Use OneLake as native storage for Azure Databricks (Generally Available)

Microsoft Employee

5 hours ago

Organizations increasingly use Microsoft Fabric and Azure Databricks together so teams can choose the tools that best fit their data engineering, analytics, and AI workloads while working from a common data foundation.

OneLake external-location support for Azure Databricks Unity Catalog is now Generally available from the Microsoft Fabric side, with OneLake Security enabled by default for Azure Databricks Storage items.

With this integration, supported Unity Catalog-managed data can be stored directly in OneLake. To understand the setup and supported scenarios, Connect Azure Databricks to a OneLake external location.

Why this matters

Data teams often need Azure Databricks and Microsoft Fabric in the same architecture. Without a shared storage approach, organizations may create copies of the same data for different platforms, introduce pipelines whose primary purpose is synchronization, and manage access independently across multiple storage locations.

Using OneLake as managed storage for supported Unity Catalog objects gives organizations a common physical data foundation while preserving flexibility in the services used above it. Azure Databricks continues to provide compute and Unity Catalog management, while OneLake provides the storage destination and Fabric-side data-access controls.

What's new in this release

This release builds on the Beta announcement, which introduced OneLake external-location support for Unity Catalog. OneLake Security is now enabled by default for Azure Databricks Storage items, giving administrators explicit control over which approved identities can discover, read, or write data in OneLake.

The updated security experience helps platform teams move from testing connectivity to planning controlled adoption. Administrators can evaluate where Azure Databricks data should be stored and explicitly configure the identities and permissions required to access it.

One shared data foundation, with flexibility above it

Use OneLake as the storage foundation

Azure Databricks workloads can create supported Unity Catalog-managed data directly in OneLake. A Unity Catalog external location points to an Azure Databricks Storage item in OneLake, and a catalog or schema can use that external location as managed storage.

Control access explicitly

OneLake Security is enabled by default for Azure Databricks Storage items. Administrators can assign discovery, read, or write permissions based on the access each identity requires.

Continue using Unity Catalog-managed objects

Teams can continue using Azure Databricks and Unity Catalog to create and manage supported managed tables, volumes, views, materialized views, and streaming tables. The objects remain managed through the Azure Databricks experience while their underlying supported data is stored in OneLake.

Keep platform responsibilities clear

Azure Databricks remains the environment for Databricks compute and Unity Catalog management. Microsoft Fabric provides the capacity-backed workspace and Azure Databricks Storage item, while OneLake provides the physical storage foundation and corresponding Fabric-side access controls.

How it works

Provision storage in Microsoft Fabric: Create a capacity-backed Fabric workspace and an Azure Databricks Storage item. The storage item provides the OneLake location used by the integration.
Configure identity and access: Use an Access Connector for Azure Databricks with a managed identity, or an approved service principal. Grant the identity the required Fabric workspace or item access and configure the applicable OneLake Security permissions.
Create the Unity Catalog connection: In Azure Databricks, create a storage credential for the approved identity, and then create a OneLake external location that points to the Azure Databricks Storage item.
Create Unity Catalog objects: Configure a catalog or schema to use the OneLake external location as managed storage. Data written by supported Azure Databricks workloads is then stored directly in OneLake.

Security and governance

A shared data foundation does not create a single permission model. Access must be configured in both Azure Databricks and Microsoft Fabric so that users and workloads can reach only the objects and data they require.

Use a managed identity or service principal approved for the workload.
Grant only the required Fabric workspace or item permission.
Configure the applicable OneLake Security role with the required discovery, read, or write permissions.
Configure Unity Catalog permissions for the corresponding Databricks objects and validate end-to-end access before broader rollout.

Keeping these responsibilities separate helps administrators apply least-privilege access on both sides. It also makes troubleshooting clearer because Databricks object permissions and OneLake data permissions can be evaluated independently.