Microsoft Fabric Introduces Delegated OneLake Shortcuts (Preview)
Summary
Microsoft has announced the preview of Delegated OneLake Shortcuts for Microsoft Fabric. This feature introduces connection-based authentication (utilizing organizational accounts, service principals, or workspace identities) as an alternative to the default user-identity pass-through model. This allows organizations to securely share and distribute data within and across tenant boundaries without having to individually provision access for every downstream consumer at the source. It simplifies data governance and enables scalable, zero-copy data distribution.
What happened?
Historically, OneLake Shortcuts in Microsoft Fabric relied solely on pass-through authentication. When a user accessed a shortcut, Fabric evaluated their individual permissions at the target source. With the new preview update, shortcut creators can select a delegated connection identity. The supported connection options include:
- Organizational accounts
- Service principals
- Workspace identities
Once configured, all downstream access to the shortcut uses the permissions of this connection identity. In addition, cross-tenant sharing is supported as long as the consumer has a valid identity in the producer’s tenant.
Why it matters
The default pass-through authentication model created significant operational bottlenecks for enterprise data sharing:
- Access Management Overhead: If a curated dataset needed to be shared with thousands of users across multiple business units, data owners had to manage permissions for every single consumer at the source.
- Cross-Tenant Barriers: Multi-tenant organizations (e.g., separating test/dev from production, or holding parent-subsidiary structures) faced complex setup requirements for simple data access.
Delegated shortcuts address these hurdles by decoupling access management. The data producer grants access to the delegated identity, while the consuming department manages internal access to the shortcut without central IT intervention.
Evidence
The official announcement was detailed in the Microsoft Fabric Updates Blog post titled “Simplifying secure data access with Delegated OneLake Shortcuts (Preview)”. The feature is currently available in preview and integrates with OneLake security roles, including Table-Level Security (TLS) and Column-Level Security (CLS).
Analysis
The release of Delegated Shortcuts addresses a key security and architecture gap in Fabric, moving it closer to a true Data Mesh model. While pass-through authentication remains ideal for collaborative work inside engineering teams, the delegated model is better suited for publishing enterprise-grade Data Products. Unlike Fabric’s existing External Data Sharing feature, which is designed for external clients without an identity in the producer’s tenant, Cross-Tenant Delegated Shortcuts target situations where the consumer already has a registered identity (like a service principal or guest account) in the host tenant.
Practical Takeaways
For data architects and administrators:
- Reduce Administrative Overhead: Use delegated shortcuts for department-wide datasets so consuming teams can manage their own end-user access.
- Enforce Granular Security: Table-level and column-level security roles are supported for delegated shortcuts and should be applied on both source and target layers.
- How to Setup: In your Fabric Lakehouse (or other item), select Get data > New table shortcut, choose the OneLake source, set the connection method to Delegated identity, and input the credentials for your service principal or organizational account.
Open Questions
- What are the performance implications of high-throughput queries executing through a single service principal?
- Are there any egress or API call limitations imposed when using delegated shortcuts intensively across tenant boundaries?