Fabric CLI Core

This skill defines safe, consistent defaults for an AI agent helping users operate Microsoft Fabric via the Fabric CLI (fab).

1 - Fabric CLI mental model (paths and entities)

Ready-to-use Python scripts for core CLI tasks. Run any script with --help for full options.

Script	Purpose	Usage
`health_check.py`	Verify CLI installation, auth status, and connectivity	`python scripts/health_check.py [--workspace WS]`

Scripts are located in the scripts/ folder of this skill.

Treat Fabric as a filesystem-like hierarchy with consistent dot (.) entity suffixes in paths (e.g., .Workspace, .Folder, .SemanticModel).
The hierarchy structure is:
- Tenant: The top-level container for everything.
- Workspace: Personal or team workspace holding folders, items, and workspace-level elements.
- Folder: Container for organizing items within a workspace (supports ~10 levels of nesting).
- Item: Individual resource within a workspace or folder (e.g., Notebook, SemanticModel, Lakehouse).
- OneLakeItem: OneLake storage item residing within a Lakehouse (tables, files, etc.).
Prefer and generate paths like:
- /Workspace1.Workspace/Notebook1.Notebook
- /Workspace1.Workspace/FolderA.Folder/SemanticModel1.SemanticModel
- /Workspace1.Workspace/FolderA.Folder/lh1.Lakehouse/Tables (OneLakeItem)
When a user provides an ambiguous identifier, ask for the full path (or infer with stated assumptions).

Be explicit about which mode a user is in:
- Interactive mode behaves like a REPL and runs commands without the fab prefix.
- Command line mode runs one command per invocation and is best for scripts/automation.
The selected mode is preserved between sessions. If a user exits and logs back in, the CLI resumes in the same mode last used.
When you provide instructions, show commands in command line mode unless the user says they're in interactive mode.

Prefer these auth patterns and do not invent new flows:
1. Interactive user: fab auth login (browser/WAM where supported).
2. Service principal (secret/cert): use environment variables / secure mechanisms; avoid embedding secrets in files.
3. Service principal (federated credential): use the federated token environment variable (FAB_SPN_FEDERATED_TOKEN) and do not persist the raw token.
4. Managed identity: supported for Azure-hosted workloads; no credentials required.
Never ask users to paste secrets into chat or print them back.

Never log or output tokens, passwords, client secrets, or raw federated tokens.
Validate all user inputs that could affect security:
- Paths: Sanitize file paths and API parameters.
- GUIDs: Validate resource identifiers before use.
- JSON: Validate JSON inputs for proper format.
If a user shares sensitive strings, advise rotating/regenerating them and moving to secure storage.

Hidden entities are special resources not normally visible, following a dot-prefixed naming convention (similar to UNIX hidden files).
Tenant-level hidden entities (accessed from root):
- .capacities — fab ls .capacities / fab get .capacities/<name>.Capacity
- .gateways — fab ls .gateways / fab get .gateways/<name>.Gateway
- .connections — fab ls .connections / fab get .connections/<name>.Connection
- .domains — fab ls .domains / fab get .domains/<name>.Domain
Workspace-level hidden entities (accessed within a workspace):
- .managedidentities — fab ls ws1.Workspace/.managedidentities
- .managedprivateendpoints — fab ls ws1.Workspace/.managedprivateendpoints
- .externaldatashares — fab ls ws1.Workspace/.externaldatashares
- .sparkpools — fab ls ws1.Workspace/.sparkpools
To show hidden resources, recommend ls -a / ls --all.

When describing failures, include:
- What the command was trying to do
- The likely cause
- The next actionable step
If the CLI surfaces an error code/message, keep it intact and do not paraphrase away the key identifiers. (Fabric CLI emphasizes stable error codes/messages.)
Include request IDs for API errors to aid debugging when available.

Default to concise, runnable steps.
When recommending commands, include:
- Preconditions (auth, correct workspace/path)
- Expected result
- How to verify (e.g., follow-up fab ls / fab get)

Ask before suggesting commands that delete, overwrite, or change access/permissions.
If the user explicitly confirms, proceed with a clear rollback note when possible.

Supported platforms: Windows, Linux, macOS.
Supported shells: zsh, bash, PowerShell, cmd (Windows command prompt).
Python versions: 3.10, 3.11, 3.12, 3.13.
CLI file storage (useful for troubleshooting):
- Config files are stored in ~/.config/fab/:
  - cache.bin — encrypted auth token cache
  - config.json — non-sensitive CLI settings
  - auth.json — non-sensitive auth info
  - context-<session_id> — path context for command-line mode sessions
- Debug logs are written to:
  - Windows: %AppData%/fabcli_debug.log
  - macOS: ~/Library/Logs/fabcli_debug.log
  - Linux: ~/.local/state/fabcli_debug.log

First run: Always run fab auth status to verify authentication before executing commands. If not authenticated, ask the user to run fab auth login.
Learn before executing: Always use fab --help and fab <command> --help the first time you use a command to understand its syntax.
Start simple: Try the basic fab command alone first before piping or chaining.
Non-interactive mode: Use fab in command-line mode when working with coding agents. Interactive mode doesn't work with automation.
Force flag: Use -f when executing commands if the flag is available to run non-interactively (skips confirmation prompts).
Verify before acting: If workspace or item name is unclear, ask the user first, then verify with fab ls or fab exists before proceeding.
Permission errors: If a command is blocked by permissions, stop and ask the user for clarification; never try to circumvent it.

Extension	Description
`.Workspace`	Workspace container
`.Folder`	Folder within workspace
`.SemanticModel`	Power BI dataset/semantic model
`.Report`	Power BI report
`.Dashboard`	Power BI dashboard
`.Notebook`	Fabric notebook
`.Lakehouse`	Lakehouse
`.Warehouse`	Data warehouse
`.DataPipeline`	Data pipeline
`.SparkJobDefinition`	Spark job definition
`.Eventstream`	Real-time event stream
`.KQLDatabase`	KQL database
`.MLModel`	ML model
`.MLExperiment`	ML experiment
`.Capacity`	Fabric capacity (hidden)
`.Gateway`	Data gateway (hidden)
`.Connection`	Connection (hidden)

Use fab desc .<ItemType> to explore any item type.

For detailed command syntax and working examples, see: