Azure Data Lake Storage Gen2

Azure Data Lake Storage Gen2

Azure Data Lake Storage Gen2 is a planned data-warehouse connector. Twelfth
will read only the Delta or Parquet tables you name under one storage account,
container and optional path. It will not write files or save credentials from
the current setup dialog.

Open Settings → Integrations → Azure Data Lake Storage Gen2 → Set up. Enter
the Entra tenant ID, storage account, container, optional path and table list.
Test connection checks read-only metadata and shows each table and its last
commit. It does not turn on a sync.

What Twelfth reads and where it lands

Twelfth uses the storage account’s DFS endpoint over TLS and reads Delta logs
or Parquet metadata under the configured path. The planned production schedule
starts daily at 04:00 Australia/Sydney; hourly is an agreed schedule change.

Raw landing and processing stay in GCP australia-southeast1 (Sydney).
Source extracts in the landing area are retained for 30 days; modelled
workspace data follows the workspace retention agreement. Removing the Azure
grant stops new reads but does not shorten an agreed retention period.

Choose an identity

  1. Workspace identity (preferred): a federated Twelfth workload identity in
    the same Entra tenant. It needs no customer secret or account key.
  2. Dedicated read-only service principal: create one Entra app registration
    for this connection and provide only its tenant ID and client ID.

Do not use the storage account key, a SAS with write access, or an administrator
identity.

Exact minimum grant

Open Storage accounts in the Azure portal,
choose the account, then open the named container’s Access control (IAM):

  1. Add a role assignment for Storage Blob Data Reader.
  2. Set its scope to this container only.
  3. Select the workspace identity or dedicated service principal.

Hierarchical namespace must be enabled for ADLS Gen2. Shared-key access can stay
off, public blob access can stay off, and TLS 1.2 or later can remain required.
Do not grant Owner, Contributor, Storage Blob Data Contributor, an account
key, or tenant-wide admin consent.

Troubleshoot 403

For a 403 response:

  • confirm the tenant ID and service-principal client ID;
  • confirm Storage Blob Data Reader is assigned on the exact container, not
    merely as a management-plane Reader role;
  • confirm the account and container names, letter case and optional path;
  • wait a few minutes after a new role assignment; and
  • check storage firewall/private-endpoint rules permit Twelfth’s agreed reader
    path without enabling public blob access.

FeatureNotAvailable and no capacity are Fabric errors, not ADLS errors. If
the source is actually a OneLake Lakehouse, use the Microsoft Fabric guide
and assign Fabric capacity and tenant settings there.

Remove access

Remove the identity’s Storage Blob Data Reader assignment from the
container. For a dedicated service principal, also disable or delete its
Entra app registration.
A later test must return 403. Rotate no account key: Twelfth never asks for or
stores one.

Next Welcome to Twelfth