Forum Discussion
Allow users to upload files to a Lakehouse without granting Contributor access to the workspace
Hi Community !
I have a workspace that contains three lakehouses along with the data processing pipelines between them.
Clients upload their data (binary files) into the BRONZE lakehouse. The issue is that in order for them to upload data, they need write access, which means they must be granted at least Contributor access to the workspace. This unfortunately also gives them access to the processing artifacts in the workspace.
One option we considered is moving the Bronze lakehouse to a separate workspace where clients would have control only over the data upload, while keeping them as Viewers in the current workspace. However, this would require significant development effort (updating connections, code, etc.).
Is there a recommended approach in Fabric to allow external users to upload files to a lakehouse without granting Contributor access to the entire workspace?
Thanks in advance for your help.
Hi ABSOmar,
Right now, the only way to grant write access is via workspace roles. Microsoft calls this out in the documentation:
https://learn.microsoft.com/en-us/fabric/data-engineering/lakehouse-sharing#folder-level-access-controlWrite permissions must still be granted through workspace roles (Contributor or higher).
Moving the lakehouse into its own workspace is probably your best bet for right now.
Hi ABSOmar ,
Currently, Folder wise write permission is not possible without providing workspace contributor access. Please check if below option suits your scenario,
1. If your client wants to upload files its better to keep it in separate workspace(contributor access) and you can create shortcut of those files in your current workspace(viewer access) for futher processess without duplicating.
2. Is it possible for your client to upload the files into their sharepoint folder and provide access to create shortcut by which we can avoid giving contributor access. Between sharepoint shortcut is in Preview.
Regards,
Srisakthi
Hello ABSOmar,
In Fabric, uploading to a Lakehouse requires Contributor access, which exposes workspace artifacts. To avoid this, give clients write access to external storage (Azure Data Lake or Blob) and create a OneLake shortcut in the Bronze Lakehouse pointing to that location. Clients upload files to storage; Fabric reads them via the shortcut. Alternatively, use a dedicated ingestion workspace or an automated upload service (Power Automate, Azure Functions) so clients never get workspace access.
References
OneLake shortcuts: https://learn.microsoft.com/fabric/onelake/create-onelake-shortcut
Workspace roles: https://learn.microsoft.com/fabric/get-started/roles-workspaces
6 Replies
- Olufemi7
Super User
Hello ABSOmar,
In Fabric, uploading to a Lakehouse requires Contributor access, which exposes workspace artifacts. To avoid this, give clients write access to external storage (Azure Data Lake or Blob) and create a OneLake shortcut in the Bronze Lakehouse pointing to that location. Clients upload files to storage; Fabric reads them via the shortcut. Alternatively, use a dedicated ingestion workspace or an automated upload service (Power Automate, Azure Functions) so clients never get workspace access.
References
OneLake shortcuts: https://learn.microsoft.com/fabric/onelake/create-onelake-shortcut
Workspace roles: https://learn.microsoft.com/fabric/get-started/roles-workspaces
SrisakthiHi ABSOmar ,
Currently, Folder wise write permission is not possible without providing workspace contributor access. Please check if below option suits your scenario,
1. If your client wants to upload files its better to keep it in separate workspace(contributor access) and you can create shortcut of those files in your current workspace(viewer access) for futher processess without duplicating.
2. Is it possible for your client to upload the files into their sharepoint folder and provide access to create shortcut by which we can avoid giving contributor access. Between sharepoint shortcut is in Preview.
Regards,
Srisakthi
- tayloramy
Hi ABSOmar,
Right now, the only way to grant write access is via workspace roles. Microsoft calls this out in the documentation:
https://learn.microsoft.com/en-us/fabric/data-engineering/lakehouse-sharing#folder-level-access-controlWrite permissions must still be granted through workspace roles (Contributor or higher).
Moving the lakehouse into its own workspace is probably your best bet for right now.
Hi ABSOmar.,
I would also take a moment to thank Olufemi7 , Srisakthi, tayloramy for actively participating in the community forum and for the solutions you’ve been sharing in the community forum. Your contributions make a real difference.
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.
Regards,
Community Support team.Hi ABSOmar,
I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We are always here to support you.
Regards,
Community Support Team.
HI Currently, we have a use case where users need to provide files that are processed by downstream pipelines. To enable end-to-end automation, we created a shortcut to an ADLS Gen2 container and enabled SFTP access for that location. On the user side, an Autosys job generates the file and securely transfers it via SFTP into the ADLS Gen2 container. The Bronze pipelines then pick up these files for processing.
As a best practice, I recommend the following folder structure:
Files/
├── Shortcut (ADLS Gen2)
├── LandingZone
└── ArchiveZone
The LandingZone is used to stage incoming files, especially when performing format conversions such as CSV to Parquet. While you can directly read files from the shortcut and continue processing, it’s important to maintain a history of all files received from users. To achieve this, move the original file to the ArchiveZone before processing.As an additional tip, organize the ArchiveZone using a YYYYMMDD folder structure. This helps keep historical files well-organized, simplifies auditing, and makes troubleshooting much easier over time.
