Connect Fabric OneLake to Dynamics 365 Customer Insights: Setup, Permissions and Delta Table Limits

While the feature is automatically enabled in the Customer Insights - Data interface for administrators, makers, and marketers, actually getting data to flow across the boundary is far from a zero-configuration affair. According to Microsoft Learn documentation updated on October 15, 2026, connecting a Fabric lakehouse directly to Customer Insights - Data requires specific Microsoft Entra tenant alignments, service principal permissions, strict table naming rules, and careful management of Delta log retention.

Bypassing the Staging Tax: What the OneLake Connector Actually Does​

At its core, the Fabric OneLake connector allows Dynamics 365 Customer Insights - Data to read managed Delta tables directly from a Microsoft Fabric lakehouse workspace without copying or staging that data in an intermediate Azure Data Lake Storage account. Microsoft OneLake serves as Fabric's unified, logical data lake across an organization, provisioned automatically with every Fabric tenant.

By reading Delta tables directly from the Fabric workspace, Customer Insights - Data can take advantage of the Delta format's transaction logs to perform incremental data ingestion. When only a small fraction of a massive customer dataset changes from one day to the next, incremental reads process just the delta rather than pulling the entire table from scratch. Microsoft also notes in its release documentation that organizations already using an Azure Data Lake Delta tables data source can convert that existing connection into a Microsoft Fabric OneLake data source while keeping their tables, mappings, and downstream dependencies intact.

Shortcuts, Mirroring, and the "Contoso" Caveat​

In the AI at Work roadmap entry and 2026 release wave documentation, Microsoft illustrates the connector's potential using its classic fictional enterprise, Contoso. In that scenario, Contoso centralizes its customer records in OneLake, uses Fabric shortcuts and mirroring to pull in outside platforms like Snowflake, and connects Customer Insights - Data directly to OneLake—supposedly replacing slow, expensive ETL (extract, transform, load) pipelines with a streamlined foundation.

From a veteran IT perspective, it is important to separate the architectural mechanism from the marketing victory lap. The Contoso example is an illustrative scenario, not an independent benchmark or a guaranteed cost-reduction metric. More importantly, using Fabric shortcuts and mirroring does not mean Customer Insights - Data suddenly speaks natively to every external database on the market. Rather, Fabric handles the virtualization or mirroring into the lakehouse, and the Customer Insights - Data connector reads the resulting Delta tables exposed in the Fabric workspace.

Section Summary:

• Direct Ingestion: Reads managed Delta tables straight from a Fabric lakehouse without intermediate Azure Data Lake staging.
• Incremental Updates: Uses Delta format logs to ingest daily changes rather than reloading entire datasets.
• External Data via Fabric: Supports Delta tables exposed through Fabric shortcuts, allowing external data brought into Fabric to feed Customer Insights - Data.

Strict Boundaries: What the Connector Won't Touch​

Before promising your marketing analysts that every scrap of company data in Microsoft Fabric is ready for customer segmentation, administrators need to review the connector's strict technical guardrails. According to Microsoft Learn's connector documentation, the integration is purpose-built for Fabric lakehouse Delta tables—and it will flatly ignore anything that falls outside its formatting rules.

That physical table naming rule is the exact kind of detail that catches data engineers off guard on a Friday afternoon. When Customer Insights - Data scans a workspace, it displays discovered tables using a combined string pattern: <lakehouse>_Lakehouse_<schema>_<table>. However, the discovery filter checks the underlying physical folder name (<table>) under Tables in the Fabric lakehouse. If a table is named 2026Orders or Sales-Orders, it simply will not appear in the selection list until you rename it inside the Fabric Lakehouse explorer.

Section Summary:

• Only Delta lakehouse tables with minReaderVersion 1 or 2 are eligible; Fabric Data Warehouses, CSVs, non-Delta Parquet files, and tables using deletion vectors are excluded.
• Physical table names must strictly follow ASCII alphanumeric and underscore rules starting with a letter, or they will remain invisible during setup.

Under the Hood: Tenant Settings, Service Principals, and Security​

Even though the roadmap lists this capability as automatically enabled for admins, makers, and marketers, the connector cannot read a single byte until a Fabric tenant administrator and workspace owner unlock the doors on the Fabric side.

First, both the Microsoft Fabric workspace and the Dynamics 365 Customer Insights - Data environment must live in the exact same Microsoft Entra tenant. The user configuring or updating the data source in Customer Insights needs at least the Viewer role on the Fabric workspace.

Second, a Fabric administrator must configure two tenant-level policies in the Fabric admin portal:

1. External App Access: Under Tenant settings > OneLake settings, enable Users can access data stored in OneLake with apps external to Fabric. This can be scoped to the entire organization or restricted to specific security groups, and Microsoft notes that changes can take up to 15 minutes to propagate.
2. Public API Access: Under Tenant settings > Developer settings, enable Service principals can call Fabric public APIs.

Third, you have to grant workspace permissions to the underlying application identity: Dynamics 365 AI for Customer Insights. Microsoft recommends placing this service principal inside a security group as a best practice, then adding it to the connected Fabric workspace with at least the Contributor role. Why Contributor instead of simple read access? According to Microsoft Learn, the service principal not only reads the Delta tables at runtime, but also writes a small amount of metadata back for each table.

The Shortcut Authentication Trap​

If your workspace relies on OneLake shortcuts to pull in Delta tables from another workspace in the same tenant using passthrough authentication, the permissions model gets an extra layer. The Dynamics 365 AI for Customer Insights service principal must still hold the Contributor role on the primary workspace hosting the shortcut, but it also needs explicit access to the target workspace or lakehouse. Administrators have two choices for the shortcut target:

• Workspace-level access: Assign the service principal the Contributor role on the target workspace.
• Lakehouse-only read access: Share the target lakehouse directly with the service principal and grant both Read and Read all with Apache Spark permissions. Crucially, Microsoft warns that granting Read all with SQL analytics endpoint by itself is insufficient because it does not permit reads through OneLake APIs.

For shortcuts configured with delegated authentication (including external shortcuts), access is handled through the shortcut's own configured connection identity rather than the Customer Insights service principal.

Private Links and Inbound Access Protection​

For enterprise environments that lock down public endpoints, Fabric's Inbound Access Protection will block standard OneLake connections. Administrators can check if this is active in the Microsoft Fabric admin portal under Admin Portal > Tenant Settings > Advanced Networking by seeing whether Azure Private Links and Block Public Internet Access are enabled. If they are, you must configure an Azure Private Link and check the Enable Private Link option when setting up the data source in Customer Insights - Data.

Section Summary:

• Requires same-tenant alignment, enabling external OneLake app access, and allowing service principals to call Fabric public APIs.
• The Dynamics 365 AI for Customer Insights service principal requires the Contributor role on the connected workspace to read tables and write metadata.
• Passthrough shortcuts require target lakehouse access (Read plus Read all with Apache Spark, or target workspace Contributor), while restricted networks require Azure Private Link configuration.

Step-by-Step: Connecting Fabric OneLake to Customer Insights - Data​

Once the tenant prerequisites and workspace permissions are in place, hooking up the data source takes only a few minutes inside the Customer Insights - Data web portal:

1. Navigate to Data > Data sources and select Add a data source.
2. Choose Microsoft Fabric OneLake.
3. Enter a unique Data source name (note that this name cannot be changed after saving), an optional Description, and select the target Workspace.
4. If your Fabric tenant enforces inbound access protection, check Enable Private Link.
5. Select Next to view discovered Delta tables across the lakehouses in that workspace.
6. Toggle Include for each table you want to ingest.
7. If a selected table does not have an automatically detected primary key, Required will appear in the Primary key column. Click Required, choose a unique, non-null column in the Edit table panel, and select Close.
8. (Optional) To turn on data profiling—which is disabled by default—click the number displayed under Columns for a table to open the Manage attributes page, enable Data profiling for the whole table or specific columns, and click Done.
9. Select Next, review the configuration summary, and click Save.

The data source will immediately enter a Refreshing status as Customer Insights reads the tables and generates metadata. Microsoft notes that ingested data is transferred and processed in the geographic location of the Customer Insights - Data environment. If you need to modify the connection later, you can edit the description, toggle Private Link, or add and remove tables (provided no downstream dependencies exist), though the data source name and workspace selection remain permanently locked.

Day-Two Operations: Schema Changes and the VACUUM Hazard​

Setting up a connector is half the battle; keeping it alive through month-end maintenance is where IT teams earn their paycheck. Because Customer Insights - Data relies on Delta transaction logs to perform incremental refreshes, it requires an unbroken chain of Delta log versions stretching back to the previous successful refresh.

If a data engineer runs an aggressive VACUUM operation on the Fabric lakehouse—or if log retention windows are set too short—Customer Insights will lose the historical log versions it needs to calculate incremental changes, causing the refresh to fail. To prevent broken pipelines, Microsoft recommends three operational safeguards:

• Extend Log History: Maintain a Delta log version history longer than your longest refresh cadence. For example, if a development environment only refreshes once every two weeks, retain at least three weeks of version history.
• Configure Retention Properties: Explicitly set both delta.logRetentionDuration and delta.deletedFileRetentionDuration to appropriate windows on your Fabric lakehouse tables.
• Recovering from Missing Logs: Avoid aggressive VACUUM jobs on ingested tables. If log versions are accidentally purged, administrators must manually trigger a full refresh on the affected table in Customer Insights - Data. Similarly, if an upstream table schema changes, the refresh will typically fail until the schema is updated in the Customer Insights connection settings.

Finally, if you open the Add Fabric Delta tables screen and the page appears unresponsive or displays an empty list, don't panic. Check the big three culprits first: verify that the Fabric tenant setting for external OneLake access has had its full 15 minutes to take effect, confirm the Dynamics 365 AI for Customer Insights service principal holds Contributor rights on the workspace, and ensure Azure Private Links are properly wired if public internet access is blocked on your Fabric tenant.