Creating a connection to Microsoft Fabric OneLake

Set up a connection between Data Integration and Microsoft Fabric OneLake as a target by entering your Fabric credentials and, optionally, configuring your own file zone for staging.

Prerequisites

Before you begin, ensure that you have:

• A Fabric workspace and a Lakehouse that you want to load data into.
• An active Fabric capacity assigned to the workspace. A paused capacity blocks data loads.
• Your Microsoft Entra (Azure AD) Tenant ID.
• Depending on the authentication type you plan to use:
  • OAuth 2.0: A Microsoft account with access to the target Fabric workspace.
  • Service Principal: A Microsoft Entra app registration with a Client ID and Client Secret, and access to the target Fabric workspace.

For more information, refer to Register a Microsoft Entra app and create a service principal, Give users access to workspaces, and Roles in workspaces.

Step 1: Create a Microsoft Fabric OneLake connection

1. In the Data Integration console, navigate to Connections > New Connection and select Microsoft Fabric OneLake (Target).
2. Enter a Connection Name.
3. Under Authentication Type, select OAuth 2.0 or Service Principal.
4. Enter your Tenant ID. This field is required for both authentication types.
5. Depending on your authentication type:
   • OAuth 2.0: Click Connect with Microsoft Fabric, and sign in with a Microsoft account that has access to the target workspace.
   • Service Principal: Enter the Client ID and Client Secret from your Microsoft Entra app registration.
6. Click Test Connection to confirm Data Integration can reach your Fabric workspace.
7. Click Save.

Step 2: Configure a file zone (optional)

By default, Data Integration stages your data using its own managed file zone. To stage data in storage you manage instead, turn on Custom File Zone and configure the following:

1. Select Amazon S3 or Azure Blob Storage as the file zone type.
2. Select an existing FileZone Connection, or create a new one for your storage account.
3. Select or enter the Default Bucket to use for staging.

Permissions required at each phase

The user or service principal you authenticate with needs different Fabric access at different points in setup. Grant each role before you reach the phase that needs it.

Phase	Required Fabric access	Why it is needed
Service Principal app registration (Service Principal only, before Step 1)	Admin consent granted for the app registration's API permissions	The service principal cannot acquire an access token until an admin consents in Microsoft Entra ID.
Testing the connection (Step 1)	Workspace Viewer role on at least one Fabric workspace	Lets Data Integration list workspaces and confirm it can reach Fabric.
Selecting a Workspace and Lakehouse on the Target tab	Workspace Viewer role on the target workspace	Populates the Workspace and Lakehouse drop-down lists.
Running a load, in any loading mode	Workspace Contributor role on the target workspace	Required for Data Integration to trigger the Fabric Spark job that performs the load.
Writing data to the target Lakehouse, in any loading mode	Lakehouse Contributor role on the target Lakehouse	Grants write and list access to the Lakehouse's /Files and /Tables areas.
Reading staged data, in any loading mode	Read access on the file zone storage account	Fabric Spark reads the staged file through the OneLake Shortcut before writing it to the table.
Using the Merge loading mode	Read access on the target Lakehouse, in addition to the access above	Merge additionally reads the existing table to determine which rows to insert or update.
Using the Overwrite or Merge loading mode	Delete access on the target Lakehouse, in addition to the access above	Both modes remove or replace existing Parquet files as part of the load.

For more information, refer to Roles in workspaces, Give users access to workspaces, and Register a Microsoft Entra app and create a service principal.