topic Re: Use Service Tags for ADLSg2 networking in Data Engineering

Use Service Tags for ADLSg2 networking

amaaiia — Mon, 13 May 2024 06:41:21 GMT

Is it possible to use Azure Service Tags to configure Azure Data Lake Storage gen2 to accept inbound traffic from Fabric?

https://learn.microsoft.com/en-us/fabric/security/security-service-tags

Re: Use Service Tags for ADLSg2 networking

v-cboorla-msft — Mon, 13 May 2024 10:38:57 GMT

Hi @amaaiia

Thanks for using Microsoft Fabric Community.

Currently, you can't use Azure Service Tags to configure Azure Data Lake Storage gen2 to accept inbound traffic from Fabric.

Azure Service Tags offer a convenient method for managing access control lists (ACLs) by representing IP ranges for Azure services. However, this approach lacks the necessary granularity for specific resources like ADLS Gen2 accounts. A single service tag encompasses a broad spectrum of IP addresses used by the entire Microsoft service, not specific to your individual storage account.

Workspace Identity offers a more secure solution for granting access to ADLS Gen2 from Microsoft Fabric. This approach leverages a managed identity assigned to your Fabric workspace, enabling you to define precise permissions for accessing specific storage resources. This eliminates the unnecessary exposure of your ADLS Gen2 account to the broader internet, minimizing potential security risks.

For additional information please refer : Workspace identity

In case if you are looking for particular service tags, I appreciate if you could share the feedback on our Microsoft Fabric Ideas. Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

I hope this information helps. Please do let us know if you have any further questions.

Thank you

Re: Use Service Tags for ADLSg2 networking

amaaiia — Mon, 13 May 2024 12:36:57 GMT

I know about workspace identities, but I need to have a capacity above F64 and I don't.

Re: Use Service Tags for ADLSg2 networking

v-cboorla-msft — Fri, 17 May 2024 16:20:09 GMT

Hi @amaaiia

Apologies for the inconvenience.

This is the known limitations in Microsoft Fabric. Fabric workspace identity can only be created in workspaces associated with a Fabric capacity (F64 or higher).

I hope this information helps. Please do let us know if you have any further questions.

Thank you

Re: Use Service Tags for ADLSg2 networking

v-cboorla-msft — Mon, 20 May 2024 06:01:51 GMT

Hi @amaaiia

Glad that you query got resolved.
Please continue using Fabric Community for further queries.

Thanks.