Introduction
Data rarely stays in one place. As organizations standardize Microsoft Fabric and OneLake, the same datasets need to be reused across teams, domains, workspaces, and increasingly across tenant boundaries. The challenge is no longer moving data; it is sharing it securely, consistently, and at scale without creating copies, breaking governance, or forcing every consumer to be individually provisioned at the source.
OneLake Shortcuts already solve a large part of this problem. A shortcut presents data where people need it while the data stays in its original location, enabling a true zero-copy approach to distribution. By default, OneLake Shortcuts use pass-through authentication: when a user reads a shortcut, Fabric accesses the target data using that signed-in user’s identity, and the data owner controls access directly on the target.
Pass-through is the right model for many collaborative scenarios, but customers have consistently told us it does not fit every access pattern. Two points came up frequently:
- Access management does not scale. When a curated dataset must be served to thousands of downstream users across multiple teams, the data owner becomes responsible for granting and maintaining every individual user’s permission on the source, an operational bottleneck that grows with every new consumer.
- Cross-tenant sharing is harder than it should be. Multi-tenant organizations told us that they need to access data residing in OneLake across their own tenant.
These are not edge cases. They are everyday realities for enterprises building governed, reusable data products on Fabric. The preview of Delegated OneLake Shortcuts — including delegated sharing both within a tenant and across tenants — gives data owners a simpler, governed way to distribute data without compromising on security.
Introducing delegated OneLake Shortcuts
Delegated OneLake Shortcuts add a second authentication option to the existing shortcut experience you already know. Instead of accessing the target data as each signed-in user, a delegated shortcut accesses the target through a configured connection identity. That identity can be an organizational account, a service principal. This identity is attached to the shortcut, so all access to the shortcut reaches the target as the delegated identity.
Delegated authentication is entirely optional and complements the default experience. If a user does not choose delegated authentication when creating a shortcut, the shortcut continues to use pass-through authentication exactly as before. The default flow is unchanged; delegation is simply there when you need it.
How it works
A delegated shortcut behaves like other external shortcuts in Fabric. When you create one, you sp, and that connection is used to browse and read the target data. This brings a familiar, governed connection model to OneLake-to-OneLake sharing.
- Identity delegation - Downstream users access the data through the delegated identity rather than their own, so the data owner no longer must provision each individual consumer on the source item.
- Secure access enforcement with OneLake security - OneLake security roles can be configured on both the data producer and data consumer delegated Shortcuts. At the time of this writing, table level security and column-level security are supported for delegated shortcuts, on both the target (where you are creating the shortcut) and the shortcut source (where data resides).
- Delegated permissions management - A shortcut can delegate as a fixed identity that represents a business unit. The central data owner controls what that identity can see, while the business unit manages OneLake security for its own end users, all while still honoring the controls applied to the delegated identity.
Cross-tenant sharing
Delegated shortcuts also work across Microsoft Fabric tenants. A cross-tenant delegated shortcut lets you create a OneLake shortcut to data that lives in another organization’s Fabric tenant. You provide a connection path to the external OneLake data and authenticate with an identity from that tenant; downstream users then access the external data through the configured delegated identity, without each user needing individual cross-tenant permissions.
This makes delegated shortcuts a natural fit for multi-tenant enterprises, for example, sharing curated data between an organization’s test and production tenants, or between a parent company and a subsidiary using the same zero-copy, intersection-based security model that applies within a tenant.
Difference between External Data Sharing and delegated Shortcuts
Microsoft Fabric has External Data Sharing, a feature that enables Fabric users to share data from their tenant with users in another Fabric tenant. External data sharing can be used when the consumer has no identity in the producer's tenant, such as sharing across organizational boundaries with an outside partner or customer. This is ideal when you must share with partners or when ISVs must share data with their customers and don’t want to have the consumer identity in their tenant.
Cross-tenant delegated shortcuts are used when the data consumer has an identity, such as an organizational account or service principal, in the producer’s tenant. For example, an organization can share data between its own test and production tenants, with access flowing through the configured delegated identity.
Use cases
Delegated OneLake Shortcuts are designed for the moments when the default pass-through behavior does not match the access pattern you want for a data product. Common scenarios include:
- Departmental data sharing at scale - Represent each department with a delegated identity, scope what that identity can see, and let department owners manage access for their own users instead of routing every request through the central data owner.
- Cross-tenant and subsidiary sharing - Share curated data between tenants — such as test-to-production or parent-to-subsidiary — with no data copies and the same delegated security model.
Getting started
Open the target Fabric item, such as a Lakehouse, and select Get data > New table shortcut.
- In New shortcut, select Microsoft OneLake, then choose the source you want to shortcut to. For cross-tenant data, select Enter connection details and provide the external OneLake path.
- For Connection method, select Delegated identity, then Connect.
- Choose an existing connection or create a new one by providing the OneLake path, a recognizable connection name, and an authentication kind (organizational account or service principal). Sign in to complete authentication.
- Browse the source, select the folders or tables to include, then review and create the shortcut.
To switch an existing shortcut between pass-through and delegated authentication, delete and recreate it with the desired method. For detailed steps, refer to the OneLake Shortcuts documentation.
Conclusion and next steps
OneLake shortcuts are a foundational building block for zero-copy data distribution across Microsoft Fabric. Delegated OneLake Shortcuts extend that foundation to the scenarios enterprises care about most: serving curated data to large audiences, delegating access management to the teams closest to the users, and sharing securely across tenant boundaries.
Together, pass-through and delegated shortcuts let organizations choose the right balance of control, scale, and simplicity for each data product. Pass-through keeps source-managed authorization per person for collaborative engineering. Delegated mode turns a shortcut into part of a governed publishing architecture: central teams retain ownership of the source, consuming teams avoid copying data, and downstream audiences access a managed experience rather than raw-path access — without ever giving up the governance benefits of unifying data in OneLake.
Share your feedback, use cases, and questions in the Microsoft Fabric Community. Your input directly shapes the roadmap.
Microsoft Employee
