Azure and Fabric events in Real-Time hub let organizations build event-driven workflows that react to changes across their data estate in real time. These workflows often span workspaces: an Activator alert in one workspace might monitor OneLake changes in another, or an Eventstream might react to pipeline Job completions across teams. This cross-workspace connectivity is what makes events powerful, but it also needs to be governed.
For enterprises adopting event-driven patterns at scale, network security is essential. Teams need confidence that their real-time workflows comply with organizational security policies, so they can move faster without compromising governance. Without this, security concerns become a blocker to adopting event-driven architectures in production.
Azure and Fabric events now support workspace outbound access protection (OAP). This means your cross-workspace event-driven workflows are now subject to the same outbound network controls you've already established for the rest of your Fabric environment, removing a key barrier for enterprises that want to adopt real-time event workflows while maintaining strict network boundaries.
What is outbound access protection?
Outbound access protection is a workspace-level security feature that controls whether items in a workspace can reach resources outside that workspace. When enabled, all outbound connections from the workspace are blocked by default unless explicitly allowed through data connection rules. Many Fabric workloads already support OAP, and with this release, Azure and Fabric events join that list.
How it works for Azure and Fabric events?
When a workspace admin enables outbound access protection on a workspace, all cross-workspace event consumption from that workspace is blocked by default. For example, if OAP is enabled on Workspace A, an Activator alert or an Eventstream in Workspace A that tries to consume Job events from a pipeline in Workspace B will fail unless access is explicitly granted.
To allow cross-workspace event consumption, admins add the Real-Time Events connector to the workspace's data connection rules. Once this rule is in place, consumers (for example, Activator or Eventstreams) in the workspace can consume events from other workspaces. Event consumption within the same workspace is always allowed, regardless of outbound access protection settings.
OAP is enforced on the consumer's workspace only. The source workspace's OAP configuration doesn't impact the event flow.
What happens when OAP is enabled after events are already configured?
One of the most important aspects of this release is how Real-Time hub responds when OAP is enabled on a workspace that already has cross-workspace event consumers configured.
The system detects the policy change and puts affected consumer configurations in a Paused state. While paused, events are retained for up to seven days. If the condition isn't resolved within that period, the retained events are dropped. You can discover paused configurations on the Fabric events or Azure events page in Real-Time hub, where the Status column shows Active or Paused. Select View details to see the specific reason for the pause.
To resume event delivery, add the Real-Time Events connector to the workspace's data connection rules, and then delete and recreate the consumer configuration.
Part of a broader network security story
OAP joins the existing private link support for Azure and Fabric events, giving you multiple layers of network security for your event-driven workflows:
- Outbound access protection controls whether a consumer workspace can reach event sources in other workspaces (NEW).
- Workspace-level private links control whether other workspaces can consume events from a source workspace that blocks public access.
- Tenant-level private links control whether Azure events (such as Azure Blob Storage events) can be delivered into a tenant that blocks public internet access.
Together, these features ensure that your event-driven workflows operate within the same network boundaries you've established for the rest of your Fabric environment.
Getting started
To enable OAP for Azure and Fabric events in your workspace:
- Enable outbound access protection in the workspace where event consumers (for example, Activator or Eventstreams) are configured.
- Add the Real-Time Events connector to the workspace's data connection rules.
- Consumers in the workspace can now consume events from other workspaces within the boundaries of the OAP policy.
Learn more
Microsoft Employee