How to use service principal authentication to access Microsoft Fabric's OneLake
Published: 2023-08-17 11:00:08

---
title: How to use service principal authentication to access Microsoft Fabric's OneLake
published: true
date: 2023-08-17 08:01:43 UTC
tags: 
canonical_url: https://dataroots.io/research/contributions/how-to-use-service-principal-authentication-to-access-microsoft-fabrics-onelake
---

* * *

Microsoft recently added support to authenticate to OneLake using service principals and managed identities. This allows users to access OneLake from applications without having to use a user account. Let's see how this works.

## Enabling the feature

2 new settings in the Fabric / Power BI Admin Portal need to be enabled for this feature to work. Both can be found in the _Tenant settings_ section.

The first one is named _Allow service principals to use Power BI APIs_ and can be found under _Developer settings_. This setting allows service principals **to be given access** to OneLake and all future Microsoft Fabric APIs as well as all current Power BI APIs. Do note that this setting by itself does not grant any access. It only allows you and your organization to give access to service principals as you already could for users and groups. This can be enabled for all service principals in your Microsoft Entra ID (Azure Active Directory) tenant or only for service principals that are members of a specific group.

![](https://dataroots.ghost.io/content/images/2023/08/allow-service-principals.png)
_Allow service principals to use Power BI APIs_

The second setting can be found a bit further down under _OneLake settings_. This setting allows you to use non-Fabric applications like a Python SDK, Databricks, and more to read and write to the OneLake.

![](https://dataroots.ghost.io/content/images/2023/08/allow-fabric-external-apps.png)
_Users can access data stored in OneLake with apps external to Fabric_

## Granting access to a service principal

Now that the feature is enabled, you can grant access to a service principal or managed identity to connect to your Fabric Workspaces. Go to the Workspace you're giving access to and click on _Manage access_.

![](https://dataroots.ghost.io/content/images/2023/08/manage-access.png)
_Manage access to a Workspace_

Next, click on _+ Add people or groups_ and start typing the name of your service principal or managed identity. It should pop up in the list of suggestions. Select it and click on _Add_.

![](https://dataroots.ghost.io/content/images/2023/08/service-principal-list.png)
_Select your service principal or managed identity from the list_

Finally, decide on the level of access you'd like to grant to your service principal or managed identity. A quick overview of the possibilities there:

**Admin** : Full access to the Workspace, including the ability to delete the Workspace. You probably don't want to give this to your service principal.

**Member** : Full access to the Workspace, except for the ability to change workspace settings or add new members.

**Contributor** (recommended): The contributor can perform most tasks except for adding other members or sharing items. This is the lowest security level you need to access OneLake through the API.

**Viewer** : The viewer can only view items in the Workspace, run SQL queries, or start data pipelines. Viewers cannot access OneLake through the API.

## Example using Python

Let's see how we can use this in practice. You can create a new service principal using the Azure CLI using the command `az ad sp create-for-rbac -n "Fabricator"`. This will create a new service principal with the name _Fabricator_ and output the following information:

```
{
  "appId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "displayName": "Fabricator",
  "password": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "tenant": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
}

```

The `appId` is the client ID and the `password` is the client secret. You can use these to authenticate to OneLake using the Python SDK.

We need 2 Python packages to get started: `azure-identity` and `azure-storage-file-datalake`. You can install them using `pip install azure-identity azure-storage-file-datalake`.

In your Python code, you can now use the following code to authenticate to OneLake:

```
from azure.identity import ClientSecretCredential
from azure.storage.filedatalake import FileSystemClient

cred = ClientSecretCredential(tenant_id="<your-tenant-id>",
                              client_id="<your-client-id>",
                              client_secret="<your-client-secret>")

file_system_client = FileSystemClient(
    account_url="https://onelake.dfs.fabric.microsoft.com",
    file_system_name="<name-of-the-workspace-you-want-to-access>",
    credential=cred)
paths = file_system_client.get_paths(path="/<name-of-the-lakehouse>.Lakehouse/Tables/")
for p in paths:
    print(p.name)

```

The code above would go through all the tables in your Lakehouse and print their physical paths. These are just GUIDs and not very useful, but you can use them to access the data in your Lakehouse.

You can access your OneLake data at the following paths:

- `/<name-of-the-lakehouse>.Lakehouse/Tables/` for the tables in your Lakehouse (this also includes Shortcuts)
- `/<name-of-the-lakehouse>.Lakehouse/Files/` for the files in your Lakehouse (this also includes Shortcuts)
- `/<name-of-the-warehouse>.Warehouse/Tables/` for the tables in your Warehouse

You could now use any of the libraries you already know like Pandas, Spark, Polars, or the [Delta Lake](https://pypi.org/project/deltalake/?ref=dataroots.ghost.io) library to directly access your data.

# You might also like

[

Exploring OneLake with Microsoft Azure Storage Explorer - Sam Debruyn

Recap: OneLake & Delta Lake One of the coolest things about Microsoft Fabric is that it nicely decouples storage and compute and it is very transparent about the storage: everything ends up in the OneLake. This is a huge advantage over other data platforms since you don’t have to worry about moving…

 ![](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAAsSAAALEgHS3X78AAAAB3RJTUUH5QMTDQUuJijI6QAAAAFvck5UAc+id5oAAANWSURBVFjD7dZZiJVlGAfw33GGaWJomMzItEXbbHGGZoyiRW0RLxLypgutbiuIFiJbQCKKiGihneqiBW+CoGIIuqgkEJexxZRogbLQjJrKaLFi1Jm6eN7Pec93vnOcAaOb+cOB873b83+2//syhf8ZtUNyyuCDreeX3/UfEqg3PhPz8AWGJ0KmOYGyV1Ve1K+Zg2dwCbZjPdbiA+zCaBWZagITCWn9mjPwLBaXVu7HTryPd7ERX2OkOYHxg9txBcaSF9+n/2UM4Hmc05q1f0RaPsLd+LgwUuV1B25NCzsS66HkxRB2YB8WJs/PKnm9Bz0lAjVRI8uwqSBQqzB+OFbj9mQ8xxi+SxH5FCtxSjY/gocxiPNxGRZgFqZl617DCuyvlYx3437cgDaTw5+4F4+n6BSRPBFLcB9mpPHPcCmGc1Yz8ARuLBnfKfLfCr9gFR7NjMNefIkXsC0bPw5zGa+BWcn4laWD38MtIq8XpZCei+Pl9cOTeO7AV96yEeG92Jr2F5Huw1B7YvI0Li8ZfxM3iYKDz/EiZqfxVdnawyqN12OLqKEi6gPSx9kZM2nRK7guM15gNKXkDVHpBRag8yBp+iSlqkAvetqTZ8M4IU3sEu33Q4uQfiO6YV4aPQ3HNBCuL/A2hQAFTsKcdnyLrzIC3ThKyGmzkP4s9L4gMBMnY0cTFe0VaZ6djfVg7jTRPttKE32VQRw/fB8+zGY6cS0WYXpp13lYgwuzsTFRT+uKgtgipLLAQIPRRqU8umRoBd7CO0ILlgkpf1nUWU7+EdyB3YUQ9QuZLdhvxNIUnTK6cI9ozw7NMSLatysb+xsPCLUcgTYrlxB9uhzHZmmYnkK1JyPSg4dEG+Y6MKpeaqX5nOAfQuIfk4lVccivQtv70/cRycPrRYFuwLoU1qtKhtaLd8B88RY4U+NFtDuF/CVFqlNxFwTGxDV5TWljZzp4viiyspdvi3tje/ruFm+DRULrB1J0b8OrB3ZlnZWHcVC0yWKcnqKQo2z8ddws9KDA79icfk/hVNH/W6uMU30dH5k8vjj9+ozfYgXWCCn+qeHgVq+pCk2pHWRTV/JioZDrfnFHrMZvrQ6eKBqfZHdezQW9VWs7xK35I/46FMarCZQxyZBOYQqTxb9fddW1INHowAAAACV0RVh0ZGF0ZTpjcmVhdGUAMjAyMS0wMy0xOVQxMzowNTo0NiswMDowMMNJPDoAAAAldEVYdGRhdGU6bW9kaWZ5ADIwMjEtMDMtMTlUMTM6MDU6NDYrMDA6MDCyFISGAAAAAElFTkSuQmCC)dataroots

 ![](https://dataroots.io/static/81d84eed5469bfaf24d182acb38897d7/f3583/ase_logo.png)
](https://dataroots.io/research/contributions/exploring-onelake-with-microsoft-azure-storage-explorer/?ref=dataroots.ghost.io)