Microsoft says OneLake external-location support for Azure Databricks Unity Catalog is generally available from the Fabric side, allowing supported Unity Catalog-managed data to be stored directly in OneLake. The change affects teams that run Microsoft Fabric and Azure Databricks together, because it reduces the need to copy data between storage locations or maintain synchronisation pipelines only to serve different platforms.
What changed
The release builds on the earlier beta for OneLake external-location support in Unity Catalog. Microsoft now enables OneLake Security by default for Azure Databricks Storage items, so administrators can control which approved identities can discover, read or write data in OneLake.
Supported Azure Databricks workloads can create Unity Catalog-managed data directly in OneLake. A Unity Catalog external location points to an Azure Databricks Storage item in OneLake, and a catalog or schema can use that external location as managed storage.
Azure Databricks remains the environment for Databricks compute and Unity Catalog management. Fabric provides the capacity-backed workspace and Azure Databricks Storage item, while OneLake provides the storage location and Fabric-side access controls.
Teams can continue to use Azure Databricks and Unity Catalog to create and manage supported managed tables, volumes, views, materialized views and streaming tables. The objects remain managed through the Azure Databricks experience, while the supported underlying data is stored in OneLake.
Setup requirements
The setup starts in Fabric with a capacity-backed workspace and an Azure Databricks Storage item. Administrators then configure an Access Connector for Azure Databricks with a managed identity, or use an approved service principal, and grant the identity the required Fabric access and OneLake Security permissions.
On the Databricks side, administrators create a storage credential for that identity and then create a OneLake external location pointing to the Azure Databricks Storage item. The path must use the ID-based ABFSS format with workspace and storage item identifiers, not display names.
The documented prerequisites include a Unity Catalog-enabled Azure Databricks workspace and serverless compute or classic compute on Databricks Runtime 18.1 or above. The administrator also needs CREATE STORAGE CREDENTIAL privilege on the Unity Catalog metastore, and CREATE EXTERNAL LOCATION privilege on both the metastore and the storage credential.
In Fabric, the workspace must have active capacity assigned. The managed identity or service principal must have the Viewer role on the target Fabric workspace and must be a member of a OneLake security role on the Azure Databricks Storage item. A Fabric administrator must also enable Users can create Azure Databricks Storage items, and the target workspace must have Authenticate with OneLake user-delegated SAS tokens enabled.
Security model
A shared storage location does not create a single permission model. Administrators must configure access in both Azure Databricks and Microsoft Fabric so that users and workloads can reach only the objects and data they require.
OneLake Security is enabled by default for the Azure Databricks Storage item, and the item is locked. Fabric workspace roles such as Administrator, Member, Contributor and Viewer do not grant access to its data. Only members of the storage item’s OneLake security role can read or write it.
The guidance is to add only the access connector’s managed identity or the relevant service principal to the OneLake security role. Adding users, groups or other service principals would allow them to read and write the data directly, outside Unity Catalog governance. Fabric users should read the data through a mirrored Azure Databricks catalog item rather than through the storage item itself.
Limits and current status
The Fabric announcement presents the support as generally available from the Microsoft Fabric side. Azure Databricks release notes for 2 November 2026 listed OneLake external locations as Public Preview, and the Azure Databricks setup documentation still refers to the Previews page for workspace administrators.
There are functional limits to plan for. Fabric Spark, including Fabric notebooks and Spark job definitions, cannot read tables with catalog commits through a mirrored Azure Databricks catalog. The documented workaround is to turn off catalog commits on tables that Fabric Spark workloads need to read, but doing so also turns off the features that depend on catalog commits for that table.
Databricks-to-Open sharing is not supported for managed tables whose storage is on OneLake, because OneLake storage paths do not support pre-signed URLs. Fabric also does not recognise the FILE type, so FILE columns are omitted from mirrored Azure Databricks catalogs, while the other columns are still mirrored.
OneLake paths do not support file event notifications. A skipped file events warning during connection testing is expected and does not mean that the external location has failed.
Using OneLake as managed storage for Unity Catalog objects changes where Fabric and Databricks teams place data, how they separate permissions and how analytics workloads consume it, which is the kind of architecture ECS's Data topic examines alongside Microsoft Fabric, Power BI, SQL Server and Dataverse. The programme gives attendees sessions and practitioner experience on Fabric architecture, data governance and analytics deployments, with room to compare implementation choices with peers. Attend with the tenant, capacity and identity questions that are difficult to settle from documentation alone.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.