synonyms can either preserve forgotten credentials indefinitely or break a legitimate seasonal workflow.

Three reviews, not one delete rule

Microsoft’s companion notebook turns the metadata into three review queues: stale connections, duplicate connections, and ownership-continuity risks. The sample defaults to flagging credentials unused for 90 days, but explicitly warns operators to confirm annual, seasonal and incident-response workloads before changing anything.

For duplicates, the suggested comparison uses connection type, path, connectivity type and gateway ID, then uses recent credential activity to identify the likely preferred connection. For ownership, it flags connections whose only owner is an individual user and recommends an approved Microsoft Entra group as the more durable operating model.

The sample is deliberately conservative. Its executable audit cells are read-only; the optional ownership-change cell is commented out. Microsoft also notes that API visibility is caller-dependent: cloud connections are generally visible only to their owners, while gateway administrators can see connections on gateways they administer. A tenant-wide inventory therefore requires an identity and scope design, not just a notebook run.

The practical rollout order

Teams should use the new fields as evidence for a human-reviewed lifecycle process:

1. Inventory the connections visible to the audit identity.
2. Separate “last linked” from “last credentials used.”
3. Ask owners to validate low-frequency workloads.
4. Consolidate confirmed duplicates.
5. Replace single-person ownership with approved groups where appropriate.
6. Only then broaden self-service or agent access.

This is not an agent feature by itself. It is plumbing—and that is precisely why it matters. An analytics agent can inherit the fragility of every connection beneath it. Connection Recency gives operators a measurable way to reduce that hidden operational debt before adding another access surface.