Skip to content

Connectivity

This page explains how workspaces reach data sources: the connection types the platform creates for you, what you must provide, and the outbound rules around them. For the network design behind it, see Architecture.

Reference design, your deployment may differ

Connection types and defaults below are those of the solution code. Ask your platform team which are enabled.

Two ways to reach a source

Way Use it when How it works
VNet data gateway The source is in the spoke network, or on-premises through ExpressRoute or VPN Fabric connections are configured to use the gateway of the environment. The workspace may only use that gateway.
Managed private endpoint The source is an Azure resource that supports Private Link (for example Storage or SQL), or another Fabric workspace A direct private connection per resource. It usually does not use the gateway.

Outbound traffic of a workspace is blocked by default. It leaves only through the gateway or a managed private endpoint (see Workspace network policy).

Connections through the gateway

All connections below use the connectivity type VirtualNetworkGateway and the gateway of the workspace's capacity. The display name of a connection is the key you choose in the configuration. The credentials are read from the Key Vault of the spoke by secret name when the pipeline runs. They are never stored in the repository.

Type Authentication What you provide
ADLS Service principal with client secret Container name, and the names of the secrets that hold the client ID and the client secret
SQL (service principal) Service principal with client secret Server, database, and the names of the secrets for client ID and client secret
SQL (basic) Username and password, for databases that use SQL authentication Server, database, and the names of the secrets for username and password
Oracle Cloud Storage Basic (username and password) API endpoint, and the names of the secrets for username and password

Notes:

  • The ADLS connection points at a container of the environment's own data lake storage account (the DFS endpoint). The platform creates the container for each ADLS connection. The service principal in the secrets needs access to the storage account, which is arranged outside this solution.
  • For SQL with a service principal (and for other Entra ID based sources) the service principal needs access to the source. The platform does not grant it. By default the service principal of the spoke is used, but you can reference a separate one through the secret names.
  • Only the connection types above are created by the solution. The repository also holds a reference export from the Fabric API of the connection types that Fabric lists as supported for a VNet data gateway (docs/reference/fabric_vnet_connection_types.json in the solution repository). Use it to check whether a type could be added, which would be a development change.
  • The gateway sleeps after 30 minutes of inactivity and wakes on the next request.
  • Connection usage rights are given to groups, see Access and roles.

Workspace to workspace

A workspace-to-workspace connection creates a managed private endpoint from one workspace to another workspace of the platform (through the Private Link Service of the target workspace). With it, Lakehouses and Warehouses of the other workspace can be used. For each such connection the platform also adds the target workspace to the allowed list of outbound cloud connections of the source workspace for the connection types LakeHouse and Warehouse, with the default action Deny and Power BI semantic models allowed.

The allowed list only works with outbound protection on

Fabric enforces these connection rules only when the outbound default action of the workspace is Deny. With outbound protection off the call returns 403, the deployment skips the step and the rules are not enforced. See Workspace network policy.

Managed private endpoints to Azure resources

You provide the resource ID of the target and the sub-resource type (for example blob or dfs for a storage account). The endpoint is created in the workspace with the name pe-<workspace name>-<key>.

Git integration

A workspace can be linked to a Git repository for version control. The solution supports GitHub (including a custom GitHub domain).

Item Value
Configuration Owner, repository, branch and directory. The directory must exist in the repository.
Credential A personal access token that is read from a Key Vault secret with a fixed name (GitHub-PAT) in the spoke Key Vault
Connection A Fabric connection of type GitHubSourceControl through the VNet data gateway, privacy level Private
Initial sync The workspace content wins (PreferWorkspace)
Network A named outbound exception for Git, applied only to workspaces with a Git link and outbound protection on
Tenant setting GitHub access must be enabled in the Fabric admin portal (Prerequisites)

In the basic setup only the development workspace has a Git link. Production workspaces are deployed through CI/CD pipelines. Removing the Git link from the configuration disconnects Git from the workspace.

Developer access

Developers reach the workspaces through VPN or ExpressRoute. Without a connection to the platform network there is no path to the workspace.

Request

Add, change or delete a connection through Request and change. Mention the environment, the workspace, the source, and for credentials the names of the secrets (never the values).