🔑 Authentication Failure Playbook¶

# Acquire and decode token via Azure CLI (dev only - never run in prod terminals)
az account get-access-token --resource https://api.fabric.microsoft.com \
  --query accessToken -o tsv \
  | cut -d. -f2 | base64 -d 2>/dev/null | jq .

# Resolve the workspace identity principalId from Bicep outputs
PRINCIPAL_ID=$(az identity show \
  --name "id-fabric-ws-fabricpoc-prod" \
  --resource-group "rg-fabric-prod" \
  --query principalId -o tsv)

# List all role assignments for this identity
az role assignment list \
  --assignee "$PRINCIPAL_ID" \
  --all \
  --output table

# Verify expected scopes per workspace-identity.bicep:
#   - Key Vault Secrets User (4633458b-17de-408a-b874-0445c86b69e6)
#   - Storage Blob Data Contributor (ba92f5b4-2d11-453d-a403-e96b0029c9fe)
#   - Purview Data Curator (af8bf84c-4de3-462a-b576-41e6c7478f52) [optional]

# List enabled CA policies
az rest --method get \
  --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies" \
  --query "value[?state=='enabled'].{name:displayName, id:id}" -o table

# Inspect a specific policy
az rest --method get \
  --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/${POLICY_ID}"

# Find CA-blocked sign-ins
az rest --method get \
  --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=conditionalAccessStatus eq 'failure'&\$top=20"

# Resolve current public egress IP
CURRENT_IP=$(curl -s https://api.ipify.org)
echo "Current public IP: $CURRENT_IP"

# List workspace firewall rules
az rest --method get \
  --url "https://api.fabric.microsoft.com/v1/workspaces/${WS_ID}/firewallRules" \
  --query "value[].{name:name, start:startIpAddress, end:endIpAddress}" \
  --output table

# Test reachability (should resolve and accept TLS)
nslookup api.fabric.microsoft.com

# 1. Create new SP secret (use --append to retain old secret during rollout)
NEW_SECRET=$(az ad app credential reset --id "${SPN_CLIENT_ID}" --append \
  --years 1 --display-name "rotated-$(date +%Y%m%d)" --query password -o tsv)

# 2. Push to Key Vault (Key Vault retains version history)
az keyvault secret set --vault-name "kv-fabric-prod" \
  --name "fabric-spn-client-secret" --value "$NEW_SECRET"

# 3. Restart cached consumers (Function/Logic apps), then re-trigger failed run
az functionapp restart --name "func-fabric-orchestrator" --resource-group "rg-fabric-prod"
gh workflow run deploy-fabric.yml

# Direct grants matching workspace-identity.bicep role IDs
az role assignment create --assignee "$PRINCIPAL_ID" --role "Key Vault Secrets User" \
  --scope "/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.KeyVault/vaults/${KV_NAME}"

az role assignment create --assignee "$PRINCIPAL_ID" --role "Storage Blob Data Contributor" \
  --scope "/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.Storage/storageAccounts/${STG_NAME}"

# Or re-deploy Bicep idempotently
az deployment group create --resource-group "$RG" \
  --template-file infra/modules/security/workspace-identity.bicep \
  --parameters projectPrefix=fabricpoc environment=prod \
      keyVaultId="/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.KeyVault/vaults/${KV_NAME}" \
      storageAccountId="/subscriptions/${SUB}/resourceGroups/${RG}/providers/Microsoft.Storage/storageAccounts/${STG_NAME}"

# Client credentials flow (SP)
curl -X POST "https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token" \
  -d "client_id=${CLIENT_ID}" -d "client_secret=${CLIENT_SECRET}" \
  -d "scope=https://api.fabric.microsoft.com/.default" -d "grant_type=client_credentials"

# Refresh token flow (delegated user)
curl -X POST "https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token" \
  -d "client_id=${CLIENT_ID}" -d "refresh_token=${REFRESH_TOKEN}" \
  -d "grant_type=refresh_token" -d "scope=https://api.fabric.microsoft.com/.default"

# Add an exclusion for the impacted SP/group (preferred over disabling policy)
az rest --method patch \
  --url "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/${POLICY_ID}" \
  --body '{
    "conditions": {
      "users": {
        "excludeServicePrincipals": ["'"${SPN_OBJECT_ID}"'"]
      }
    }
  }'

# Add allowed IP range to the workspace
az rest --method post \
  --url "https://api.fabric.microsoft.com/v1/workspaces/${WS_ID}/firewallRules" \
  --body '{
    "name": "GHA-runner-egress-2026-04-27",
    "startIpAddress": "20.42.0.0",
    "endIpAddress": "20.42.0.255"
  }'

# Re-invite the guest user (idempotent - re-issues invitation if accepted state lost)
az rest --method post \
  --url "https://graph.microsoft.com/v1.0/invitations" \
  --body '{
    "invitedUserEmailAddress": "auditor@partner-tenant.com",
    "inviteRedirectUrl": "https://app.fabric.microsoft.com",
    "sendInvitationMessage": true
  }'

# Add to the appropriate Fabric security group
az ad group member add \
  --group "sg-fabric-casino-prod-viewers" \
  --member-id "${GUEST_OBJECT_ID}"

# Verify cross-tenant access policy allows inbound from partner tenant
az rest --method get \
  --url "https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/partners/${PARTNER_TENANT_ID}"

TOKEN=$(curl -s -X POST "https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token" \
  -d "client_id=${CLIENT_ID}" -d "client_secret=${NEW_SECRET}" \
  -d "scope=https://api.fabric.microsoft.com/.default" -d "grant_type=client_credentials" \
  | jq -r .access_token)

curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  -H "Authorization: Bearer $TOKEN" \
  "https://api.fabric.microsoft.com/v1/workspaces/${WS_ID}"

az rest --method post \
  --url "https://api.fabric.microsoft.com/v1/workspaces/${WS_ID}/items/${PIPELINE_ID}/jobs/instances?jobType=Pipeline"

# Create app registration + SP
APP=$(az ad app create --display-name "spn-fabric-cicd-prod" --query appId -o tsv)
az ad sp create --id "$APP"

# Add 1-year secret (capture immediately — shown only once)
SECRET=$(az ad app credential reset --id "$APP" --years 1 --query password -o tsv)

# Store in Key Vault
az keyvault secret set --vault-name "kv-fabric-prod" --name "fabric-spn-cicd-secret" --value "$SECRET"

# Grant Fabric workspace Contributor role (via Fabric REST)
PRINCIPAL_ID=$(az ad sp show --id "$APP" --query id -o tsv)
az rest --method post \
  --url "https://api.fabric.microsoft.com/v1/workspaces/${WS_ID}/roleAssignments" \
  --body "{\"principal\":{\"id\":\"${PRINCIPAL_ID}\",\"type\":\"ServicePrincipal\"},\"role\":\"Contributor\"}"

TOKEN=$(az account get-access-token --resource https://api.fabric.microsoft.com --query accessToken -o tsv)

curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.fabric.microsoft.com/v1/workspaces/${WS_ID}" | jq .