Streamlined, secure access to private ADLS containers
Strong security should protect your data—not slow your teams down. In today’s digital landscape, adhering to Zero Trust principles is non-negotiable, but the controls you put in place shouldn’t create unnecessary friction.
At Inviso, we help organizations build secure, scalable data platforms that align with Zero Trust principles and empower people to do their best work without risking safety. A common challenge we help customers solve is enabling Microsoft Fabric to access data stored in Azure Data Lake Storage (ADLS) containers that are locked down with private endpoint-only access—with no exposure to the public internet whatsoever.
In this post, we’ll walk through how to enable this secure access using Fabric trusted workspace access. We’ll also show how to integrate service principal authentication and Lakehouse shortcuts for a seamless, governed data experience.
When private storage meets public platform: A SaaS connectivity issue
As more organizations embrace Zero Trust and private networking strategies, their ADLS accounts are increasingly configured to block all public network access. These accounts are only reachable via private endpoints within a secured virtual network.
But what happens when you want to use Microsoft Fabric—a SaaS platform—to access that data?
By default, Fabric cannot reach into your private network. This is where trusted workspace access comes in.
Leveraging trusted workspace access and lakehouse shortcuts
Trusted workspace access allows you to explicitly authorize Fabric workspaces to connect to private resources like ADLS—without exposing them publicly. This creates a secure bridge between Fabric and your data, so you maintain Zero Trust compliance while still enabling analytics and integration at scale.
Before we dive into the steps, it’s important to note that trusted workspace access is only available on F-SKU capacities. P-SKU and trial capacities don’t support the features required for private connectivity.
Below, we outline Inviso’s proven approach to enabling this secure connectivity.
Begin by creating a Workspace Identity
Each Fabric workspace must have a Workspace Identity configured. This identity acts as the bridge between Fabric and your private storage.
Create a Workspace Identity in the workspace settings:
Figure 1:Creating a Workspace Identity
After clicking +Workspace identity, the Workspace Identity name and ID will be generated.
- We proceed by assigning the Storage Blob Data Reader role to the Workspace Identity on the target Storage Account.
Figure 2: Adding role-based access controls
Figure 3: Selecting the Storage Blob Data Reader role
Figure 4: Assigning the members to add with Storage Blob Data Reader Role
Use a Service Principal for connection setup
We then also need to configure a Service Principal (SPN) to authenticate the connection when creating shortcuts in Fabric.
It is important to note that the SPN must also be granted the Storage Blob Data Reader role on the Storage Account. Without this role, even if trusted workspace access is configured, the SPN will not be able to access the files in the container, and any queries or integrations from Fabric will fail.
Deploy trusted access via ARM template
Next, to establish the trust relationship, we deploy a custom ARM template that registers the Fabric workspace as a trusted resource on the Storage Account. Below is an example of the code used in the ARM template.
ARM template
Figure 5: Example of ARM template code
Defining the ARM template values
- name”: “<storage account name>”
- Name of the storage account where the access rules will be applied.
- “id”: “/subscriptions/<subscription id of storage account>/resourceGroups/<resource group name>/providers/Microsoft.Storage/storageAccounts/<storage account name>”
- Subscription ID, resource group name, and storage account name where the access rules will be applied.
- “location”: “<region>”
- Region of the storage account where the access rules will be applied.
- “tenantId”: “<tenantid>”
- Tenant ID for your storage account where the access rules will be applied.
- “resourceId”: “/subscriptions/00000000-0000-0000-0000-000000000000/resourcegroups/Fabric/providers/Microsoft.Fabric/workspaces/<workspace-id>”
- The subscription identified as all 0’s is correct – leave that as is.
- The workspace ID is the GUID found in the Fabric workspace URL after “/groups/…”
Figure 6: Finding the Fabric workspace ID in the URL
Running the ARM template
In Azure, use the “deploy a custom template” service to run the ARM template.
Figure 7: Deploy a custom template example
In the “Select a template” step, choose to build your own template.
Figure 8: Selecting to build your own template
Paste the updated ARM template into the editor and click “Save”. Check that the Subscription, Resource Group and Region of the Storage Account are selected, then click “Review + create”. The ARM template will run and update the trusted resources for the Storage Account.
Creating the shortcut connection in Fabric
Now that trusted workspace access is configured, the actual connection to the ADLS container is made using a shortcut inside a Lakehouse in Fabric.
Let’s look at how that works:
1. Open your Lakehouse in the Fabric Workspace
2. Click the three-dot button “…” next to the Tables or Files folder within the Lakehouse and select “New Shortcut”.
Figure 9: Example of selecting “New Shortcut”
a. Shortcuts in the Tables folder need to connect to a folder holding files that define a Delta Table.
b. Shortcuts in the Files folder can connect to any directory level with a particular storage container to view all the files within that directory and/or subdirectories.
3. Select Azure Data Lake Storage Gen2 as the source.
4. Create or use an existing connection to the Storage Account, authenticating with the Service Principal credentials.
Figure 10: Example of the connection credentials required
5. Select the container/directory within the Storage Account where you want the shortcut, and then click “Create”.
Figure 11: Creating a folder shortcut in a Lakehouse files folder
Figure 12: The created folder shortcut
Using shortcuts in workspaces enabled with trusted workspace access allows Fabric to read data directly from the private ADLS container—without copying or moving data, and without exposing it to the public internet.
Ensuring a smooth implementation
Before we close, here’s a summary of the critical aspects to consider when enabling trusted workspace access with Microsoft Fabric:
- F-SKU required: Trusted workspace access is only available on F-SKU (Fabric enterprise) capacities; trial or P-SKU capacities won’t work.
- RBAC configuration: Both the workspace identity and the service principal must have the correct RBAC roles.
- Private endpoint setup: Your storage account must already be configured with private endpoint access.
- Lakehouse shortcuts: This is the mechanism through which Fabric accesses the data once trust is established.
Unlock secure, private, and scalable Fabric Access
The approach we’ve outlined here enables secure, private, and scalable access from Microsoft Fabric to your ADLS containers—without compromising your Zero Trust architecture.
At Inviso, we specialize in helping organizations implement secure data platforms that integrate seamlessly with Microsoft’s modern analytics stack.
If you’re looking to enable private connectivity and Zero Trust access in your Fabric environment, we’re here to help. Please reach out to our experts at info@invisocorp.com to learn more about what we provide.
