What Are Fabric Apps?

Fabric Apps is a new development platform within Microsoft Fabric that lets you build complete data-driven applications without managing infrastructure. You define data models in TypeScript, and Fabric generates the database, GraphQL APIs, authentication, and static hosting automatically.

The Rayfin toolchain (@microsoft/rayfin-cli, @microsoft/rayfin-client, @microsoft/rayfin-mcp) is currently at v1.34.0. Everything below is still Preview — there is no GA milestone published for Fabric Apps.

Anonymous Data Access

The Data App Template

Alongside the default template there is now a purpose-built data app starter, scaffolded with:

npx @microsoft/rayfin-cli init my-data-app --template dataapp

Rather than starting from an empty CRUD backend, this template connects to an existing Power BI semantic model and queries it with DAX through the Execute DAX Queries API. It ships with built-in visuals and a data grid, so the common "put a real UI on top of a model my BI team already built" scenario no longer requires you to hand-roll the query layer.

It also includes Playwright-based validation out of the box, which matters more than it sounds: it gives you a repeatable way to prove the app still works after a schema or model change.

Agent & AI Tooling

Fabric Apps now ships first-class support for AI coding agents, which is a meaningful shift in how these apps are expected to be built:

Custom Templates & Registries

You can now author your own templates and publish them to a registry, rather than being limited to Microsoft's starters. For any organisation standing up more than a handful of Fabric Apps this is the difference between every team inventing its own structure and a single golden-path template that bakes in your auth roles, naming, and CI wiring.

Microsoft also maintains microsoft/awesome-rayfin, a community gallery of example apps worth reading before you design your own.

CI/CD with GitHub Actions

There is now documented guidance for deploying Fabric Apps from GitHub Actions. This is the practical workaround for the ALM gap: because App items aren't covered by Fabric Git integration or Fabric deployment pipelines (see Limitations), your pipeline runs the Rayfin CLI against a target workspace instead of using Fabric's native promotion.

Deployment Flow

When you run rayfin up, Fabric creates a managed app service with child items:

App Backend URL

Each Fabric app gets a single endpoint exposing all services:

https://<your-app>-app.rayfin.windows.net/

/api/graphql  → Data API (GraphQL) — queries & mutations via RayfinClient
/auth         → Authentication service
/storage      → File storage

What Fabric Manages For You

• Infrastructure: Compute, networking, scaling, and hosting
• Database: Schema creation, migrations, and query endpoints
• Security: Entra ID SSO, HTTPS, PKCE, session tokens
• APIs: GraphQL generated from your TypeScript models
• Storage: Static assets + file storage in OneLake

What Is Rayfin?

Rayfin is an open-source Backend-as-a-Service (BaaS) SDK and CLI for Microsoft Fabric — think Supabase or Firebase, but with enterprise governance, Entra ID auth, and OneLake integration baked in.

Getting Started

# Scaffold a new Rayfin project
npm create @microsoft/rayfin@latest my-app --workspace my-fabric-workspace

# Navigate to the project
cd my-app

# Develop locally (Docker required)
npm run dev

# Deploy to Fabric (provisions DB, auth, APIs, and static hosting)
npx rayfin up

Data Model Decorators

Define your app's data schema with TypeScript decorators. Fabric generates the database tables, GraphQL endpoints, and authorization rules automatically:

import {
  entity, role, text, boolean, date, uuid
} from '@microsoft/rayfin-core';

@entity()
@role('authenticated', '*', {
  policy: (claims, item) => claims.sub.eq(item.user_id),
})
export class Todo {
  @uuid() id!: string;
  @text({ min: 1, max: 100 }) title!: string;
  @boolean() isCompleted!: boolean;
  @date() createdAt!: Date;
  @date({ optional: true }) dueDate?: Date;
  @text() user_id!: string;
}

Supported Frontend Approaches

Connecting Frontend to Backend

Use the type-safe RayfinClient to query your GraphQL APIs from the frontend:

import { RayfinClient } from '@microsoft/rayfin-client';

const client = new RayfinClient({
  endpoint: 'https://my-app-app.rayfin.windows.net'
});

// Fluent, type-safe query — catches errors at compile time
const page = await client.todo
  .select('id', 'title', 'isCompleted')
  .where({ isCompleted: false })
  .orderBy('createdAt', 'DESC')
  .first(25)
  .executePaginated();

const todos = page.items;

// Single record by primary key
const one = await client.todo.findByPk(id);

// Mutations
await client.todo.create({ title: 'Write docs', isCompleted: false });
await client.todo.update(id, { isCompleted: true });
await client.todo.delete(id);

Project Structure

my-app/
├── rayfin/
│   ├── data/
│   │   └── models.ts        # Data models with decorators
│   └── rayfin.yml            # App configuration
├── app/                      # Your frontend (HTML, React, etc.)
│   ├── index.html
│   ├── styles.css
│   └── main.ts
├── package.json
└── tsconfig.json

Authentication Model

• Deployed apps: Microsoft Entra ID (Fabric SSO) — users sign in with their existing Fabric identity
• Local development: Email/password authentication for testing
• No external providers: Only Entra ID is supported after deployment

Authorization — Row-Level Security

Use the @role decorator to define fine-grained access policies directly in your data models:

@entity()
@role('authenticated', '*', {
  // Users can only access their own records
  policy: (claims, item) => claims.sub.eq(item.user_id),
})
@role('admin', '*')  // Admins can access everything
export class Document {
  @uuid() id!: string;
  @text() title!: string;
  @text() user_id!: string;
}

Item Permissions in Fabric Portal

Your Security Responsibilities

✅ Ideal Scenarios

⚠️ When to Choose Alternatives

Development Workflow

• Local-first: Use npm run dev with Docker for rapid iteration before deploying
• Schema as code: Never modify the SQL database schema directly in the portal — always use TypeScript decorators and rayfin up
• Version control: Store your rayfin/ folder and frontend in Git. Treat rayfin.yml as your infrastructure definition
• Environment separation: Use separate Fabric workspaces for Dev/Test/Prod, and switch between them with rayfin up switch. There is no built-in multi-environment concept — you manage it yourself

Security Best Practices

• Least privilege: Define @role policies that restrict access to owned records by default
• No secrets in frontend: Static content is public — never embed API keys or connection strings
• Audit access: Review workspace permissions and app sharing regularly
• Use workspace isolation: Separate production apps into dedicated workspaces with restricted contributor lists

Performance & Cost

• Capacity awareness: Fabric Apps consume CUs from your workspace capacity — monitor usage via the Capacity Metrics app. The SQL database bills at 1 Fabric CU = 0.383 SQL vCores, and GraphQL API usage bills at 10 CUs per hour of request and response processing. App hosting, authentication, and deployment operations themselves are not separately billed
• Efficient queries: Use GraphQL field selection to fetch only what you need — avoid over-fetching
• Cache static assets: Leverage browser caching for frontend assets; Fabric serves them from OneLake
• Minimize deployments: Batch schema changes rather than deploying per-change to reduce overhead

Integration with Fabric Ecosystem

• Analytics: The app's SQL database is OneLake-integrated. The launch blog describes app data landing in OneLake for the wider stack, but the docs stop at storage integration — validate the notebook/Spark path before designing on it
• Power BI: Build Direct Lake semantic models on top of your app's SQL database for instant reporting
• AI Agents: Use Fabric Data Agents to query and act on app data programmatically
• Governance: App items live in a workspace and inherit its permission model and sharing controls. Endorsement, lineage, and Purview coverage for App items are not documented — verify before relying on them

Fabric Apps is a Preview product, and its constraints are real enough to disqualify certain designs outright. Read this list as a go/no-go gate, not as a backlog of things that will be fixed by the time you ship.

Data Modelling

Platform & Operations

Prerequisites

Enable Fabric Apps (Admin)

1. Sign in to the Fabric admin portal
2. Navigate to Tenant settings
3. Under Fabric Apps (preview), toggle to Enabled
4. Choose to enable for the entire organization or specific security groups
5. Select Apply (changes may take a few minutes to propagate)

Your First App in 3 Commands

# 1. Scaffold a new project (interactive wizard)
npm create @microsoft/rayfin@latest my-app --workspace my-fabric-workspace

# 2. Navigate and explore the generated project
cd my-app

# 3. Deploy to Fabric — provisions everything
npx rayfin up