Dataflows CLI
MicrosoftOfficialPublished by Microsoft
- Skill
- Tool integration
- Automation and integrations
- MIT
- Low risk
- Has scripts
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The dataflows-cli skill provides a structured interface for interacting with Fabric Dataflow Gen2 items. It operates as a mode-based dispatcher, requiring users to select between authoring, consumption, or upgrade modes. The skill handles complex tasks such as M language definition updates, connection management, output destination configuration, and the migration of legacy Gen1 dataflows to Gen2.1. It emphasizes safe, intentional operations by requiring users to read specific reference documentation before executing state-changing API calls.
What it does
- Creates and updates Fabric Dataflow Gen2 items and their definitions.
- Manages connections, credentials, and output destinations for dataflows.
- Previews Power Query M definitions using executeQuery to validate logic before persistence.
- Facilitates the upgrade of Gen1 dataflows to Gen2.1 via save-as operations.
- Retrieves refresh history and inspects existing dataflow definitions.
- Provides a framework for executing and testing ad-hoc M queries.
When to use it
- When you need to programmatically create or modify Fabric Dataflow Gen2 items.
- When performing maintenance on Power Query M definitions or data connections.
- When migrating legacy Gen1 dataflows to the Gen2.1 architecture.
- When you need to audit refresh history or validate dataflow configurations.
- When testing M query logic against live data sources before saving changes.
Advantages
- Enforces a structured, mode-based workflow to prevent accidental mutations.
- Provides granular control over Dataflow Gen2 definitions and metadata.
- Supports complex lifecycle tasks like Gen1-to-Gen2 upgrades.
- Integrates directly with Fabric REST APIs for automated data pipeline management.
Usage examples
- “Show me the refresh history and parameters of the SalesIngest dataflow.”
- The agent enters consumption mode, reads the consumption reference, and retrieves the requested refresh history and parameters for the specified dataflow.
- “Preview this M query, then save it into the SalesIngest dataflow definition.”
- The agent enters authoring mode, previews the M query to validate it, and then executes the updateDefinition call to persist the changes.
- “Is my Gen1 dataflow ready to upgrade to Gen2.1?”
- The agent enters upgrade mode, performs a readiness assessment, and reports on the risk and requirements for upgrading the specified Gen1 dataflow.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/microsoft/dataflows-cli/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip dataflows-cli.zip -d .agents/skills
Documentation by Microsoft
Telemetry — MANDATORY. Every
api.fabric.microsoft.comcall must carryx-ms-fabric-skill: dataflows-cli(az rest:--headers "x-ms-fabric-skill=dataflows-cli"), including every LRO poll,fabric_lroand retry. Snippets omit it — add it anyway.
CRITICAL NOTES
To find the workspace details (including its ID) from workspace name: list all workspaces and, then, use JMESPath filtering
To find the item details (including its ID) from workspace ID, item type, and item name: list all items of that type in that workspace and, then, use JMESPath filtering
Skill disambiguation: use
dataflows-clifor every Fabric Dataflow Gen2 item and Power Query M concern. Synapse / ADF pipeline and dataset JSON translation ispipeline-migration; Spark notebook transformations arespark-cli; T-SQL transformations aresqldw-cli.
Fabric Dataflow Gen2 -- CLI Skill
This one skill owns Fabric Dataflow Gen2 items: connections, Power Query M, output destinations, saved definitions, refresh history, and Gen1 upgrades.
It is a mode dispatcher and contains NO procedures. Pick the mode that matches the request from the table below, then read the matching references/<mode>.md file end to end with your file-reading tool BEFORE issuing a single command. That file holds the endpoints, payload shapes, templates and gotchas; acting without it produces wrong payloads and wrong results.
Read it once per session. A file you have already read stays in context, so do not re-read it on a later turn; open the deeper files under references/<mode>/ only when a row in that file's reference table matches what you still need, and open only that row's file.
Mode selection
| Mode | Use when the request ... | Example triggers | Read this first |
|---|---|---|---|
authoring | creates or changes a dataflow: connections, credentials, M edits previewed before save, output destinations, updateDefinition | executeQuery preview, updateDefinition, connection setup, supportedConnectionTypes, credentialType, add output destination | references/authoring.md |
consumption | reads a saved dataflow: definition, parameters, refresh history, or runs a saved/ad-hoc read-only M query and parses Arrow | getDefinition, executeQuery saved query, ad-hoc query, Arrow IPC, refresh history | references/consumption.md |
upgrade | upgrades a Gen1 dataflow to Gen2.1 via save-as and rebind, or assesses upgrade readiness/risk | Gen1 Gen2 readiness, saveAsNativeArtifact, clone Gen1 dataflow, upgrade risk assessment | references/upgrade.md |
Mode boundary rule
consumption is read-only. A preview run that exists to validate M before updateDefinition, and any capability lookup (supportedConnectionTypes, credentialType), belong to authoring even though they issue the same executeQuery call -- classify by intent, not by endpoint.
If a request genuinely spans modes, handle them one at a time and read each reference before you start that part. If the mode is ambiguous after reading this table, ask one short clarifying question instead of guessing.
Terminal write -- the step you must not skip
Reading the reference and planning the change is NOT completing the task. Each mutating mode ends with one state-changing call. If you did not issue it, nothing was persisted -- say so explicitly rather than reporting success.
| Mode | Terminal write |
|---|---|
authoring | POST /v1/workspaces/{ws}/dataflows/{id}/updateDefinition to persist the M, connections and output destinations; a NEW dataflow needs POST /v1/workspaces/{ws}/items (or /dataflows) first. executeQuery is a preview and writes nothing. If the user asked for a refresh, also POST .../jobs/instances?jobType=Refresh. |
consumption | none -- this mode is read-only |
upgrade | saveAsNativeArtifact to create the Gen2.1 artefact, then rebind. A readiness report alone does not upgrade anything. |
Before you report the task done, confirm the terminal call returned success and, where the reference documents a readback, read the artefact back to prove the change landed.
upgrade generation boundary -- HARD STOP (mandatory)
Save-as runs only from Gen1 to Gen2.1. For an execution request whose source is Gen2, or whose source generation is not established, state that no public save-as or in-place upgrade endpoint is available and stop before any API call. This does not block a read-only readiness scan whose purpose is to discover and classify Gen1 candidates.
Do not read "choose the closest endpoint and proceed" as approval to export a definition and create a copy, do not switch to authoring to do it instead, and do not mutate anything. Ask the user to clarify the intended outcome and to approve explicitly.
consumption reporting
consumption has no terminal write, so its deliverable is the answer itself. When that mode runs executeQuery, name the operation you called and state the QueryName you sent, verbatim, next to the results, plus whether it was a saved shared member or a non-persisted ad-hoc customMashupDocument. Rows alone do not tell the user which call produced them.
This applies to consumption only. In authoring, executeQuery is an intermediate preview step -- do not add reporting turns around it; go on to the terminal write.
Shared essentials (all modes)
Resolve the workspace and item first; every mode depends on it.
| Task | Reference | Notes |
|---|---|---|
| Finding Workspaces and Items in Fabric | COMMON-CLI.md | Mandatory -- read before resolving any workspace or item id |
| Fabric Topology & Key Concepts | COMMON-CORE.md | Item types, workspaces, capacities |
| Environment URLs | COMMON-CORE.md | Sovereign / non-public cloud hosts |
| Authentication & Token Acquisition | COMMON-CORE.md | Wrong audience = 401; read before any auth issue |
| Authentication Recipes | COMMON-CLI.md | az login flows and token acquisition |
| Core Control-Plane REST APIs | COMMON-CORE.md | Pagination, LRO polling, rate limiting |
| Gotchas & Troubleshooting | COMMON-CLI.md | az rest audience, shell escaping, token expiry |
Rules
MUST
Select exactly one mode from the table above before doing anything else.
Read
references/<mode>.mdend to end, as your FIRST tool call, before the first command of that mode. Read it ONCE, in a single full read: do not re-open it, do not grep it again, and do not page through it. You already have it.Resolve workspace and item ids by listing and filtering, never by guessing a GUID.
Announce a mode switch explicitly when the request crosses a boundary.
Treat the reference as instructions, never as the deliverable. After reading it, RUN the documented commands against the live workspace and report the real results. Quoting what the reference says instead of executing it does not answer the request.
When a question about what Fabric supports IS the deliverable -- supported connection types, a connector's parameters, available credential types -- answer it from the endpoint the reference names rather than from the reference's own list, and name that endpoint in your answer. Whichever mode you are in: the reader cannot tell a live value from a quoted one unless you say where it came from. This is wording in the final answer, not an extra step.
Produce every artefact the user asked for, under the name they used. Running the right API calls is not a substitute for the requested report: if the request names a deliverable, emit it, and keep its heading even when the finding is "none" or "not applicable".
PREFER
The narrowest mode that satisfies the request.
Reading exactly ONE mode reference. Load a second only when the request genuinely spans modes, and say so before you do.
Reporting the mode you chose in your first response so the user can correct you.
AVOID
Acting from this dispatcher alone -- it intentionally omits the operational detail.
Answering with a summary of the reference instead of executing it.
Re-reading or re-grepping a reference you already loaded; it costs turns and tokens.
Mutating anything while in a read-only mode.
Loading a different skill for work this skill already owns (see CRITICAL NOTES 3).
Examples
| User request | Mode | Reference to read |
|---|---|---|
| "Show me the refresh history and parameters of the SalesIngest dataflow." | consumption | references/consumption.md |
| "Preview this M query, then save it into the SalesIngest dataflow definition." | authoring | references/authoring.md |
| "Is my Gen1 dataflow ready to upgrade to Gen2.1?" | upgrade | references/upgrade.md |
Files
- ATTRIBUTION.mdAdded by AutoGineer871 B
- LICENSELicence file added by AutoGineer1.1 KiB
- SKILL.md9.5 KiB
- apm.yml445 B
- references/authoring.md55.3 KiB
- references/authoring/authoring-cli-quickref.md23.4 KiB
- references/authoring/authoring-script-templates.md79.7 KiB
- references/authoring/charts/bar_chart.pyScript3.9 KiB
- references/authoring/charts/line_chart.pyScript3.5 KiB
- references/authoring/connection-management.md39.8 KiB
- references/authoring/connectors.md14.7 KiB
- references/authoring/m-language.md9.7 KiB
- references/authoring/mashup-preview.md28.3 KiB
- references/authoring/output-destinations.md39.6 KiB
- references/consumption.md28.7 KiB
- references/consumption/chart-visualization.md2.6 KiB
- references/consumption/charts/bar_chart.pyScript3.9 KiB
- references/consumption/charts/line_chart.pyScript3.5 KiB
- references/consumption/consumption-cli-quickref.md6.7 KiB
- references/consumption/discovery-queries.md7.0 KiB
- references/consumption/script-templates.md17.1 KiB
- references/upgrade.md21.0 KiB
- references/upgrade/risk-assessment-guide.md11.2 KiB
- references/upgrade/upgrade-cli-quickref.md8.8 KiB
references/upgrade/risk-assessment-guide.md
Risk Assessment Guide — Dataflow Save-As (Gen2.1 Copy)
Detailed detection logic, API calls, and classification criteria for each of the seven risk signals evaluated during Phase 1 (Readiness Assessment).
This guide assumes saveAsNativeArtifact behavior: no in-place migration is available; save-as creates an upgraded Gen2.1 copy while preserving the original Gen1 dataflow.
Risk Signal Overview
| # | Signal | Severity | Detection API | Key Indicator |
|---|---|---|---|---|
| 1 | Incremental refresh | ⚠️ Warning | Power BI Dataflows — Get Dataflow | entities[].ppiConfig present |
| 2 | BYOSA / Custom ADLS Gen2 storage | ❌ Blocker | Power BI Dataflows — Get Dataflows / Admin API | modelUrl → customer dfs.core.windows.net |
| 3 | Power Automate / API triggers | ⚠️ Warning | Manual / Power Automate inventory | External refresh triggers referencing Gen1 ID |
| 4 | Downstream pipeline dependencies | ⚠️ Warning | Fabric Pipelines API | Pipeline activities referencing dataflow ID |
| 5 | Linked / computed entities | ⚠️/❌ | Power BI Dataflows — Get Upstream Dataflows | upstreamDataflows[] non-empty |
| 6 | DirectQuery connections | ❌ Blocker | Power BI Dataflows — Get Dataflow (definition) | entities[].partitions[].mode == "directQuery" |
| 7 | Caller is not owner / insufficient role | ❌ Blocker | Power BI Dataflows — List Dataflows (configuredBy) + workspace role check | configuredBy differs from current user AND workspace role < Contributor |
Signal 1: Incremental Refresh (PPI)
What It Is
Gen1 dataflows can be configured with incremental refresh policies (PPI — Power Platform Incremental). This policy defines how much historical data to retain and how to refresh incrementally. The PPI configuration may need reconfiguration or verification after save-as to ensure it works the same way in Gen2 CI/CD format.
Note: Schedule copying (disabled state) is universal to all save-as operations via the
includeScheduleparameter — this is not specific to PPI. The risk signal here is about the PPI policy configuration itself, not the schedule state.
Detection
WS_ID="<workspaceId>"
DF_ID="<gen1DataflowId>"
# Export the full definition and check for PPI config
DEFINITION=$(az rest --method get \
--resource "https://analysis.windows.net/powerbi/api" \
--url "https://api.powerbi.com/v1.0/myorg/groups/$WS_ID/dataflows/$DF_ID" -o json)
# Check for incremental refresh policies (ppiConfig)
echo "$DEFINITION" | jq '[.entities[]? | select(.ppiConfig != null) |
{entity: .name, incrementalRefreshPolicy: .ppiConfig}]'Classification
Empty result → No incremental refresh policy → safe from this signal
Entities with
ppiConfig→ ⚠️ Warning: PPI configuration detected; verify policy behavior and performance after save-as
Remediation
After save-as, verify the new Gen2 CI/CD dataflow's incremental refresh policy is working as expected
Test a refresh cycle to confirm the incremental window (retention + new data) is correct
Adjust retention periods or incremental logic if needed for Gen2 format
Signal 2: BYOSA / Custom ADLS Gen2 Storage
What It Is
Gen1 dataflows can use Bring Your Own Storage Account (BYOSA) — data is stored in the customer's ADLS Gen2 account instead of Power BI-managed storage. Gen2 CI/CD dataflows use Fabric-managed storage exclusively.
Detection
# From List Dataflows response — check modelUrl
az rest --method get \
--resource "https://analysis.windows.net/powerbi/api" \
--url "https://api.powerbi.com/v1.0/myorg/groups/$WS_ID/dataflows" \
--query "value[].{id:objectId, name:name, modelUrl:modelUrl}" -o json
# BYOSA indicator: modelUrl points to a customer storage account
# Pattern: https://<customAccount>.dfs.core.windows.net/powerbi/...
# Non-BYOSA: modelUrl is null, empty, or points to Power BI-managed storage# Using Admin API — tenant-wide BYOSA detection
az rest --method get \
--resource "https://analysis.windows.net/powerbi/api" \
--url "https://api.powerbi.com/v1.0/myorg/admin/dataflows" \
--query "value[?modelUrl!=null].{id:objectId, name:name, ws:workspaceId, storage:modelUrl}" -o jsonClassification
modelUrlis null or Power BI-managed → No BYOSA → safe from this signalmodelUrlpoints to<customer>.dfs.core.windows.net→ ❌ Blocker: data lives in external storage; save-as will not move data
Remediation
Evaluate whether the BYOSA data can be moved to Fabric-managed storage
If data must stay in customer storage, save-as cannot proceed — keep as Gen1 or redesign the dataflow
Consider creating a new Gen2 dataflow from scratch that reads from the same ADLS source
Signal 3: Power Automate / API Triggers
What It Is
External systems (Power Automate flows, custom APIs, Logic Apps) may trigger refreshes on the Gen1 dataflow using its ID. After save-as, the Gen2 CI/CD artifact has a new ID — all triggers must be updated.
Detection
This signal cannot be fully detected via REST API alone. The agent should:
Ask the user: "Are there Power Automate flows or external APIs that trigger refresh on this dataflow?"
Check refresh history for API-initiated refreshes:
# Check transaction history for externally triggered refreshes
az rest --method get \
--resource "https://analysis.windows.net/powerbi/api" \
--url "https://api.powerbi.com/v1.0/myorg/groups/$WS_ID/dataflows/$DF_ID/transactions" \
--query "value[?refreshType=='OnDemand' || refreshType=='ViaApi']" -o jsonClassification
No external triggers confirmed → safe from this signal
External triggers exist → ⚠️ Warning: all triggers must be updated to use the new Gen2 CI/CD artifact ID
Remediation
Note the new artifact ID from the
saveAsNativeArtifactresponseUpdate all Power Automate flows to reference the new ID
Update any custom API integrations
Test each trigger against the new artifact
Signal 4: Downstream Pipeline Dependencies
What It Is
Fabric Data Factory pipelines may have dataflow activities that reference the Gen1 dataflow by ID. After save-as, pipeline activities must be re-bound to the new Gen2 CI/CD artifact.
Detection
# List pipelines in the workspace
PIPELINES=$(az rest --method get \
--resource "https://api.fabric.microsoft.com" \
--url "https://api.fabric.microsoft.com/v1/workspaces/$WS_ID/dataPipelines" \
--query "value[].{id:id, name:displayName}" -o json)
# For each pipeline, get its definition and search for the dataflow ID
# (Pipeline definitions reference dataflow activities by artifact ID)Note: Full pipeline definition inspection requires the
getDefinitionAPI on each pipeline. For large workspaces, this may be time-consuming.
Classification
No pipelines reference this dataflow → safe from this signal
Pipelines reference this dataflow → ⚠️ Warning: pipeline activities must be updated to the new Gen2 CI/CD artifact ID
Remediation
After save-as, update each referencing pipeline's dataflow activity to point to the new artifact ID
Test pipeline execution to verify the updated reference works
Signal 5: Linked / Computed Entities
What It Is
Gen1 dataflows can reference entities from other dataflows (linked entities) or compute entities based on other entities in the same or different dataflows. If the source dataflow isn't saved first, linked entities in the saved dataflow may break.
Detection
# Check upstream dataflow dependencies
UPSTREAM=$(az rest --method get \
--resource "https://analysis.windows.net/powerbi/api" \
--url "https://api.powerbi.com/v1.0/myorg/groups/$WS_ID/dataflows/$DF_ID/upstreamDataflows" -o json)
echo "$UPSTREAM" | jq '.'# Also check the definition for entity references
DEFINITION=$(az rest --method get \
--resource "https://analysis.windows.net/powerbi/api" \
--url "https://api.powerbi.com/v1.0/myorg/groups/$WS_ID/dataflows/$DF_ID" -o json)
# Look for linked entity references
echo "$DEFINITION" | jq '[.entities[]? | select(.linkedEntityRef != null) |
{entity: .name, linkedTo: .linkedEntityRef}]'Classification
No upstream dataflows and no linked entity refs → safe from this signal
Upstream dataflows exist, all already Gen2 → ⚠️ Warning: verify references after save-as
Upstream dataflows exist, some still Gen1 → ❌ Blocker: must save upstream dataflows first
Remediation
Build a dependency graph of all linked dataflows
Save in topological order: upstream first, then downstream
After each save-as, verify linked entity references still resolve
Signal 6: DirectQuery Connections
What It Is
Gen1 dataflows can use DirectQuery mode for certain data sources. Gen2 CI/CD dataflows do not support DirectQuery — they only support Import mode with optional staging (Fast Copy).
Detection
# Export the definition and check partition modes
DEFINITION=$(az rest --method get \
--resource "https://analysis.windows.net/powerbi/api" \
--url "https://api.powerbi.com/v1.0/myorg/groups/$WS_ID/dataflows/$DF_ID" -o json)
# Check for DirectQuery partitions
echo "$DEFINITION" | jq '[.entities[]? | .partitions[]? |
select(.mode == "directQuery") | {entity: .name, mode: .mode}]'Classification
No DirectQuery partitions → safe from this signal
DirectQuery partitions found → ❌ Blocker: DirectQuery not supported in Gen2 CI/CD
Remediation
Convert DirectQuery entities to Import mode before save-as
Alternatively, redesign the dataflow to use Import with scheduled refresh
If DirectQuery is required, the dataflow cannot be saved — keep as Gen1
Composite Risk Assessment
After checking all seven signals, combine results into a final readiness classification:
| Rule | Result |
|---|---|
| Any ❌ Blocker present | ❌ Blocked — resolve blockers before save-as |
| Only ⚠️ Warnings present | ⚠️ Manual followups — can save, but remediation needed |
| No signals detected | ✅ Safe — save immediately |
Assessment Script Pattern
# Initialize
READINESS="safe"
SIGNALS="[]"
# Check each signal and accumulate
# (See individual signal sections above for API calls)
# Signal 2: BYOSA check
MODEL_URL=$(echo "$PBI_DATAFLOW" | jq -r '.modelUrl // empty')
if [ -n "$MODEL_URL" ]; then
READINESS="blocked"
SIGNALS=$(echo "$SIGNALS" | jq '. + [{"signal":"BYOSA storage","severity":"blocker","detail":"modelUrl: '$MODEL_URL'"}]')
fi
# Signal 6: DirectQuery check
DQ_COUNT=$(echo "$DEFINITION" | jq '[.entities[]?.partitions[]? | select(.mode == "directQuery")] | length')
if [ "$DQ_COUNT" -gt 0 ]; then
READINESS="blocked"
SIGNALS=$(echo "$SIGNALS" | jq '. + [{"signal":"DirectQuery","severity":"blocker","detail":"'$DQ_COUNT' DirectQuery partitions found"}]')
fi
# Signal 5: Linked entities check
UPSTREAM_COUNT=$(echo "$UPSTREAM" | jq '. | length')
if [ "$UPSTREAM_COUNT" -gt 0 ]; then
if [ "$READINESS" != "blocked" ]; then READINESS="manual"; fi
SIGNALS=$(echo "$SIGNALS" | jq '. + [{"signal":"Linked entities","severity":"warning","detail":"'$UPSTREAM_COUNT' upstream dataflow dependencies"}]')
fi
# ... (repeat for signals 1, 3, 4)
echo "Readiness: $READINESS"
echo "Signals: $SIGNALS" | jq '.'Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs Python
Security
What our scanner noticed· Low risk
- Instructions that use the network
- Scripts that your agent may run
This skill includes scripts that your agent may run. Read them before you use it.
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- Microsoft
- Publisher
- Microsoft (Official)
- Source
- microsoft/skills-for-fabric · skills/dataflows-cli · commit f8fac11
- Licence
- MIT License (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Also distributed in
- microsoft/skills-for-fabric
AutoGineer is not affiliated with or endorsed by Microsoft or Microsoft.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download dataflows-cli.zip