OneLake – External Data Sharing

At #MSIgnite Microsoft announced a new feature in Fabric that allows people from one organization to share data with people from another organization. You might ask yourself why is this even news, and rightly so. Up until last week, professionals have had to use tools like (S)FTP clients like FileZilla, Azure Storage Explorer, WeTransfer or similar products in order to share data. Some of these tools are in fact hard to use and/or understand for a great number of business users – they are familiar with Windows and the Office suite and not much more. This is all to be expected, as business users in general should focus on business stuff rather than IT stuff.

As of last week this picture has changed quite dramatically as Microsoft has introduced what they refer to as External Data Sharing in Microsoft Fabric. Even though this new feature involves some configuration from the IT department, once it’s setup the end user can actually be allowed to share data with external organizations through what looks to be the File Explorer! 🔥 At least it looks like the File Explorer, but is in fact another application end users will need to install on top, to enable this functionality. The tool is called OneLake File Explorer and is obviously a file explorer for OneLake in Microsoft Fabric. In the following diagram, Microsoft demonstrates the feature and even underlines that no data is copied from one tenant to the other – all data is shared in-place.

Think about it just one more time – The end user will be able to, on their own device, copy and paste data from local folders to OneLake synchronized folders (also on their own device) which then gets synchronized to another tenant. The tool works just like the OneDrive application, which means that it keeps files in synch between your device and OneLake.

Admin Settings in Tenant A

Configuring the functionality requires the sharing organizations (Tenant A) to toggle a settings in their Fabric Admin section.

The setting “External Data Sharing” should be allowed, and it is recommended that this is allowed only to a specific security group for easier management of access through the IT department.

As per screenshot above, members of the security group “CatMan” are the only ones who are allowed to share externally. One note that is highlighted in the yellow box might be worth considering before using this feature.

The functionality will work, even if the receiving organization (Tenant B) does not allow sharing as described above.

Sharing from Tenant A

Suppose you already have a lakehouse in Microsoft Fabric, (otherwise here’s a great introduction on how to create that), and you want to share files or tables with an external business user or it-professional. Then the following steps will allow you just to do that.

I have uploaded my Important Business Numbers.xlsx spreadsheet in my folder File_Share. I need this file for my critical workloads in my BI analysis but I also want to share these numbers with a professional outside my organization.

From inside the workspace in Tenant A I can now (due to the configuration in the admin portal) choose to share data externally by clicking the three dots (…) on the lakehouse in question.

Choosing this option guides me to a wizard where I get to select what data items I would like to share. The supported item types are data residing in tables or files in lakehouses and mirrored databases.

In this case, I choose to share an entire folder named File_Share.

Clicking ‘Save and Continue‘ leads me to a new dialog, where I get to assign who I want to share this data with. Sharing in this way does NOT require Entra B2B guest user access but is relying on a dedicated Fabric-to-Fabric authentication mechanism. Also note that the sharer from Tenant A can’t control who has access to the data in Tenant B. Access can even be granted to guest users of Tenant B.

In this example the sharer can either choose to send the grant as an email, copy the link and send that through Teams or other option. The intended receive has 90 days to accept the invitation, after which the invitation expires.

Accepting share from Tenant B

In order for the user in Tenant B to accept the share, they have to have access to a lakehouse that becomes the target of the share. Please see link to setup a lakehouse.

Here the user Testy McTestify has created a workspace in Tenant B and also created a lakehouse called Tenant_B_Lakehouse.

Testy can now accept the share in more than one way, either by mail by clicking an accept button that directs him to the fabric portal where you will be guided through the next steps in accepting the invitation. Or Testy can simply click or paste in the link in a browser and begin the same journey as above. Either way, the below screen will be presented once authorization has completed.

Testy McTestify is a user in the domain @catmansolution.com (Tenant B) and the invite was sent from Tenant A which is @catman.bi – this information is also present in the dialog, along with details on what is shared.

Now Testy has to select the lakehouse that will house the referenced folder (in this case). Here Testy chooses Tenant_B_Lakehouse.

And the final step is to place the shared folder in the files hierarchy that exists in Tenant_B_Lakehouse, and here Testy just places the folder in the root.

Two notifications will pop up and inform you on the relevant actions taken.

As soon as that process is completed (within seconds) the files from the folder in Tenant A are available as if present in Tenant B

OneLake Explorer

Installing OneLake Explorer will allow Testy McTestify to access the same files and folders synchronized on his device. This is, as you can imagine, immensely powerful as almost every business user knows how to operate Windows File Explorer and OneDrive on their device – this is right up their alley and not some odd third party product that IT needs to whitelist for them alone. Chances are that OneLake Explorer is already in use in the organization and no further action from IT is needed.

I simply love the potential of this new feature that I feel has traveled well below the radar, covered by all the AI and CoPilot noise over the last couple of weeks.