Question

You administer a Microsoft Fabric tenant. A data engineering team wants to enable OneLake data access for third-party applications by generating short-lived credentials that respect the same OneLake security roles and item permissions already defined in the workspace. The team asks how to allow external tools (such as Azure Storage Explorer or custom apps using the ADLS Gen2 API) to read lakehouse data without granting broad workspace access. Which configuration should you use?

Accepted Answer

Enable the 'Users can access data stored in OneLake with apps external to Fabric' tenant setting, which lets external ADLS-compatible tools connect while honoring existing OneLake permissions

Answer

Enable external data sharing so that a shortcut is created in the third-party's own tenant, bypassing local OneLake security roles

Answer

Add the external application's service principal to the workspace Admin role so it can read all lakehouse data

Answer

Disable OneLake security roles and rely solely on workspace-level roles for the external tools to authenticate