OneLake
OneLake is the data lake built into Microsoft Fabric. Every Fabric tenant includes exactly one: Microsoft’s documentation states that you cannot delete OneLake or create multiple OneLakes, and there is no infrastructure to provision. All Fabric workloads — data engineering, warehousing, real-time analytics, Power BI — store their data in it.
How it is organized
| Level | What it is | Why it matters |
|---|---|---|
| Tenant | The organization’s Microsoft Entra tenant, with one OneLake | Tenant-level policies apply to everything stored |
| Workspace | A container for items, assigned to a capacity in a specific region | Sets where data lives and which capacity pays for work on it |
| Item | A lakehouse, warehouse, database, or other Fabric object | Holds the tables and files themselves |
OneLake is built on Azure Data Lake Storage Gen2 and is compatible with its APIs, so existing tools can read it: a workspace appears as a container and an item as a folder.
One copy for many engines
Fabric’s engines store tables in open formats — Delta Parquet, with Iceberg supported through metadata that lets each format be read as the other. The practical consequence is that a table written by Spark can be queried by the SQL endpoint and loaded by a Power BI semantic model without being copied into each engine’s own storage.
Data that lives elsewhere can be brought into the same namespace without moving it, through shortcuts, or replicated in from operational databases through mirroring.
What one lake per tenant implies
- Tenant policies coexist with distributed ownership. OneLake provides a common tenant boundary, while teams own workspaces and items with their assigned permissions. Define both the shared baseline and the responsibilities within those scopes.
- Location follows the workspace. Because each workspace belongs to a capacity tied to a region, the capacity decides where a workspace’s data is stored by default. Residency needs more than that: with business continuity and disaster recovery enabled, the data is also replicated to a paired Azure region; shortcut data stays wherever its source is; and processing and results have locations of their own.
- Security has more than one definition point. OneLake security roles can be defined at folder, table, row, and column level, but whether a given query honors them depends on how the engine accesses the data. That interaction is where access surprises tend to arise, and is worth testing per engine. The rules also restrict only some users: because OneLake security grants access rather than denying it, row and column rules do not apply to workspace Admins, Members, or Contributors.
- Deletion has a grace period. The documentation describes a seven-day soft delete, which helps recovery and matters for erasure obligations.
How OneLake fits with Fabric’s capacity model and the move from Synapse is worked through in Microsoft Fabric Architecture: OneLake, Capacity, and the Move from Synapse.
References
- Microsoft Learn, OneLake, the unified data lake
- Microsoft Learn, What is Microsoft Fabric?
- Microsoft Learn, OneLake table, column, and row-level security
Discover more from Insightful Data Lab
Subscribe to get the latest posts sent to your email.