Forum Discussion
Solution SageCross tenant trusted workspace
I solved this by using the managed private endpoint in combination with a service principal in the same tenant as the storage account, since the workspaces does not work cross tenant without connecting the two tenants in some way.
With the private endpoint, I was able to connect to the storage account that had network restrictions.
With a custom Python script I copied the files from the network restricted storage account to Fabric.
Hi FabianSchut ,
Yes, you can add tenant B's workspace to tenant A's resource instance rule.
- The article you referenced mentions that Microsoft Fabric will soon support Fabric Workspace Identity (FWI) to improve authentication security in the connector. You will be able to add the Fabric Workspace Identifier (FWI) as a trusted identifier for ADLS Gen2 storage accounts. This means that you can use the workspace identifier for secure connections without having to add the workspace identifier each time.
- You can use SAS tokens in conjunction with a trusted workspace that has an identifying SAS tokens are a common authentication method that can be used in conjunction with a trusted workspace to ensure secure access.
Best Regards,
Adamk Kong
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Solution SageHi Anonymous,
Unfortunately, I did not get this setup working. I've added the workspace from tenant A in the network settings from tenant B. When I try to setup the connection in tenant A with a SAS-token, I get an invalid credentials error. I've tried all different access rights with the SAS-token.
What I think goes wrong in this case, is that a connection is not set on workspace level, but Fabric tenant level. When I add a workspace as trusted, the connection does not use that trusted workspace. It may only work if I use Workspace Identity as an authorization method. However, I cannot add the Workspace Identity from tenant A in tenant B as a Blob Data Reader for example.
What is the best way to add the Workspace Identity from tenant A in tenant B?
Hi FabianSchut ,
You can try to manage user identity and control user access to resources with the help of IAM.
Refer to below document:
Azure identity & access security best practices | Microsoft Learn
Best Regards,
Adamk KongIf this post helps, then please consider Accept it as the solution to help the other members find it more quickly.