Before you start

Team workspace setup creates real GitHub, Microsoft Entra ID, and Microsoft Fabric resources. Check these requirements before you start.

GitHub CLI on github.com

Fabricator uses the GitHub CLI, gh, for team repositories. Team workspaces use github.com only.

You need to be signed in with these classic OAuth scopes:

• repo
• read:org
• workflow

When the scopes are missing, Fabricator shows Grant GitHub access and opens a terminal that runs gh auth refresh --hostname github.com --scopes repo,read:org,workflow. If you are not signed in, Sign in to GitHub runs gh auth login --web --git-protocol https --hostname github.com --scopes repo,read:org,workflow.

Abandoning an unfinished setup also needs the delete_repo scope to delete the workspace's repository. Fabricator asks for it only then, with the same Grant GitHub access button. See Abandon an unfinished setup.

In organizations that use SAML single sign-on, GitHub lets the GitHub CLI into the organization only when you sign it in during a single sign-on session. When that's missing, Fabricator shows Open single sign-on and Sign in to GitHub again. See GitHub says the organization requires single sign-on.

More than one GitHub account

The GitHub CLI can be signed in to several GitHub accounts, for example a personal account and a work account. When you create or join a team workspace, choose the GitHub account to use. Fabricator remembers it and always uses that account for the workspace, whichever account the GitHub CLI has active. Workspaces under different accounts work side by side.

• To add an account, select Add account next to GitHub account. Fabricator opens a terminal that runs gh auth login, then makes the account that was active before active again.
• If the chosen account is missing scopes, Grant GitHub access refreshes that account's sign-in, then makes the previously active account active again.
• To change the account an existing workspace uses, see Change the GitHub account.

Azure CLI sign-in for Microsoft Entra ID

Fabricator checks the Azure CLI sign-in before setup. You need an account in the tenant where the Fabric workspaces will live.

To create the deploy identities yourself, your account must be allowed to create and update app registrations and service principals. That is commonly allowed for tenant users, but some organizations turn it off. If it is off, you need the Application Developer role or an administrator-provided app registration.

Fabric capacity and tenant setting

You need access to an active Fabric or Premium capacity. Fabricator lists capacities it can use and creates the workspace on the one you choose.

A Fabric administrator may also need to allow service principal API access. Fabricator's admin instructions use this exact setting name: Service principals can call Fabric public APIs.

Rayfin version in each app

Team workspace deploys need Rayfin 1.36.2 or newer because the pipeline deploys apps by item name. New apps start with a supported version. For older apps, open the app, select Rayfin in the status bar, and choose Update with Copilot before moving it.

GitHub plan

GitHub Free private repositories do not support branch protection. Fabricator still follows the publish flow in the app, but GitHub cannot enforce it for direct pushes to main. See Team workspace limitations.

GitHub Actions runners

The workspace's pipeline runs on GitHub-hosted runners by default. If your GitHub organization turned those off, ask an organization owner which runner group or runner labels Actions jobs should use, and choose them when you create the workspace. See Choose where the pipeline runs.

Where the repository can live

The workspace's apps live in one private GitHub repository. Setup can create a new one under the GitHub owner you choose, if you're allowed to create repositories there. It can also use a repository that already exists, with you in the Maintain or Admin role. Many organizations don't let their members create repositories. Then an owner of the organization can create an empty private repository for you. See Use an existing repository.

Some companies' Microsoft Entra ID only accepts pipeline sign-ins from repositories owned by organizations in their GitHub enterprise. Microsoft's own tenant works this way. In such a tenant, choose one of those organizations, not your personal account. A personal account's repository fails setup's last step with AADSTS7002381. See The pipeline's sign-in fails with AADSTS7002381.