Forum Discussion
Accessing one lake
Hi smpa01 ,
Thanks for providing those details and code examples, your understanding is logical, but here’s where the key difference lies:
Although OneLake is built on ADLS Gen2 and supports the same APIs and SDKs, it does not support SAS token authentication. OneLake exclusively uses Microsoft Entra ID (Azure AD)-based authentication, which is more secure and aligned with Fabric’s enterprise governance model.
So while you can continue to use DataLakeServiceClient, you must authenticate using a supported credential type like ClientSecretCredential or DefaultAzureCredential with a registered service principal.
To enable this:
- Use your SPN and authenticate via Entra ID (no SAS tokens).
- Ensure your SPN has at least Viewer or Member role assigned to the Lakehouse item in the Fabric workspace via “Manage Access”.
- Use endpoint:
https://<workspace-name>.dfs.fabric.microsoft.com
While the APIs are compatible, the authentication model is not, and that’s the main reason your current Databricks pattern doesn’t apply directly to OneLake.
If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thankyou.
Anonymous I will tell you what is my confusion here.
The client I works for, uses databricks and provisions each account with an ADLS Gen 2 storage as an external location. You can write files to the storage container with the provided SAS token from databricks notebook. Such as
from azure.storage.filedatalake import DataLakeServiceClient
import json
import io
# https://learn.microsoft.com/en-us/python/api/overview/azure/storage-file-datalake-readme?view=azure-python
blob_account = "account"
blob_container = "container"
scope = "scope"
sas_token = "token"
# Account URL for Data Lake Storage Gen2
account_url = f"https://{blob_account}.dfs.core.windows.net"
# COMMAND ---------
# Initialize the DataLakeServiceClient
datalake_service_client = DataLakeServiceClient(account_url=account_url, credential=sas_token)
# Get the FileSystemClient for the container
fs_client = datalake_service_client.get_file_system_client(file_system=blob_container)
# List all files and directories in the container
print("Listing files and directories:")
paths = fs_client.get_paths()
for path in paths:
print(path)
Now, the following is what the doc says and I was under the impression that I can extend the same methods to Fabric as well but I am somehow can't programmatically access one lake the way I am able to in the above scenario. If I could, I can just recycle all the libraries in fabric I have already written to programmatically access ADLS Gen2 for databricks.
Also,
Additionally, ensure that the identity being used has the correct OneLake access permissions for the Fabric workspace and item. You must be assigned the appropriate role in the Fabric workspace to programmatically access the Lakehouse files via OneLake APIs. - I am the workspace Admin (not tenant admin though) and I have a SPN that I programatically use with Fabric and Power BI rest api. I am not sure what role are you referring to?
Hi smpa01 ,
Thanks for providing those details and code examples, your understanding is logical, but here’s where the key difference lies:
Although OneLake is built on ADLS Gen2 and supports the same APIs and SDKs, it does not support SAS token authentication. OneLake exclusively uses Microsoft Entra ID (Azure AD)-based authentication, which is more secure and aligned with Fabric’s enterprise governance model.
So while you can continue to use DataLakeServiceClient, you must authenticate using a supported credential type like ClientSecretCredential or DefaultAzureCredential with a registered service principal.
To enable this:
- Use your SPN and authenticate via Entra ID (no SAS tokens).
- Ensure your SPN has at least Viewer or Member role assigned to the Lakehouse item in the Fabric workspace via “Manage Access”.
- Use endpoint:
https://<workspace-name>.dfs.fabric.microsoft.com
While the APIs are compatible, the authentication model is not, and that’s the main reason your current Databricks pattern doesn’t apply directly to OneLake.
If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thankyou.
Hi smpa01 ,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.