Question

Your team runs a Fabric data pipeline that copies files from an Azure Data Lake Storage Gen2 account into a lakehouse. The storage account has its firewall enabled and only permits access from trusted Microsoft services and specific managed identities. The security team requires that the pipeline authenticate without storing account keys or SAS tokens, and that the credential be automatically managed and scoped to the workspace. What should you configure?

Accepted Answer

Create a workspace identity and grant it access to the storage account, then use it for the pipeline connection

Answer

Generate a SAS token for the storage account and store it in a connection within the pipeline

Answer

Store the storage account key in Azure Key Vault and reference it from the pipeline connection

Answer

Configure a personal account (organizational account) sign-in on the connection for each pipeline run