Microsoft Fabric (OneLake)

Microsoft Fabric (OneLake)

Microsoft Fabric (OneLake) is a planned data-warehouse connector. Twelfth
will read only the Delta tables you name in one Lakehouse. It will not write to
Fabric, follow shortcuts into other workspaces, or save credentials from the
current setup dialog.

Open Settings → Integrations → Microsoft Fabric (OneLake) → Set up to enter
a tenant ID, the Fabric Lakehouse URL (or its workspace and Lakehouse IDs), and
the table list. Test connection checks the read-only metadata contract and
shows each table and its latest Delta commit. It does not turn on a sync.

What Twelfth reads and where it lands

Twelfth reads Delta/Parquet files through OneLake’s ADLS Gen2 endpoint over
TLS, incrementally where the table has a suitable watermark. The planned
production schedule starts daily at 04:00 Australia/Sydney; hourly is an
agreed schedule change.

Raw landing and processing stay in GCP australia-southeast1 (Sydney).
Source extracts in the landing area are retained for 30 days; modelled
workspace data follows the workspace retention agreement. Removing access
stops new reads but does not shorten an agreed retention period.

Choose an identity

  1. Workspace identity (preferred): a federated Twelfth workload identity in
    the same Entra tenant. No customer secret, certificate or account key is
    created or stored.
  2. Dedicated read-only service principal: create one Entra application for
    this connection and provide only its tenant ID and client ID. Limit Fabric’s
    service-principal tenant setting to the security group containing that app.
    Do not reuse a publisher or administrator identity.

Use Microsoft Entra app registrations
for the second option.

Exact minimum grant

In Fabric, open the named workspace and:

  1. Add the chosen identity as Viewer on that workspace only.
  2. Give the identity a OneLake data-access role with Read on the Lakehouse
    (for example, a role limited to the tables it may read), or grant Read all
    OneLake data    . Viewer alone cannot read files when OneLake security is on.
  3. For a service principal, open Fabric tenant settings
    and enable Service principals can call Fabric public APIs only for its
    security group. Keep Service principals can create workspaces off.
  4. Ensure Users can access data stored in OneLake with apps external to
    Fabric     is enabled for the identity’s group.

Do not grant Owner, Contributor, an account key, access to another workspace,
or tenant-wide admin consent.

Capacity and tenant settings

A Lakehouse needs Fabric capacity. If Fabric reports
FeatureNotAvailable, the workspace is usually on Power BI Premium Per User
rather than Fabric capacity. In Workspace settings → License info, assign a
Fabric trial or an approved paid Fabric capacity. No capacity and an expired
trial also prevent the test from listing tables.

If the identity receives a 403:

  • confirm its tenant ID and that it is Viewer on the exact workspace;
  • confirm a OneLake data-access role grants Read, or Read all OneLake
    data     applies to the Lakehouse;
  • for a service principal, confirm its group is included in both required
    tenant settings and wait a few minutes for policy propagation;
  • confirm the URL’s workspace and Lakehouse IDs are from the same item; and
  • confirm the workspace has active Fabric capacity.

Remove access

Remove the identity from the Fabric workspace. For a dedicated service
principal, also disable or delete its Entra app registration
and remove it from the allowed Fabric security group. A later test must return
403. No Twelfth-side secret needs rotation for workspace identity.

Next Welcome to Twelfth