Edit

Connect to a Microsoft Fabric workspace with inbound access protection enabled

Microsoft Fabric provides inbound access protection for organizations that require enhanced control over connections to a workspace. You can connect Dynamics 365 Customer Insights - Data to a Microsoft Fabric OneLake workspace when Inbound Access Protection is enabled.

Inbound access protection helps secure Microsoft Fabric workspaces by restricting access from the public internet. When enabled, public endpoints are disabled, and services such as Customer Insights - Data must connect through Private Link.

Learn more:

When inbound access protection is on, public OneLake endpoints are blocked. To allow access, you must create and validate a workspace-level Private Link in Azure, then complete the data source connection in Customer Insights - Data.

Prerequisites

Before you connect Customer Insights - Data to a Microsoft Fabric OneLake workspace, ensure that:

To use a Microsoft Fabric workspace with inbound access protection enabled in Customer Insights - Data, create a Private Link and have an Azure administrator approve the pending private endpoint connections.

  1. In Customer Insights - Data, go to Data > Data sources.

  2. Select Add a data source.

  3. Select Microsoft Fabric OneLake.

  4. Select the Enable Azure Private Link checkbox.

    Screenshot of adding Fabric OneLake using a Private Link.

  5. In the Fabric workspace Private Link dropdown, select the Fabric Private Link service resource in Azure that corresponds to the workspace. The Azure administrator creates and names the Private Link service specifically for each workspace, so the name should clearly associate with the workspace name.

  6. Select Create Private Link.

Step 2: Approve pending endpoint connections

An Azure administrator must approve pending Private Link requests. Ask your Azure administrator to:

  1. Open the Azure portal.

  2. Go to Network Foundation.

  3. Select Pending connections.

  4. Find the two pending private endpoint requests.

  5. Approve both connections.

Users can't use the Private Link until you approve both endpoint connections.

  1. Return to the Fabric Private Link configuration page.

  2. Select Validate Private Link.

  3. Verify that validation succeeds.

Important

Changes can take several minutes to propagate after you approve the endpoint connections. If validation initially fails, wait a few minutes and try again.

Connect to the workspace in Customer Insights - Data

After the Private Link validates successfully, connect to Microsoft Fabric OneLake to ingest data from the workspace. For more information, see Connect to Microsoft Fabric OneLake.

Troubleshooting

If you don't see a Private Link service for the workspace, you might not have created the Private Link service in Azure, or you might not have access to the resource.

Contact your Azure administrator to create the Private Link service or give you access as appropriate. For more information, see Step 2: Create the Private Link service in Azure.

Verify that:

  • Both pending endpoint connections are approved.

  • The approved connections have sufficient time to propagate.

  • The workspace Private Link is created successfully.

The table list appears hung during refresh, or appears empty

An empty table list indicates that Customer Insights - Data doesn't have permission to access or read the contents of the workspace. Verify that:

  • The Customer Insights - Data service principal has the required workspace permissions.
  • The Fabric tenant setting for external access to OneLake data is enabled.
  • The Private Link is successfully validated.
  • Last updated on