Microsoft Fabric Apps & Rayfin — Complete Developer Guide

What Are Microsoft Fabric Apps?

For decades, enterprise data architectures enforced a strict split between applications and analytics. Applications wrote to operational databases — PostgreSQL, Azure SQL, Cosmos DB — and data engineers ran ETL pipelines to pull that data into warehouses for reporting. Every new application became a new data silo.

Microsoft Fabric Apps closes that gap. Instead of running your application backend on a separate cloud infrastructure and then piping data into Fabric, your backend is Fabric. The SQL database, authentication, APIs, and hosting all run inside your existing Fabric tenant. Data lands in OneLake by default — the same OneLake your Power BI models, Notebooks, and Data Agents already read from. No ETL. No pipeline. No silo.

The developer toolchain for this is Rayfin — an open-source SDK and CLI announced at Microsoft Build 2026. Developers define data models, business logic, and access policies in TypeScript, then run npx rayfin up. Fabric provisions the entire backend automatically.

Microsoft Fabric Apps Architecture

Understanding Microsoft Fabric Apps requires seeing two layers: the developer toolchain that runs locally, and the cloud execution environment that runs inside your Fabric tenant.

The security model is architectural. Data never leaves your Microsoft Fabric tenant by design. Each child service is an individual artifact in the workspace, subject to the platform’s existing governance controls — workspace RBAC, sensitivity labels, and Purview policies all apply automatically.

Microsoft Fabric Apps Child Services — What Gets Auto-Provisioned

Deploying a Microsoft Fabric App with npx rayfin up automatically orchestrates four child services inside your Fabric workspace. Microsoft refers to these as Child Services — each appears as a separate Fabric artifact in the workspace view.

Rayfin CLI — Local Development Workflow

The standard Microsoft Fabric Apps development workflow uses three core Rayfin CLI commands: scaffold, run locally, and deploy.

# 1. Scaffold a new project from template
npm create @microsoft/rayfin@latest my-app --workspace <workspacename>

# 2. Run locally (full stack — database, API, and frontend)
cd my-app
npm run dev

# 3. Deploy to Microsoft Fabric
npx rayfin up

Project Structure

The scaffold command generates a structured, predictable project tree. The rayfin/ directory contains the backend definition — data models, configuration, and TypeScript schema. The src/ directory contains the frontend.

my-app/
├── rayfin/
│   ├── data/          # TypeScript entity classes (your data models)
│   ├── rayfin.yml     # Service configuration (auth, db, hosting)
│   └── tsconfig.json
├── src/               # Frontend source code
└── package.json

Key CLI Commands

TypeScript Data Models & Decorators in Microsoft Fabric Apps

The Rayfin programming model is code-first and TypeScript-driven. Instead of writing SQL DDL scripts, developers define data models as TypeScript classes with decorators. Fabric Apps reads these decorators at deploy time and generates the SQL schema, GraphQL API, data validation rules, and row-level security policies automatically.

Core Decorators from @microsoft/rayfin-core

import { entity, role, text, boolean, date, uuid } from '@microsoft/rayfin-core';

@entity()
@role('authenticated', '*', {
  policy: (claims, item) => claims.sub.eq(item.user_id),
})
export class Todo {
  @uuid()
  id!: string;

  @text({ min: 1, max: 100 })
  title!: string;

  @boolean()
  isCompleted!: boolean;

  @date()
  createdAt!: Date;

  @date({ optional: true })
  dueDate?: Date;

  @text()
  user_id!: string;
}

This single class definition causes Fabric Apps to generate: a Todo table in the SQL database with the correct column types and constraints; a GraphQL API with CRUD operations, filtering, and pagination; a row-level security policy that restricts each user to seeing only their own Todo items; and data validation on the title column (minimum 1 character, maximum 100).

Your TypeScript model files act as the single source of truth for the entire backend schema — database, API, and security policies all stay in sync automatically when you redeploy.

GraphQL API — Reading and Writing Data in Microsoft Fabric Apps

Every entity class decorated with @entity() automatically gets a full GraphQL API. You do not write resolvers for standard CRUD operations — Fabric Apps generates them. The client-side SDK provides a typed, fluent API for querying and mutating data.

import { RayfinClient } from '@microsoft/rayfin-client';
import type { Todo } from '../rayfin/data/Todo';

type AppSchema = {
  Todo: Todo;
};

const client = new RayfinClient<AppSchema>({
  baseUrl: import.meta.env.VITE_RAYFIN_API_URL ?? 'http://localhost:5168',
  publishableKey: 'pk-your-project-key',
});

// Query all todos for the signed-in user
const todos = await client.data.Todo.findMany({
  where: { isCompleted: { eq: false } },
  orderBy: { createdAt: 'desc' },
  take: 20,
});

// Create a new todo
const newTodo = await client.data.Todo.create({
  data: { title: 'Review Q2 data model', isCompleted: false },
});

The generic type argument on RayfinClient enables TypeScript to provide autocomplete and compile-time type checking for all data operations. If your schema changes — a new column, a renamed field — TypeScript catches mismatches before deployment.

Authentication, Security & the Shared Responsibility Model

Authentication Model

Microsoft Fabric Apps uses Microsoft Entra ID SSO (Fabric SSO) as the exclusive authentication provider for deployed applications. The RayfinClient exposes an auth service that handles sign-in, sign-up, session management, and sign-out — the same call handles both new and returning users.

For local development only, email and password authentication is available as a fallback so developers can test without a Fabric deployment. In production on Fabric, Fabric SSO is the only supported auth method.

Shared Responsibility Model

Workspace Permission Levels

Microsoft Fabric Apps Pricing & Capacity Usage

Microsoft Fabric Apps consumes Capacity Units (CUs) from the assigned Fabric capacity — the same CU pool that powers your Warehouses, Lakehouses, and Notebooks. There is no separate billing account for Fabric Apps.

Microsoft Fabric Apps as an AI Agent Backend

While Microsoft Fabric Apps supports standard CRUD application patterns, Microsoft launched this platform primarily to serve as a governed backend for AI agents. The vibe-coding era has made it easy for anyone with a prompt to create a working application in minutes — but each one arrives with its own uncoordinated database, its own auth model, and no connection to the enterprise data estate.

Rayfin is Microsoft’s structural answer to that problem: every agent-created application deploys to the same governed Fabric tenant, inherits the same security controls, and routes its data into the same OneLake.

Why AI Agents Need Microsoft Fabric Apps

Replit is the exclusive launch partner for Microsoft Fabric Apps. The integration lets teams build in Replit using natural language or AI assistance, then deploy the backend to Fabric with Rayfin — application data stays inside the Fabric tenant boundary rather than Replit’s infrastructure.

For the broader picture of AI agent development on Fabric, see Agentic Data Engineering Tutorial and Microsoft Fabric Data Agent — Complete Guide.

Microsoft Fabric Apps vs Power Apps — Key Differences

Both platforms create applications within the Microsoft ecosystem, but they target entirely different development personas and use cases. Choosing the wrong platform adds unnecessary complexity — this comparison clarifies the decision.

The decision is straightforward: if your team writes TypeScript and you need a governed, AI-ready backend that integrates with your existing Fabric data estate, use Microsoft Fabric Apps. If your business analyst needs to build an internal form or workflow tool without writing code, use Power Apps.

Current Limitations of Microsoft Fabric Apps

Microsoft Fabric Apps is in public preview. These are confirmed limitations as of June 2026 based on official Microsoft Learn documentation.

FAQ — Microsoft Fabric Apps & Rayfin

Official Microsoft Documentation — Fabric Apps & Rayfin