Control access and mutations

Choose how Microsoft Fabric accesses data and control read and write operations in ajan.

Choose how Fabric accesses data

Choose Single sign-on (SSO) when users should access each source with their own identity. Users need access to the GraphQL API and its underlying sources. Fabric evaluates the source's permissions and security rules for the signed-in user.

Choose Saved credentials when all API users should access the source through one centrally managed identity. Fabric stores this connection, not ajan. Users still sign in to ajan with Microsoft OAuth and need access to the GraphQL API, but Fabric evaluates source access as the saved identity.

Each GraphQL API uses one connectivity option across all of its sources. Microsoft documents the current requirements in its authentication and permissions summary.

Control who can read or change data

Fabric grants query and mutation execution through the same Run Queries and Mutations API permission, also shown as Execute under direct access. Effective access still depends on what the API exposes and which source permissions apply.

With SSO, grant users or Microsoft Entra groups only the source access they need. With Saved credentials, apply least privilege to the saved identity instead. For broader rollouts, use separate GraphQL APIs for distinct audiences or use cases and expose only the relevant sources, objects, and operations in each API.

Fabric owns the detailed permission model and source-level controls. Follow Microsoft's current guidance for the Fabric permission model and the relevant source, such as Fabric SQL databases or Warehouses and SQL analytics endpoints.

Add mutations safely

ajan provides separate actions for GraphQL queries and mutations. Queries cannot execute a mutation. Before ajan executes a mutation, it asks the user for confirmation.

Fabric determines which sources and objects can expose mutations. To keep an API read-only for an audience, do not expose mutations in that API or do not grant its source identity write access. See Microsoft's current supported sources and operations and GraphQL limitations.

For controlled business operations, consider exposing a stored procedure that validates its inputs and applies the complete change. Microsoft documents how to use stored procedures with Fabric API for GraphQL.

Preserve individual access in shared agents and workflows

For shared agents and workflows that should preserve each user's Fabric access, select Their own credentials for the Fabric actions. Each user connects their own Microsoft account, and an API using SSO applies that user's Fabric permissions.

A preselected ajan connection runs the actions as that connection's owner. An API using Saved credentials always accesses its sources as the saved Fabric identity, regardless of which ajan connection calls the API.