OneLake – External Data Sharing

Posted by Jens Vestergaard on in Programming 1 Comment

At #MSIgnite Microsoft announced a new feature in Fabric that allows people from one organization to share data with people from another organization. You might ask yourself why is this even news, and rightly so. Up until last week, professionals have had to use tools like (S)FTP clients like FileZilla, Azure Storage Explorer, WeTransfer or similar products in order to share data. Some of these tools are in fact hard to use and/or understand for a great number of business users – they are familiar with Windows and the Office suite and not much more. This is all to be expected, as business users in general should focus on business stuff rather than IT stuff.

As of last week this picture has changed quite dramatically as Microsoft has introduced what they refer to as External Data Sharing in Microsoft Fabric. Even though this new feature involves some configuration from the IT department, once it’s setup the end user can actually be allowed to share data with external organizations through what looks to be the File Explorer! šŸ”„ At least it looks like the File Explorer, but is in fact another application end users will need to install on top, to enable this functionality. The tool is called OneLake File Explorer and is obviously a file explorer for OneLake in Microsoft Fabric. In the following diagram, Microsoft demonstrates the feature and even underlines that no data is copied from one tenant to the other – all data is shared in-place.

External data sharing in Microsoft Fabric – Microsoft Fabric | Microsoft Learn

Think about it just one more time – The end user will be able to, on their own device, copy and paste data from local folders to OneLake synchronized folders (also on their own device) which then gets synchronized to another tenant. The tool works just like the OneDrive application, which means that it keeps files in synch between your device and OneLake.

Admin Settings in Tenant A

Configuring the functionality requires the sharing organizations (Tenant A) to toggle a settings in their Fabric Admin section.

The setting “External Data Sharing” should be allowed, and it is recommended that this is allowed only to a specific security group for easier management of access through the IT department.

As per screenshot above, members of the security group “CatMan” are the only ones who are allowed to share externally. One note that is highlighted in the yellow box might be worth considering before using this feature.

The functionality will work, even if the receiving organization (Tenant B) does not allow sharing as described above.

Sharing from Tenant A

Suppose you already have a lakehouse in Microsoft Fabric, (otherwise here’s a great introduction on how to create that), and you want to share files or tables with an external business user or it-professional. Then the following steps will allow you just to do that.

I have uploaded my Important Business Numbers.xlsx spreadsheet in my folder File_Share. I need this file for my critical workloads in my BI analysis but I also want to share these numbers with a professional outside my organization.

From inside the workspace in Tenant A I can now (due to the configuration in the admin portal) choose to share data externally by clicking the three dots (…) on the lakehouse in question.

Choosing this option guides me to a wizard where I get to select what data items I would like to share. The supported item types are data residing in tables or files in lakehouses and mirrored databases.

In this case, I choose to share an entire folder named File_Share.

Clicking ‘Save and Continue‘ leads me to a new dialog, where I get to assign who I want to share this data with. Sharing in this way does NOT require Entra B2B guest user access but is relying on a dedicated Fabric-to-Fabric authentication mechanism. Also note that the sharer from Tenant A can’t control who has access to the data in Tenant B. Access can even be granted to guest users of Tenant B.

In this example the sharer can either choose to send the grant as an email, copy the link and send that through Teams or other option. The intended receive has 90 days to accept the invitation, after which the invitation expires.

Accepting share from Tenant B

In order for the user in Tenant B to accept the share, they have to have access to a lakehouse that becomes the target of the share. Please see link to setup a lakehouse.

Here the user Testy McTestify has created a workspace in Tenant B and also created a lakehouse called Tenant_B_Lakehouse.

Testy can now accept the share in more than one way, either by mail by clicking an accept button that directs him to the fabric portal where you will be guided through the next steps in accepting the invitation. Or Testy can simply click or paste in the link in a browser and begin the same journey as above. Either way, the below screen will be presented once authorization has completed.

Testy McTestify is a user in the domain @catmansolution.com (Tenant B) and the invite was sent from Tenant A which is @catman.bi – this information is also present in the dialog, along with details on what is shared.

Now Testy has to select the lakehouse that will house the referenced folder (in this case). Here Testy chooses Tenant_B_Lakehouse.

And the final step is to place the shared folder in the files hierarchy that exists in Tenant_B_Lakehouse, and here Testy just places the folder in the root.

Two notifications will pop up and inform you on the relevant actions taken.

As soon as that process is completed (within seconds) the files from the folder in Tenant A are available as if present in Tenant B

OneLake Explorer

Installing OneLake Explorer will allow Testy McTestify to access the same files and folders synchronized on his device. This is, as you can imagine, immensely powerful as almost every business user knows how to operate Windows File Explorer and OneDrive on their device – this is right up their alley and not some odd third party product that IT needs to whitelist for them alone. Chances are that OneLake Explorer is already in use in the organization and no further action from IT is needed.

I simply love the potential of this new feature that I feel has traveled well below the radar, covered by all the AI and CoPilot noise over the last couple of weeks.

Loading

Unexplainable behavior’s with DefaultAzureCredential()

Posted by Jens Vestergaard on in Programming 0 Comment

Long story, short (2 days later)

While implementing an Azure Function that is designed to fetch secrets from Azure KeyVault, I ran into a funny and odd issue. I am not able to explain why and what is going on, but I have tried every trick a google search can conjure, at least until page 30 in the search results. It was by coincidence I came across some of the parameters in the DefaultAzureCredentialOptions class that got me going, at least locally.

The idea, as far as I have understood, is that whenever you invoke the Azure.Identity.DefaultAureCredential class, it provides a flow for attempting authentication using one of the following credentials, in listed order:

I suspect that since I have deployed my Azure Function using the Managed Identity setting to a Systems Assigned identity, like this:

System Assigned Identity

AND the fact that ManagedIdentityCredential is before VisualStudioCredential in the authentication flow, it fails, since it is unable to authenticate the managed identity – which is the main principle of the design – none other than the service can assume the identity of the service.

See more detail here: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
Snip

  • System-assigned. Some Azure resources, such as virtual machines allow you to enable a managed identity directly on the resource. When you enable a system-assigned managed identity:
    • A service principal of a special type is created in Azure AD for the identity. The service principal is tied to the lifecycle of that Azure resource. When the Azure resource is deleted, Azure automatically deletes the service principal for you.
    • By design, only that Azure resource can use this identity to request tokens from Azure AD.
    • You authorize the managed identity to have access to one or more services.
    • The name of the system-assigned service principal is always the same as the name of the Azure resource it is created for. For a deployment slot, the name of its system-assigned identity isĀ <app-name>/slots/<slot-name>.

Love rears it’s ugly head

Having assigned the proper permissions in the Azure KeyVault, you are able to connect using your credentials in Visual Studio to said KeyVault. A code example of that could look like this:

publicĀ staticĀ stringĀ GetSecret(Ā stringĀ keyvault,Ā stringĀ secretĀ )
{Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 
Ā Ā Ā varĀ kvUriĀ =Ā $"https://{keyvault}.vault.azure.net";
 
Ā Ā Ā varĀ credsĀ =Ā newĀ DefaultAzureCredential();
 
Ā Ā Ā varĀ clientĀ =Ā newĀ SecretClient(newĀ Uri(kvUri),Ā creds);
Ā Ā Ā varĀ secretĀ =Ā client.GetSecretAsync(secret).Result.Value.Value;
 
Ā Ā Ā returnĀ secret;
}

(link to NuGet: NuGet Gallery | Azure.Security.KeyVault.Secrets 4.5.0)

Usually this works, and I have no other explanation than having deployed the solution to a live running App Service is what breaks this otherwise elegant piece of code. The above listed code does not work for me.

Workaround

You can instantiate the DefaultAzureCredential class using a constructor that takes a DefaultAzureCredentialOptions object as a parameter and this object has a great number of attributes that are of interest. You can actively remove items in the authentication flow and you can specify the tenant id, if you have access to multiple tenants.

The code that resolved the issue locally looks something like this. (I can probably just do without the ManagedIdentity, will test)

publicĀ staticĀ stringĀ GetSecret(Ā stringĀ keyvault,Ā stringĀ secretĀ )
{Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā Ā 
Ā Ā Ā varĀ kvUriĀ =Ā $"https://{keyvault}.vault.azure.net";
 
 
Ā Ā Ā Ā varĀ credsĀ =Ā newĀ DefaultAzureCredential(
Ā Ā Ā Ā Ā Ā Ā Ā newĀ DefaultAzureCredentialOptions()Ā {
Ā Ā Ā Ā Ā Ā Ā Ā TenantIdĀ =Ā "<INSERT TENANT ID HERE>"
Ā Ā Ā Ā Ā Ā Ā Ā ,Ā ExcludeAzureCliCredentialĀ =Ā true
Ā Ā Ā Ā Ā Ā Ā Ā ,Ā ExcludeAzurePowerShellCredentialĀ =Ā true
Ā Ā Ā Ā Ā Ā Ā Ā ,Ā ExcludeSharedTokenCacheCredentialĀ =Ā true
Ā Ā Ā Ā Ā Ā Ā Ā ,Ā ExcludeVisualStudioCodeCredentialĀ =Ā true
Ā Ā Ā Ā Ā Ā Ā Ā ,Ā ExcludeEnvironmentCredentialĀ =Ā true
Ā Ā Ā Ā Ā Ā Ā Ā ,Ā ExcludeManagedIdentityCredentialĀ =Ā true
Ā Ā Ā Ā });
 
 
Ā Ā Ā Ā varĀ clientĀ =Ā newĀ SecretClient(newĀ Uri(kvUri),Ā creds);
Ā Ā Ā varĀ secretĀ =Ā client.GetSecretAsync(secret).Result.Value.Value;
 
Ā Ā Ā returnĀ secret;
}

I am not sure this will work when I deploy the solution, but I will probably create a test on environment (local debug or running prod)

HTH

Loading

Are you Dino or Carl?

Posted by Jens Vestergaard on in Community 0 Comment

If you are new to IT you might not yet have become aware that the tech stack is ever changing. I’ve been around long enough to have seen my share of DOS, Windows and also SQL server editions, but what is not immediately apparent is that this forces the people in the industry to, at some point, make a choice; become a dinosaur or adapt.

If your choice is dinosaur, you will probably be fighting to keep the workloads coming as time passes by. At best it’s a bit of a gamble, to put all your eggs into one basket so to speak. Tech changes and so will demand for the one tech you have mastered to perfection. Albeit the upside of the gamble is that little to no-one knows the tech in question which means you can ask a higher price for your services.

On the other hand Carl Lewis’s accomplishments is actually a great image of how the modern IT worker has to spread the interest on more than one tech. Carl Lewis was a childhood hero of mine and among other astonishing merits he was undefeated for a period of seven years (7) in long jump (still has the world record indoor) – but many remember him for his incredible performances in 100m and 200m dash. This just helps build the image that I am trying to convey here – modern IT people will almost certainly be specialised in more that one tech – or this particular tech evolves into something new.

So, which one is it? Dino or Carl?

source: See the exhibition, The First Dinosaur at GeoCenter MĆøns Klint (moensklint.dk)
source: Eliud Kipchoge ā€“ Latest Sports News Africa | Latest Sports Results (sportsleo.com)

But what’s my point with this?

source: YARN | Walter, what’s the point? | The Big Lebowski | Video gifs by quotes | 4dd14554 | ē“— (getyarn.io)

On September 11th in 2020 I passed the AZ-400 test to become a Microsoft Certified: Azure DevOps Engineer Expert and as this is an Expert level certification, Microsoft requires this certification to be renewed within a specified amount of time. Microsoft operates with four levels of certification.

Fundamentals (ā­) which cannot be renewed and do not expire,

Associate (ā­ā­), Expert (ā­ā­ā­) and Speciality (no stars) which expires after one (1) year*
*) except if taken before June 30th 2021 – then validity lasts two (2) years

In a month from now, at the time of writing, I would no longer be allowed to flash that I am a certified Azure DevOps Engineer, unless… unless I renew the certification. Certification renewals is something fairly new to the Microsoft certification program and I must say I welcome the opportunity given by Microsoft to update your accolades for free. Yes, for free.

90 days (and 30 days) or so in advance, Microsoft sends a notification, that your certification will expire unless you renew it. The process of renewing is really simple and it all comes down to you and how updated your skills are on the subject. One of the smart things about renewals is that Microsoft gets to test your knowledge on features and tech added to its services since you first took the test. And this could potentially be a lot of new ground to cover. Even though Microsoft aquired Github back in the summer of 2018, there has been put in a lot of work to inhale Github into the Microsoft stack – much of this work has surfaced since I took the test initially, so the renewal test has a lot more questions on Github – which makes so much sense.

The email you receive would look similar to this one, except of course time and type of certification would be different:

All you have to do is click the link, log in with your Microsoft Learn account and off you go.

It could be that the number of questions vary, but I have had a two (2) renewals lately and both consisted of about 25 questions. There have been no cases like in the real tests, hence just 25 individual questions on tech stuff related to the overall topic of the certification. Also, all of my question have been multiple choice/single answer – meaning no multiple possible answers/ranking of tasks to perform or code to complete. But I am sure they are working on getting that in there.

Once you’ve completed all questions you will be directed to either a pass or fail page (unfortunately I didn’t screen grab that when I failed the AZ-400 renewal the first time, so I am not able to display how that look). Microsoft Learn even provides you with a collection of learning materials (from Microsoft Learn) that fits your weak areas so you can concentrate on getting that up to speed- this is very helpful!

If you pass, the resulting page looks something like this

There is also an explanation on the various areas of the test and how you performed in those categories:

This one is from my DA-100 renewal which is now outdated and superseded by PL-300

Final thoughts

Having a history of every other year having to take on new certifications, even in the same tech space, I really welcome the idea of certification renewals. For instance I have SQL Server 2005, 2008 and 2016 certifications but, at least in my mind, it makes a lot more sense to be able to communicate that I am certified in SQL Server and the certification is up to date, for instance with the Azure SQL Server Administrator certification – no editions attached – it’s just active or not. This goes for any technology/role that manages to stick around and evolve.

Best of luck to all you out there who are either renewing or taking on new exams.

Loading

2.000 members milestone

Posted by Jens Vestergaard on in Community 0 Comment

It’s only been a couple of months since I took over the reins from co-partner Erik Svensen (t|l) for the Danish Power BI User Group. But even just a few months in, I see and appreciate all the hard work and effort Erik has put into this user group. It’s because of Erik’s relentless efforts over the past four-five years that I can now announce that the user group has 2.000 members!

Bravo Erik – Well done!

Loading

New Microsoft certifications passed

Posted by Jens Vestergaard on in Programming 0 Comment

This summer my family and I spent almost three weeks driving to Germany and into Italy by car. Not just any car I might add. The old Volvo clicked in 4.000 km and handled it like a charm šŸ„° even when it was super packed for the final stage of the journey from the duty free shop just across the border.

Main cities visited NĆ¼rnberg, Venice, Bologna, Brisighella, Comacchio… and obviously I had to make a stop at the Mutti field of tomatoes, as Mutti is a client of ours šŸ™‚

Assorted Pictures from the vacation

Just before the vacation began, I got notice, that I had passed the two beta exams I attended in the middle of May. With beta exams you do not get the passing score immediately, you have to wait ’till the program has collected enough data on the individual questions/answers to release the final version of the test.

Microsoft Power Automate RPA Developer (PL-500)

First of I passed the Microsoft Power Automate RPA Developer (PL-500) exam, which was quite a stretch for me, and I had even raised some concerns about the scope of the test before, in the below announcement on LinkedIn:

Candidates for this exam automate time-consuming and repetitive tasks by using Microsoft Power Automate (formerly known as Flow). They review solution requirements, create process documentation, and design, develop, troubleshoot, and evaluate solutions.

Candidates work with business stakeholders to improve and automate business workflows. They collaborate with administrators to deploy solutions to production environments, and they support solutions.

Additionally, candidates should have experience with JSON, cloud flows and desktop flows, integrating solutions with REST and SOAP services, analyzing data by using Microsoft Excel, VBScript, Visual Basic for Applications (VBA), HTML, JavaScript, one or more programming languages, and the Microsoft Power Platform suite of tools (AI Builder, Power Apps, Dataverse, and Power Virtual Agents).

 Important

Passing score: 700.Ā Learn more about exam scores. (which is exactly what I scored šŸ˜)

Part of the requirements for:Ā Microsoft Certified: Power Automate RPA Developer Associate

The detailed skills are outlined here: Exam PL-500: Microsoft Power Automate RPA Developer ā€“ Skills Measured

Designing and Implementing Enterprise-Scale Analytics Solutions Using Microsoft Azure and Microsoft Power BI (DP-500)

Candidates for this exam should have advanced Power BI skills, including managing data repositories and data processing in the cloud and on-premises, along with using Power Query and Data Analysis Expressions (DAX). They should also be proficient in consuming data from Azure Synapse Analytics and should have experience querying relational databases, analyzing data by using Transact-SQL (T-SQL), and visualizing data.

 Important

Passing score: 700. Learn more about exam scores.

 Tip

Part of the requirements for:Ā Microsoft Certified: Azure Enterprise Data Analyst Associate

Active certifications

New/Renewed 2022

Other Active Certifications

Loading