Forum Discussion

pranavsabnis's avatar
pranavsabnis
Copper Contributor
Dec 03, 2025

Cross-Tenant Purview Scan of Fabric Lakehouse fails to ingest Sub-items (Delta Tables)

Environment:

  • Tenant 1 (Consumer): Azure Purview (Microsoft Purview Data Map).
  • Tenant 2 (Provider): Microsoft Fabric (Capacity + Workspaces).
  • Architecture: Purview in Tenant 1 is scanning Fabric in Tenant 2 via the "Fabric" Data Source using Azure Auto-Resolve Integration Runtime.

The Issue: I can successfully scan and see Item-level metadata (e.g., Workspace Name, Lakehouse Name). However, I am getting Zero sub-item visibility. No Delta Tables, no Columns, and no sub-item lineage are being ingested into Purview.

Configuration Verified:

Service Principal (SPN): Created an App Registration in Tenant 2 (Fabric Tenant).

Permissions: The SPN is a Member (and I tested Admin) of the target Fabric Workspace.

Fabric Admin Settings (Tenant 2):

Allow service principals to use read-only admin APIs: Enabled for the SPN's Security Group.

Enhance admin APIs responses with detailed metadata: Enabled.

Enhance admin APIs responses with DAX and mashup expressions: Enabled.

My Specific Questions for the Product Team / MVPs/Members:

  1. Authentication Flow: For sub-item ingestion (Delta Tables) to work cross-tenant, is it sufficient for the SPN to be a standard App Registration in Tenant 2 (Provider), or does Fabric require the "Cross-Tenant Access" (Guest User) flow where a shadow SPN is created via the specific trusted external tenants configuration?
  2. API Limitation: Is the "Enhanced Metadata" API payload (metadata/subartifacts) restricted to Same-Tenant calls only during the current Preview? I suspect the API is returning a standard payload instead of the enhanced one due to the cross-tenant boundary.
  3. Workaround: Has anyone successfully forced ingestion of Delta Tables cross-tenant by using the Apache Atlas REST API to manually inject the schema entities, or is there a specific hidden toggle in the Fabric Admin Portal (perhaps specifically for "External Principals") that I am missing?
Azure Purview
data map
microsoft purview
purview
Unified catalog

1 Reply

  • sashakorniakUK's avatar
    sashakorniakUK
    Brass Contributor
    Dec 04, 2025

    Yes, this is the same underlying cross-tenant limitation - as your other post. Purview can scan high-level Fabric items across tenants, but it cannot ingest Delta tables, columns, or lineage because the enhanced metadata APIs only return full detail when the calling identity is in the same tenant. Even with the correct service principal permissions and admin settings, Fabric will not expose sub-item metadata to an external tenant, so Purview receives an incomplete payload. At the moment there is no reliable workaround other than bringing the data or metadata into the same tenant as Purview......................to my knowledge and experince 

Resources