Cross tenant trusted workspace

[FabianSchut]

Hi,

I am trying to set up a trusted workspace in ADLS in two different tenants. In Tenant A, I have an ADLS Storage Account and in Tenant B, I have my Fabric capacity and environment running. Is it possible to add a workspace from Tenant B in the Resource instance rule of Tenant A? I am using this article as a reference: https://blog.fabric.microsoft.com/en-us/blog/introducing-trusted-workspace-access-for-onelake-shortc....

And is it always necessary to add a workspace identity too? Or can I use a SAS token with trusted workspace with an identity?

[FabianSchut · Accepted solution]

I solved this by using the managed private endpoint in combination with a service principal in the same tenant as the storage account, since the workspaces does not work cross tenant without connecting the two tenants in some way. 
With the private endpoint, I was able to connect to the storage account that had network restrictions. 
With a custom Python script I copied the files from the network restricted storage account to Fabric. 

[v-kongfanf-msft]

Hi @FabianSchut ,

Yes, you can add tenant B's workspace to tenant A's resource instance rule.

• The article you referenced mentions that Microsoft Fabric will soon support Fabric Workspace Identity (FWI) to improve authentication security in the connector. You will be able to add the Fabric Workspace Identifier (FWI) as a trusted identifier for ADLS Gen2 storage accounts. This means that you can use the workspace identifier for secure connections without having to add the workspace identifier each time.
• You can use SAS tokens in conjunction with a trusted workspace that has an identifying SAS tokens are a common authentication method that can be used in conjunction with a trusted workspace to ensure secure access.

Best Regards,
Adamk Kong

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[FabianSchut]

Hi @v-kongfanf-msft,

Unfortunately, I did not get this setup working. I've added the workspace from tenant A in the network settings from tenant B. When I try to setup the connection in tenant A with a SAS-token, I get an invalid credentials error. I've tried all different access rights with the SAS-token.
What I think goes wrong in this case, is that a connection is not set on workspace level, but Fabric tenant level. When I add a workspace as trusted, the connection does not use that trusted workspace. It may only work if I use Workspace Identity as an authorization method. However, I cannot add the Workspace Identity from tenant A in tenant B as a Blob Data Reader for example.
What is the best way to add the Workspace Identity from tenant A in tenant B?

[v-kongfanf-msft]

Hi @FabianSchut ,

You can try to manage user identity and control user access to resources with the help of IAM.

Refer to below document:

Configure the Grit IAM B2B2C solution with Azure Active Directory B2C - Azure AD B2C | Microsoft Lea...

Azure identity & access security best practices | Microsoft Learn

Best Regards,
Adamk Kong

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.