As organizations scale their use of OneLake across analytics workloads, a key challenge emerges: enabling secure, service‑to‑service access from Azure services, such as an Azure Databricks workspace or Azure SQL Server, without adding operational complexity. Traditional approaches such as IP allowlists or fully private networking can become difficult to manage as the number of services, workspaces, and integration points grows.
Resource instance rules provide a simpler way to secure access based on trusted Azure resource identities.
Resource instance rules are available for production workloads across enterprise analytics environments. They give workspace admins a precise way to allow access from trusted Azure resource instances while continuing to enforce strong network and data-level protections.
Use resource instance rules when you need to enable secure service-to-service access to OneLake without relying only on IP allowlists or requiring private networking for every integration. Combined with Private Link, IP firewall rules, and identity-based permissions, they help organizations apply layered security based on the needs of each workspace and workload.
Resource instance rules support a broad set of Azure services that can present a verifiable Azure resource identity, including Azure Databricks, Azure SQL Server, Azure Data Factory, Azure Event Grid, Azure Machine Learning, and more.
A simpler approach to securing service access
Resource instance rules introduce a model where access to data in OneLake is governed by trusted Azure resource identities, rather than relying solely on network location.
Workspace admins can define an allowlist of specific Azure resource instances that are permitted to access data. Requests over the public endpoint are evaluated against this allowlist, and only approved resource identities are allowed through.
This gives customers fine-grained control over which services can access OneLake, without needing to manage IP ranges or enforce private networking for every integration.
Common scenarios include allowing a specific Azure Databricks workspace or Azure SQL Server to access without relying on broad IP allowlists or deploying private networking for every integration, similar to how trusted resource access is used with ADLS today.
How it works
Resource instance rules are simple to configure and enforce:
- Workspace admins configure trusted Azure resource instances in Workspace Settings.Figure: Workspace settings to add trusted resource instances.
- Azure resource instance ARM IDs are added to the allowlist.
- When a request is made to OneLake over the public endpoint:
- The resource identity is validated against the configured allowlist.
- Access is allowed only if the resource is explicitly trusted.
- Data permissions are then evaluated.
Works seamlessly with existing security controls
Resource instance rules extend existing networking controls rather than replace them.
Customers can use them alongside:
- Private Link
- IP firewall rules
- Identity-based permissions
This enables a layered security approach, combining identity-based access with network-based restrictions based on the needs of each workspace and workload.
Bring trusted Azure service access into your OneLake security model
Resource instance rules help organizations extend existing OneLake security controls to trusted Azure resource identities, providing another layer of access control alongside network and identity-based protections.
To get started, review the Resource Instance rules for Inbound access documentation to learn more about configuring inbound trusted resources and how resource instance rules can simplify secure access for your Azure service integrations.
Microsoft Employee