> ## Documentation Index
> Fetch the complete documentation index at: https://docs.less.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# How to create Entra Service Principal

Use this when setting up a [Microsoft SQL Server source](/sources/guides/mssql) or [destination](/destinations/guides/mssql) with **Microsoft Entra service principal** authentication — required for **Microsoft Fabric SQL Database** and other endpoints that do not accept SQL logins.

<Steps>
  <Step title="Register an app">
    In the [Microsoft Entra admin center](https://entra.microsoft.com/), go to **App registrations** → **New registration**.

    Give the app a name (for example `Less connector`), leave **Redirect URI** empty, and select **Register**.

    Copy the **Application (client) ID** — you will use this as **Client ID** in Less.
  </Step>

  <Step title="Create a client secret">
    Open the app → **Certificates & secrets** → **New client secret**.

    Add a description, choose an expiry, and select **Add**.

    Copy the secret **Value** right away (it is only shown once). This is **Client secret** in Less.
  </Step>

  <Step title="Grant access in Fabric">
    In [Microsoft Fabric](https://app.fabric.microsoft.com/), open the workspace that contains your SQL database.

    On the database item, open **Manage access** (or use workspace **Access**) and add your app registration.

    * **Sources** — the app needs permission to **read** the database.
    * **Destinations** — the app needs permission to **create and write** tables in the database.

    A workspace role such as **Contributor** is usually enough; your admin may use item-level permissions instead.
  </Step>

  <Step title="Connect in Less">
    In the MSSQL wizard:

    1. **Account** — host, port (usually **1433**), and database name (from the database **Connection strings** in Fabric).
    2. **Credentials** — choose **Microsoft Entra service principal**, then paste the **Client ID** and **Client secret** from steps 1–2.
    3. **Test connection** (destination) or **Connect** on the Tables step (source).

    Whitelist [Less IP addresses](/guides/less-ip) if your database uses a firewall.
  </Step>
</Steps>

## Troubleshooting

**Login timeout expired**

* Confirm the client secret has not expired.
* Check that the app was added to the correct Fabric workspace and database.
* Ensure a Fabric admin has enabled **Service principals can use Fabric APIs** under [Tenant settings](https://app.fabric.microsoft.com/admin-portal) → **Developer settings**.
* Whitelist [Less IP addresses](/guides/less-ip) on your database firewall.

**Authentication or permission errors**

* **Sources** need read access to the database; **destinations** need write access (create/insert tables).
* Re-open **Manage access** on the SQL database item and confirm the app registration is listed.

**Azure SQL (not Fabric)**

If you use Azure SQL with Entra-only auth (not Fabric), a DBA may also need to create a database user for the app:

```sql theme={null}
CREATE USER [Less connector] FROM EXTERNAL PROVIDER;
```

Grant `db_datareader` for sources and `db_datawriter` (or `db_owner`) for destinations.

**Finding host and database name**

In Fabric, open the SQL database → **Settings** → **Connection strings**. Use the **Server** value as **Host** and **Database** as **Database** in Less.

**Further reading**

* [Authentication in Fabric SQL Database](https://learn.microsoft.com/en-us/fabric/database/sql/authentication)
* [Connect to your SQL database in Fabric](https://learn.microsoft.com/en-us/fabric/database/sql/connect)