Forum Discussion
Cross-Tenant Purview Scan of Fabric Lakehouse fails to ingest Sub-items (Delta Tables)
Environment:
- Tenant 1 (Consumer): Azure Purview (Microsoft Purview Data Map).
- Tenant 2 (Provider): Microsoft Fabric (Capacity + Workspaces).
- Architecture: Purview in Tenant 1 is scanning Fabric in Tenant 2 via the "Fabric" Data Source using Azure Auto-Resolve Integration Runtime.
The Issue: I can successfully scan and see Item-level metadata (e.g., Workspace Name, Lakehouse Name). However, I am getting Zero sub-item visibility. No Delta Tables, no Columns, and no sub-item lineage are being ingested into Purview.
Configuration Verified:
Service Principal (SPN): Created an App Registration in Tenant 2 (Fabric Tenant).
Permissions: The SPN is a Member (and I tested Admin) of the target Fabric Workspace.
Fabric Admin Settings (Tenant 2):
Allow service principals to use read-only admin APIs: Enabled for the SPN's Security Group.
Enhance admin APIs responses with detailed metadata: Enabled.
Enhance admin APIs responses with DAX and mashup expressions: Enabled.
My Specific Questions for the Product Team / MVPs/Members:
- Authentication Flow: For sub-item ingestion (Delta Tables) to work cross-tenant, is it sufficient for the SPN to be a standard App Registration in Tenant 2 (Provider), or does Fabric require the "Cross-Tenant Access" (Guest User) flow where a shadow SPN is created via the specific trusted external tenants configuration?
- API Limitation: Is the "Enhanced Metadata" API payload (metadata/subartifacts) restricted to Same-Tenant calls only during the current Preview? I suspect the API is returning a standard payload instead of the enhanced one due to the cross-tenant boundary.
- Workaround: Has anyone successfully forced ingestion of Delta Tables cross-tenant by using the Apache Atlas REST API to manually inject the schema entities, or is there a specific hidden toggle in the Fabric Admin Portal (perhaps specifically for "External Principals") that I am missing?