Skip to Content

Wiki source code of Fabric external data sharing

Version 2.1 by Dimitri Rupp on 2026/06/11 09:16
Hide last authors
Dimitri Rupp 1.1 1 {{box cssClass="floatinginfobox" title="**On this page**"}}
2 {{toc/}}
3 {{/box}}
4
5 = Fabric external data sharing =
6
7 {{info}}
8 **Topic:** Sharing data from Lakehouse **outside the SPL tenant**.
9 **Two approaches:** Service Principals (SPN) + API for GraphQL.
10 {{/info}}
11
12 == External data sharing ==
13
14 External data sharing in Fabric refers to **sharing data across organizational boundaries** (cross-tenant), or **enabling internal users or systems to consume data without relying on Microsoft Entra-based authentication**. Both approaches are designed to support secure, scalable, and flexible data exchange — whether across tenants or within environments that require **non-interactive access**.
15
16 == Consume data without Entra authentication ==
17
18 Non-Entra-based authentication is often needed for **systems that operate outside the interactive user model**. These systems typically require **credential-based** or **token-based access** that can be embedded in **scripts** or **automation pipelines**. Using **service principals** or **API keys** allows **secure, programmatic** access.
19
20 == Service Principals to get data from Lakehouse ==
21
22 **Service Principals (SPNs)** are used to facilitate data access for **internal users** who require non-Entra-based authentication, as well as for **external applications or consumers**. By using SPN credentials, **authorised systems can programmatically access data** from designated Lakehouses. Since this method bypasses interactive sign-in, it is well-suited for automation, third-party tools, and cross-tenant scenarios.
23
24 === Setting up SPN — step by step ===
25
26 **🔧 Step 1 — Register the Service Principal in Microsoft Entra ID**
27 * Go to the **Microsoft Entra admin centre** (formerly Azure AD portal).
28 * Navigate to **App registrations → New registration**.
29 * Provide a name for the SPN (e.g., (% style="font-family:monospace" %)LakehouseDataConsumer-SPN(%%)).
30 * Set the **Supported account type** to "Accounts in this organisational directory only".
31
32 **🔧 Step 2 — Use the credentials**
33
34 A user or client tool can authenticate with a Lakehouse using a Service Principal by providing the **client ID**, **tenant ID**, and **client secret**. Once authenticated, data can be consumed programmatically. In **Python**, this is commonly done using the (% style="font-family:monospace" %)pyodbc(%%) library along with the appropriate ODBC driver for SQL Server.
35
36 === SPNs used for external sharing ===
37
38 |=SPN|=Used for
39 |**Fabric Odoo Reader**|Used by the service provider to get data from Lakehouse into **Odoo**.
40 |**Fabric AI Reader**|Used for providing data for **AI use cases** internally.
41
42 === Additional levels of security ===
43
44 * **No workspace access** — SPNs do **not** have a workspace role. They cannot view items in the workspace.
45 * **Access restricted to Lakehouse** — SPN can access only (% style="font-family:monospace" %)shared_data_lh(%%) Lakehouse, which is dedicated for external sharing.
46 * **Access restricted using security role** — Security roles further restrict which schemas/objects the SPN can read.
47
48 == API for GraphQL ==
49
50 The **API for GraphQL** in Microsoft Fabric is a **native item type** that lets us expose **structured data** from Fabric sources — Lakehouses, Warehouses, Mirrored Databases — through a **GraphQL endpoint**. It provides a **flexible, schema-aware** way to query **only the fields needed**, ideal for client applications.
51
52 === How it works ===
53
54 In an **API for GraphQL** item, you configure which tables to expose — such as those from the (% style="font-family:monospace" %)shared_data_lh(%%) Lakehouse. These tables can then be queried using **GraphQL syntax** through the API's endpoint. To access the endpoint programmatically, the query must be authenticated using **Service Principal (SPN) credentials**.
55
56 === Disadvantages of API for GraphQL ===
57
58 * **Not for bulk extraction** — GraphQL is designed for **precision querying**, not bulk extraction. Large result sets can lead to **performance bottlenecks**, **timeouts**, or **throttling**.
59 * **Pagination is supported** but **inefficient** for high-throughput data pipelines.
60 * **Microsoft's GraphQL implementation** does not yet offer the full GraphQL feature set used in other platforms.
61
62 === API for GraphQL items in telefabric ===
63
64 |=Item|=Purpose
65 |(% style="font-family:monospace" %)api_odoo_sharing(%%)|Provides data from the (% style="font-family:monospace" %)sdminvoice(%%) table to **Odoo**.
66 |(% style="font-family:monospace" %)api_sharing_dev(%%)|Used for **testing internally**. Hosted in the (% style="font-family:monospace" %)Fabric_Dev(%%) workspace.
67
68 === Additional levels of security ===
69
70 * **No Lakehouse access** — SPNs do **not** have direct access to a Lakehouse.
71 * **Access restricted to endpoint** — SPN can access only the endpoint of the API for GraphQL item.
72 * **Access restricted using security role** — API-for-GraphQL items can be restricted to query from specific schemas and objects only.
73
74 == Comparison: SPN vs. API for GraphQL ==
75
76 |=Aspect|=Service Principal (direct Lakehouse)|=API for GraphQL
77 |**Access target**|Full Lakehouse (Tables / SQL endpoint)|Single GraphQL endpoint
78 |**Authentication**|SPN credentials + ODBC driver|SPN credentials via HTTP
79 |**Best for**|Programmatic / bulk reads|Precision queries from client apps
80 |**Granularity**|Schema- and table-level|Field-level via GraphQL schema
81 |**Drawback**|Requires direct Lakehouse permission|Not suited for bulk extraction
82 |**Used in SPL by**|Fabric Odoo Reader, Fabric AI Reader|(% style="font-family:monospace" %)api_odoo_sharing(%%), (% style="font-family:monospace" %)api_sharing_dev(%%)
83
84 {{mermaid}}
85 flowchart LR
86 EXT[External system<br/>Odoo / AI consumer]
87 SPN[Service Principal<br/>SPN credentials]
88 EXT -->|"Approach A:<br/>SPN + ODBC"| LH[(shared_data_lh<br/>Lakehouse)]
89 EXT -->|"Approach B:<br/>GraphQL endpoint"| GQL[API for GraphQL]
90 GQL -.->|"reads from"| LH
91 SPN -.->|grants access| LH
92 SPN -.->|grants access| GQL
93
94 classDef ext fill:#e3f2fd,stroke:#1976d2,stroke-width:1px
95 classDef spn fill:#fff3cd,stroke:#b85c00,stroke-width:1px
96 classDef lh fill:#f4a261,stroke:#b85c00,stroke-width:1px,color:#000
97 classDef gql fill:#c8e6c9,stroke:#2e7d32,stroke-width:1px
98 class EXT ext
99 class SPN spn
100 class LH lh
101 class GQL gql
102 {{/mermaid}}
103
104 == Related pages ==
105
106 * [[Fabric (Hub)>>doc:IT-Wiki.02-Tools.Fabric.WebHome]]
107 * [[Fabric security for admins>>doc:IT-Wiki.06-Security-und-Compliance.Fabric-security-for-admins.WebHome]]
108 * [[Fabric Gold Lakehouse>>doc:IT-Wiki.01-Data.Processing.Lakehouse.Fabric-Gold-Lakehouse.WebHome]] — no shortcuts; tighter access control
109
110 ----
111
112 {{info}}
113 **Migration footer**
114 **Source:** [[Fabric external data sharing (SharePoint)>>url:https://spltele.sharepoint.com/sites/WikiPowerBI/SitePages/Fabric-external-data-sharing.aspx]]
115 **Original author:** Bukkerji Sreejith
116 **Original last-modified:** 2025-10-10
117 **Migration date:** 2026-05-24
118 **Migrated by:** Dimitri Rupp via ClaudeAI
119 **Notes:** EN-Original 1:1 (Setup-Steps, SPN-Liste, GraphQL-Items, Disadvantages); 'REFERENCE'-Marker entfernt (war Layout-Notiz); Mermaid SPN-vs-GraphQL-Architektur und Vergleichstabelle als Wissensbasis-Erweiterung.
120 {{/info}}
121
122
123 ----
124
125 == Verwandte Themen ==
126
127 {{include reference="IT-Wiki.Makros.Verwandte-Themen.WebHome"/}}
128
129 ----
130 **Status:** Migriert — Team-Review ausstehend · **Owner:** //(festlegen)// · **Letzter Review:** 2026-06-11
131