Datasphere to ADLS security connectivity

You’re right to be concerned about relying on public endpoints, IP allow‑listing, and Service Principal authentication alone. That setup works, but it isn’t the recommended secure architecture for Datasphere → ADLS → Fabric integration.

The secure approach is:

1. Use Azure Private Endpoint (Private Link) for ADLS
This removes public exposure completely and forces all traffic over Microsoft’s backbone network. It also eliminates the need to maintain static IP allow lists.

2. Add the SAP Datasphere VNet Subnet ID to ADLS network rules
SAP Datasphere provides a VNet subnet binding. Adding that subnet to ADLS network rules enables private access instead of public egress IPs, which can change and cause instability.

3. Disable public network access on the ADLS account
Once Private Endpoint + VNet rules are in place, you can safely turn off public access to reduce attack surface.

4. Continue using Service Principal / RBAC for authentication
This is still the right way to authorize, but it should run over the private endpoint instead of a public endpoint.

5. (Optional) For Fabric usage, enable trusted workspace access or use shortcuts
Fabric’s security model supports fully private access to ADLS without exposing anything publicly.

Microsoft Fabric end-to-end security scenario - Microsoft Fabric | Microsoft Learn

Data integration security for SAP on Azure - Cloud Adoption Framework | Microsoft Learn

Thanks,

Lakshmi.