Forum Discussion
Datasphere to ADLS security connectivity
hi v-lgarikapat
Are you using the same Azure region for both SAP Datasphere and ADLS, or are they in different regions? [ Balaji ] Yes
What authentication method are you currently using (e.g., Service Principal)? [Balaji] Yes Service principal is the authentication when connecting from datasphere to adls.
Do you have any private endpoints configured for your ADLS account? [ Balaji ] No
What specific security concerns would you like to address that are not covered in this solution? [Balaji] Currently using IP Address Exception of SAP's public IP. This IP might not be static it could be changed. So would like to understand how this can be addressed in secure network protocol
Hi BalajiL , Thanks for the responces
You’re right to be concerned about relying on public endpoints, IP allow‑listing, and Service Principal authentication alone. That setup works, but it isn’t the recommended secure architecture for Datasphere → ADLS → Fabric integration.
The secure approach is:
1. Use Azure Private Endpoint (Private Link) for ADLS
This removes public exposure completely and forces all traffic over Microsoft’s backbone network. It also eliminates the need to maintain static IP allow lists.
2. Add the SAP Datasphere VNet Subnet ID to ADLS network rules
SAP Datasphere provides a VNet subnet binding. Adding that subnet to ADLS network rules enables private access instead of public egress IPs, which can change and cause instability.
3. Disable public network access on the ADLS account
Once Private Endpoint + VNet rules are in place, you can safely turn off public access to reduce attack surface.
4. Continue using Service Principal / RBAC for authentication
This is still the right way to authorize, but it should run over the private endpoint instead of a public endpoint.
5. (Optional) For Fabric usage, enable trusted workspace access or use shortcuts
Fabric’s security model supports fully private access to ADLS without exposing anything publicly.
Microsoft Fabric end-to-end security scenario - Microsoft Fabric | Microsoft Learn
Data integration security for SAP on Azure - Cloud Adoption Framework | Microsoft Learn
Thanks,
Lakshmi.
hi v-lgarikapat : Thanks for your prompt response. I will discuss the above points with our infra team. Regarding #5 - Trusted Workspace Access (TWA) is already in-place to connect ADLS -> Fabric using shortcut. Here the data is coming from Datasphere - > ADLS and using Public IP address as exception.
Hi BalajiL ,
Just following up did you get a chance to discuss this with the infra team as mentioned in the earlier messages
Thanks,
Lakshmi.
Hi BalajiL ,
I'm following up to check whether your issue has been resolved. If you still have any questions or need further assistance, please don't hesitate to reach out we're happy to continue supporting you.
We truly appreciate your participation and thank you for being an active member of the community.
Best regards,
Lakshmi.