Automate Fabric and Power BI Admin with Claude Code

A week of Fabric and Power BI admin work is a lot of clicking through the portal: workspace settings, then Manage access, then the Refresh history panel, then over to the pipeline monitor. The Fabric CLI turns those trips into commands you type in a terminal.

The Fabric CLI, fab, is Microsoft’s command-line tool for Fabric and Power BI. A CLI (command-line interface) is a program you drive by typing commands instead of clicking, and fab is built on Fabric’s public REST APIs. This guide follows one workspace, Sales Performance Demo, through four chores: look around, copy a report to a second workspace called Sales Demo 2, check who has access, and read a semantic model’s refresh history. Every command is here as text you can copy, and the download is a one-page command sheet.

0:00Who the Fabric CLI is for

If you’re a tenant or workspace admin, work in a support role, or look after a lot of Data Factory pipelines and notebook jobs, this tool is going to be a big help 0:05. It’s also a natural tool for AI agents that build Power BI and Fabric content 0:22, because an agent can run the same commands you type. The last section covers that.

0:32Install and log in

The CLI is a Python package. It needs Python 3.10, 3.11, 3.12 or 3.13, with python on your PATH, so check your version first:

python --version

Then install the CLI and confirm it runs:

pip install ms-fabric-cli
fab --version

pip install --upgrade ms-fabric-cli updates it later. This guide uses version 1.7.0, released August 18, 2026.

How the install goes depends on your machine and the security profile your company puts on it 0:41. Try the command. If you get an error, paste it into your chatbot, and you may need your IT team to unlock installs on your machine. The Fabric CLI is a Microsoft product, created and supported by Microsoft, so hopefully your company will allow it 1:09.

Sign in as yourself, or as a service principal

Run fab auth login, and the CLI asks how you want to authenticate:

fab auth login offers five ways to sign in. Interactive with a web browser signs you in as yourself.

I sign in with Interactive with a web browser. Pick it, click your account in the browser tab that opens, and the page tells you to close the tab and return to the terminal 1:37. fab auth status shows who you’re signed in as, and fab auth logout signs you out.

Interactive sign-in suits short, hands-on work, where the CLI should act with your own permissions. A service principal, an identity for an app instead of a person, suits headless work: CI/CD pipelines, and automated jobs such as pipelines or notebooks. Deploying to Production is another case for one: the Fabric CLI signs in as the service principal, in a pipeline or run by hand, and deploys the code, so no person needs access to the Production environment.

The service principal options sign in with flags instead of the menu:

# With a client secret
fab auth login -u <client-id> -p <client-secret> --tenant <tenant-id>

# With a federated credential, as in a CI/CD pipeline
fab auth login -u <client-id> --federated-token <token> --tenant <tenant-id>

The certificate and managed identity versions are in the CLI’s auth examples.

2:23Look around

Type fab with nothing after it, and the CLI opens its own prompt:

Welcome to the Fabric CLI ⚡
Type 'help' for help.

fab:/$

At this prompt you type commands without fab in front, and quit or exit leaves. From your normal shell the same commands run one at a time with fab in front, so ls at the prompt is fab ls in the shell 2:08. The prompt is a little easier while you work, since you don’t type fab every time 2:17. Scripts and agents use the one-at-a-time form. The CLI picks the mode from how you call it, so you can ignore the line in its help text about fab config set mode interactive.

The mental model is a file system 2:22. Your tenant is the root folder, /, and from there everything is folders and the items inside them:

Workspaces are folders, and an item’s suffix is its type.

At the root, ls (short for list) lists every workspace you have access to 3:05. cd (change directory) moves into one; put quotes around any name with spaces. ls again lists the items inside, and open opens an item in your browser 4:01:

fab:/$ cd 'Sales Performance Demo.Workspace'

* Switched to 'Sales Performance Demo.Workspace'

fab:/Sales Performance Demo.Workspace$ ls
Sales.SemanticModel
Sales Performance.Report
Sales Performance.SemanticModel
SalesExecutiveSummary.Report
SalesExecutiveSummary.SemanticModel
fab:/Sales Performance Demo.Workspace$ open 'Sales Performance.Report'
Opening 'Sales Performance.Report' in the web browser...

* https://app.powerbi.com/groups/<workspace-id>/reports/<report-id>/?experience=fabric-developer

When you forget a command, help lists them all with some guidance on each 3:22, and fab <command> --help shows one command’s flags. pwd prints where you are.

To find an item without knowing its workspace, fab find searches the OneLake catalog across all your workspaces, matching names, descriptions and workspace names. -P type= narrows it to one item type, and -l adds the IDs:

fab find 'sales' -P type=Report -l

4:17Copy a report

cp takes two parameters: the item to copy, then where it goes 4:24. .. means go up one level, so '../Sales Demo 2.Workspace' is the workspace next door 4:38:

fab:/Sales Performance Demo.Workspace$ cp 'Sales Performance.Report' '../Sales Demo 2.Workspace'
? Item definition is copied without its sensitivity label. Are you sure? Yes
Copying '/Sales Performance Demo.Workspace/Sales Performance.Report' → '/Sales Demo 2.Workspace'...

* Copy completed

fab:/Sales Performance Demo.Workspace$ cd '../Sales Demo 2.Workspace'

* Switched to 'Sales Demo 2.Workspace'

fab:/Sales Demo 2.Workspace$ ls
Sales Performance.Report

Read the question before you answer it. The copy doesn’t carry the report’s sensitivity label, so if your organization uses labels, apply it again on the copy. -f copies without asking.

Sales Demo 2 now holds only the report. The copy uses the same semantic model as the original report, back in Sales Performance Demo. To point it at a different model, rebind it with fab set. This report is in PBIR definition version 2, which names its model in a connection string, so you set the whole string with the new model’s workspace, name and ID:

fab set 'Sales Demo 2.Workspace/Sales Performance.Report' -q 'definition.parts[0].payload.datasetReference.byConnection.connectionString' -i 'Data Source="powerbi://api.powerbi.com/v1.0/myorg/<workspace>";initial catalog=<model>;integrated security=ClaimsToken;semanticmodelid=<model-id>'

Keep the single quotes around the -q path: without them, zsh (the default shell on a Mac) reads the square brackets as a file pattern. To see the current string first, run fab get on the report with the same -q path and -f. Type connectionString with a lowercase c: the CLI’s item examples capitalize it, and the service rejects that. A report in PBIR definition version 1 takes the shorter -q semanticModelId -i <model-id>.

Copying into the same workspace adds _copy to the name. -r copies a folder with its subfolders, skipping any items that don’t support copying. A whole workspace copies only at the fab:/$ prompt, where the CLI asks which items to take; from your shell, version 1.7.0 refuses it. To move content between environments, export writes an item’s definition to disk, import brings it back, and fab deploy runs a fabric-cicd deployment from a config file.

5:20Who has access

acl stands for access control list: who has access to a workspace or an item 5:26. Type acl on its own to list its subcommands: ls, get, set and rm.

acl ls lists the access for a path. ./ means the folder you’re in, so in Sales Demo 2 this lists everyone with access to that workspace 5:44:

fab:/Sales Demo 2.Workspace$ acl ls ./
acl     identity           type
-------------------------------------
Admin   <your sign-in>     User

Here is the whole session so far, from the first cd to the access list:

The running example in one session: look around, open the report, copy it, then check who has access to the copy’s workspace.

acl set adds people to a workspace’s access list 6:04, and acl rm removes them 6:22. Both take the identity’s Microsoft Entra object ID, and set takes a role: admin, member, contributor or viewer:

fab acl set 'Sales Demo 2.Workspace' -I <object-id> -R viewer
fab acl rm 'Sales Demo 2.Workspace' -I <object-id>

Both ask you to confirm, and -f skips that. Know the limits before you script them. acl set and acl rm work on workspaces, gateways and connections, so they can’t grant access to a single report or model. acl ls and acl get can read an item’s access, but only with the tenant-level Fabric Administrator role, and the CLI’s help marks the whole acl command [admin]. In version 1.7.0 they read Fabric items such as a pipeline or a lakehouse, but a report returns NotFound and a semantic model isn’t supported. For those, call the admin API with the item’s type:

fab api 'admin/workspaces/<workspace-id>/items/<report-id>/users?type=Report'

type=SemanticModel does the same for a model, and it needs the same Fabric Administrator role.

6:31Jobs and refresh history

fab job manages runs of notebooks, data pipelines, Spark job definitions and lakehouse table maintenance. If you look after Data Factory pipelines, notebooks or PySpark jobs, it lists their runs, shows how each one is doing, and cancels the ones that are hung up 6:42:

fab job run-list 'ws1.Workspace/pipeline1.DataPipeline'
fab job run-status 'ws1.Workspace/pipeline1.DataPipeline' --id <job-id>
fab job run-cancel 'ws1.Workspace/pipeline1.DataPipeline' --id <job-id>

job start kicks off a run and returns, job run waits for it to finish, and job run-sch schedules one. With a lot of jobs feeding OneLake, these commands monitor them, find the ones that hung, and start new runs from a script 6:57. You can even have an agent read the results and decide whether to restart a job that failed 7:11.

Semantic model refreshes go through fab api

Semantic models aren’t a fab job type, so their refreshes have no built-in command 7:19. The way in is fab api, which makes an authenticated call to a REST endpoint. -A powerbi points it at the Power BI REST API, where refresh history is the Get Refresh History In Group endpoint: groups/<workspace-id>/datasets/<model-id>/refreshes.

Get the two IDs first. The workspace ID is the GUID after /groups/ in the URL that open printed, or fab get returns each one:

fab get 'Sales Performance Demo.Workspace' -q id
fab get 'Sales Performance Demo.Workspace/Sales Performance.SemanticModel' -q id

Then call the endpoint:

fab api -A powerbi 'groups/<workspace-id>/datasets/<model-id>/refreshes?$top=5'

The single quotes stop your shell from reading $top as a variable. The call returns the same history you see in the portal when you select the model’s ellipsis (…) and choose Refresh history 8:26. Without $top you get up to the last 60 entries. You need Write permission on the semantic model, and OneDrive refresh history isn’t returned.

Each entry is one refresh: how it was triggered (refreshType, such as Scheduled, OnDemand or ViaApi), startTime, endTime, and status, which is Completed, Failed, Disabled, or Unknown while the refresh is still running. A failed refresh carries its error code in serviceExceptionJson. This is Microsoft Learn’s example of a failed refresh:

{
  "value": [
    {
      "refreshType": "ViaApi",
      "startTime": "2017-06-13T09:25:43.153Z",
      "endTime": "2017-06-13T09:31:43.153Z",
      "serviceExceptionJson": "{\"errorCode\":\"ModelRefreshFailed_CredentialsNotSpecified\"}",
      "status": "Failed",
      "requestId": "11bf290a-346b-48b7-8973-c5df149337ff",
      "refreshAttempts": [
        {
          "attemptId": 1,
          "startTime": "2017-06-13T09:25:43.153Z",
          "endTime": "2017-06-13T09:31:43.153Z",
          "serviceExceptionJson": "{\"errorCode\":\"ModelRefreshFailed_CredentialsNotSpecified\"}",
          "type": "Data"
        }
      ]
    }
  ]
}

fab api wraps what the API returns: the HTTP status goes in status_code, and the body, like the example above, goes in text. To keep only what you need, add a JMESPath query with -q, starting from text:

fab api -A powerbi 'groups/<workspace-id>/datasets/<model-id>/refreshes?$top=5' -q "text.value[].{status: status, start: startTime, error: serviceExceptionJson}"

The same endpoint with -X post starts a refresh, and the CLI’s refresh guide shows how to poll it until it finishes:

fab api -A powerbi -X post 'groups/<workspace-id>/datasets/<model-id>/refreshes'

Why fab api is easier than calling the API yourself

You’ve been able to call these APIs for a long time, but by hand it’s frustrating 7:34. You authenticate, get a bearer token and store it, pass it in the headers of every call, and form a JSON body 7:39. fab api handles that part for you 7:53. -A picks the API: fabric (the default), powerbi, storage or azure.

There’s a second reason to go through the CLI 8:45. Your AI agent can work with either the raw API or the CLI, but it’s much more effective and token-efficient with a CLI, so you’re likely to get an answer faster and use fewer tokens 9:08.

Which command for which chore

Some chores have built-in commands, and some go through fab api:

Chore	Command	Notes
List the workspaces you can access	fab ls	Run at the root, /
Find an item across workspaces	fab find '<text>' -P type=<type>	Searches the OneLake catalog
Copy an item to another workspace	fab cp <item> <workspace>	Copied without its sensitivity label
See who has access to a workspace	fab acl ls <workspace>	Role, identity and type for each entry
Grant or remove workspace access	fab acl set, fab acl rm	Needs an Entra object ID; workspaces, gateways and connections only
See who has access to a pipeline or lakehouse	fab acl ls <workspace>/<item>	Needs the Fabric Administrator role
See who has access to a report or model	fab api 'admin/workspaces/<workspace-id>/items/<item-id>/users?type=Report'	Fabric Administrator; type=SemanticModel for a model
Check pipeline and notebook runs	fab job run-list <item>	Also Spark job definitions and table maintenance
Read a model’s refresh history	fab api -A powerbi groups/<workspace-id>/datasets/<model-id>/refreshes	Needs Write permission on the model
Refresh a model now	fab api -A powerbi -X post groups/<workspace-id>/datasets/<model-id>/refreshes	Poll it at .../refreshes/<refresh-id>

The download has these commands, and the rest of this guide’s, on one printable page.

9:41Why use the CLI

For one change, such as adding one person to one workspace, the browser is probably faster than the CLI 10:00. I think there are three cases where the Fabric CLI comes in handy 10:11.

Repeated admin and support work. If you’re a tenant or workspace admin, or in a support role, and you do the same things over and over, you can script them 10:15.

Headless runs. Headless means no one is sitting at a terminal 10:42. I don’t mean an AI agent here, but a deterministic pipeline such as CI/CD 10:45. If your Power BI content goes through a deployment pipeline in Azure DevOps, the Fabric CLI can be part of that deployment, or of tests that look at permissions 10:54. The pipeline signs in as a service principal. The CLI’s repository has an Azure Pipelines example and a GitHub Actions workflow, and both sign in with a federated credential instead of a client secret. The workflow’s sign-in step:

fab config set encryption_fallback_enabled true
FED_TOKEN=$(curl -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=api://AzureADTokenExchange" | jq -r '.value')
fab auth login -t $FAB_TENANT_ID -u $FAB_CLIENT_ID --federated-token $FED_TOKEN

Agentic development. The third case is the most interesting one 11:19, and it has its own section.

Hand it to your agent

Your agent is going to love the Fabric CLI 11:28. Agents gravitate toward CLIs: an agent understands a CLI much more easily than an API, let alone a browser, and makes short work of the job 11:31.

The setup is the same as yours. Install the CLI and sign in once, and an agent such as Claude Code runs fab commands in your terminal as you. How To Use Claude Code for Power BI Development installs Claude Code and covers the permission prompts it shows before it runs a command.

Microsoft also writes instructions for agents that use the CLI. The .ai-assets folder in the fabric-cli repository has:

• context/CLAUDE.md, project instructions for Claude Code. Copy it to CLAUDE.md or .claude/CLAUDE.md in your project, and Claude Code loads it when a session starts.
• Two skills. fabric-cli-core covers paths, sign-in, safety rules and item types, and loads first. fabric-cli-powerbi covers semantic models, reports, refresh and DAX, with scripts such as list_refresh_history.py and rebind_report.py. In Claude Code, a skill folder goes in .claude/skills/ in your project, or in ~/.claude/skills/ for every project.

Then give the agent a task in plain English:

Audit every workspace I admin. Who has access, and did any refresh fail in the last 24 hours? Give me a summary.

That task breaks down into the commands in this guide: fab ls for the workspaces, fab acl ls on each one for who has access and where you’re an admin, fab ls inside each workspace for its semantic models, fab get -q id for their IDs, and fab api -A powerbi on each model’s refreshes, filtered to failures in the last day. That’s a sketch of how the work divides, not a recorded run; your agent picks its own route.

You stay in charge. Have the agent report before it changes anything, and read every acl set, acl rm, cp or job start it proposes before you approve it.

Install the CLI, run this guide’s commands against one workspace you own, then hand the chore you repeat most to your agent. To build Power BI content with an agent instead, How To Use Microsoft’s Fabric Skills To Build a Power BI Report takes one paragraph of instructions to a published report.