Understanding Microsoft Fabric: How to Unify Multi-Cloud Data with Shortcuts and External Connections

Photo by Mel Poole on Unsplash

Your data is scattered. Some lives in Azure Data Lake Storage, some in Amazon S3, some in Google Cloud Storage, some in Dataverse, and some in Snowflake. Traditional data platforms force you to copy all of it into a central location before you can analyze it. Microsoft Fabric takes a different approach with OneLake shortcuts: reference data in place, query it alongside your native Fabric data, and avoid duplicating storage entirely.

In this article, we will cover everything you need to know about OneLake shortcuts and external connections. How shortcuts work, which data sources are supported, how authentication and caching work, the new shortcut transformations, and how to share data across tenants without copying it.

If you are preparing for the DP-700: Fabric Data Engineer Associate exam, shortcuts are a core concept. Microsoft tests your ability to choose the right data access pattern (shortcut vs. mirroring vs. copy) for a given scenario.

This article is part of the Understanding Microsoft Fabric series, a practical guide designed to help you master every key component of Fabric and prepare for the DP-700 certification.

If you have been following the series, we have already covered:

• Understanding Microsoft Fabric: Introduction to Fabric

• Understanding Microsoft Fabric: OneLake

• Understanding Microsoft Fabric: Lakehouse

• Understanding Microsoft Fabric: Warehouse

• Understanding Microsoft Fabric: Dataflows Gen2

• Understanding Microsoft Fabric: Pipelines

• Understanding Microsoft Fabric: Notebooks

• Understanding Microsoft Fabric: KQL and Real-Time Analytics

• Understanding Microsoft Fabric: Eventhouse

• Understanding Microsoft Fabric: Streaming Dataflows

• Understanding Microsoft Fabric: Data Warehouse Optimization

• Understanding Microsoft Fabric: Incremental Data Loads

• Understanding Microsoft Fabric: Security and Permissions

• Understanding Microsoft Fabric: Cost and Performance Optimization

• Understanding Microsoft Fabric: Monitoring and Troubleshooting

• Understanding Microsoft Fabric: Data Activator

Take Your DP-700 Prep to the Next Level

Reading articles is great for understanding concepts. But passing the exam requires practice. I created a comprehensive practice test course specifically for DP-700: Implementing Data Engineering Solutions Using Microsoft Fabric. Inside you will find:

300+ exam-style questions,
5 full practice tests,
case studies and scenario-based questions,
detailed explanations,
learn WHY each answer is correct,
All 3 exam domains covered

Whether you are just starting or doing final prep, these tests will show you exactly where you stand.

Limited offer: Use code EARLY_BIRD at checkout. Get the practice exams on Udemy

What Are OneLake Shortcuts and Why They Matter

A OneLake shortcut is a reference to data stored elsewhere. Instead of copying data into OneLake, a shortcut points to the source, and Fabric compute engines read the data directly from that source whenever a query runs. Think of it like a desktop shortcut or a symbolic link in a file system: the file appears in your folder, but it actually lives somewhere else.

This is a fundamental shift from traditional data warehousing, where you typically extract, transform, and load (ETL) data into a central repository before analyzing it. With shortcuts, you can query data in place, eliminating the need for duplicate storage, ETL pipelines, and the inevitable drift between source and target.

Why Use Shortcuts?

• Zero data duplication. Your data stays in its original location. No copies, no storage costs for duplicates, no synchronization logic.

• Zero ETL. No pipelines to build, schedule, or maintain. Queries hit the source directly.

• Zero staging latency. As soon as data changes at the source, it is visible through the shortcut (subject to caching).

• Unified namespace. All your shortcuts appear as folders inside OneLake, giving you a single logical view of distributed data.

• Works across all Fabric workloads. Spark, T-SQL, Power BI (Direct Lake), KQL, and Dataflows Gen2 can all read through shortcuts.

When Not to Use Shortcuts

Shortcuts are powerful but not always the right choice:

• High-frequency read workloads on cross-cloud sources can incur egress fees. Caching helps, but if every query hits S3 or GCS, costs add up.

• Performance-critical workloads may be slower than local OneLake data because of network latency and the lack of Fabric-specific optimizations (like V-Order) on external data.

• Frequent writes are better handled by mirroring or native OneLake storage, not shortcuts.

DP-700 Exam Tip

If a question describes a scenario where you need to query data from Amazon S3 without copying it, the answer is a OneLake shortcut. If the scenario requires high-performance queries with low latency, mirroring or native OneLake storage may be better.

Supported Shortcut Sources

OneLake shortcuts support a wide range of data sources, both internal (within Fabric) and external.

Internal Shortcuts (Within OneLake)

Internal shortcuts reference data already stored in OneLake, including:

• Other Lakehouses in the same or different workspace

• Warehouses (via the SQL analytics endpoint)

• Mirrored databases

• Shared data from other Fabric tenants (via External Data Sharing)

Internal shortcuts are the fastest because data stays within OneLake. Use them to share data across workspaces without copying.

External Shortcuts

External shortcuts reference data outside OneLake:

• Azure Data Lake Storage (ADLS) Gen2: The most common external source for Azure-centric organizations. Requires Hierarchical Namespaces to be enabled on the storage account.

• Amazon S3: Connect to S3 buckets using access keys or IAM roles.

• Amazon S3 Compatible: Works with S3-compatible storage providers like MinIO, Cloudflare R2, and Wasabi.

• Google Cloud Storage (GCS): Connect to GCS buckets for multi-cloud scenarios.

• Dataverse: Access Dynamics 365 and Power Platform data directly from Fabric.

• On-premises sources: Via the Fabric on-premises data gateway (OPDG) for databases and file shares behind firewalls.

• Iceberg tables: OneLake supports Apache Iceberg tables through metadata virtualization. A shortcut to an Iceberg table is automatically exposed as a Delta Lake table, making it accessible across all Fabric workloads.

Key Limits

• Each Fabric item supports up to 100,000 shortcuts.

• A single OneLake path supports up to 10 shortcuts.

• The maximum number of direct shortcuts to shortcut links is 5 (chained shortcuts).

• Shortcut names, parent paths, and target paths cannot contain “%” or “+” characters.

DP-700 Exam Tip

Know the supported sources: ADLS Gen2, S3, S3-compatible, GCS, Dataverse, on-premises (via OPDG), and other Fabric items. If a question asks how to connect Dynamics 365 data to a Lakehouse, the answer is a Dataverse shortcut.

How to Create a Shortcut: Step by Step

ADLS Gen2 Shortcut

1. Open a Lakehouse in Fabric.

2. Right-click on a directory within the Lake view (Files or Tables) and select “New shortcut.”

3. Under “External sources,” select “Azure Data Lake Storage Gen2.”

4. Enter the DFS endpoint URL of your storage account (for example,

https://accountname.dfs.core.windows.net/

1. ).

2. Create a new connection or select an existing one.

3. Choose an authentication method: Organizational account, Service principal, SAS token, Account key, or Workspace Identity.

4. Navigate to the target directory and confirm the shortcut path.

5. Click Create. The shortcut appears as a folder in the Lakehouse.

S3 Shortcut

1. Same initial steps as ADLS Gen2.

2. Select “Amazon S3” under External sources.

3. Enter the bucket URL (for example, https://s3.amazonaws.com/bucket-name).

4. Provide access key and secret key for authentication.

5. Select the target folder and create the shortcut.

Internal Shortcut (Cross-Workspace)

1. Right-click in the Lakehouse and select “New shortcut.”

2. Choose “Microsoft OneLake” as the source.

3. Browse to the target workspace and item.

4. Select the folder or table you want to reference.

5. Click Create. No authentication needed because OneLake handles permissions via workspace roles.

DP-700 Exam Tip

The creation flow is similar across sources, but authentication differs. For ADLS Gen2, prefer Workspace Identity for secure, credential-free access. For S3, use IAM roles instead of long-lived access keys when possible.

Authentication: Delegated Authorization Model

Shortcuts use a delegated authorization model. The user who creates the shortcut specifies a credential, and all subsequent access through that shortcut uses the same credential. This means:

• Users who query the shortcut do NOT need direct permissions on the source storage.

• The creator’s credential is trusted by the shortcut for all reads.

• If the creator’s account is disabled or loses access, the shortcut stops working.

Authentication Options for ADLS Gen2

• Organizational Account: Uses the signed-in user’s Entra ID. Simplest option, but tied to an individual user.

• Service Principal: Dedicated identity for automation. Requires Storage Blob Data Reader (or higher) role on the storage account.

• Shared Access Signature (SAS): Time-limited token. Less secure for long-term use.

• Account Key: Full access key. Avoid in production.

• Workspace Identity: Managed identity of the Fabric workspace. Recommended for production because it eliminates credential management and integrates with Trusted Workspace Access.

Authentication Options for S3

• Access key and secret key (basic).

• IAM role via OIDC federation with Microsoft Entra (more secure, no long-lived secrets).

Cross-Tenant Shortcuts

ADLS Gen2 shortcuts to storage in a different Microsoft Entra tenant than your Fabric tenant require Service Principal or SAS token authentication. Organizational Account and Workspace Identity do not work across tenants. For cross-tenant sharing of Fabric data, use External Data Sharing instead (covered below).

DP-700 Exam Tip

If a question asks about secure production authentication for ADLS Gen2 shortcuts, the answer is Workspace Identity (combined with Trusted Workspace Access). For cross-tenant scenarios, the answer is Service Principal.

Trusted Workspace Access: Shortcuts to Private Storage

By default, Fabric cannot access ADLS Gen2 storage accounts protected by firewalls or private endpoints. Trusted Workspace Access solves this problem.

How It Works

1. Create a Workspace Identity for your Fabric workspace.

2. Configure a Resource Instance rule on the storage account that allows access from the specific Fabric workspace.

3. Grant the Workspace Identity the Storage Blob Data Reader (or higher) role.

4. Create a shortcut using Workspace Identity authentication.

The storage firewall recognizes the request as coming from a trusted Fabric workspace and allows access, even when public access is disabled.

This is critical for regulated industries (finance, healthcare, government) where data cannot be exposed to the public internet. You get the benefits of Fabric’s unified data access without compromising network security.

DP-700 Exam Tip

If a question describes a scenario where Fabric needs to access ADLS Gen2 storage behind a firewall or private endpoint, the answer is Trusted Workspace Access using Workspace Identity.

Shortcut Caching: Reducing Egress Costs

When Fabric Compute reads data through a shortcut to a cross-cloud source (S3, GCS), the cloud provider charges egress fees on every read. Over time, this can become expensive, especially for frequently accessed data.

How Caching Works

Shortcut caching stores a local copy of the data in OneLake after the first read. Subsequent reads use the cached copy, eliminating repeated egress fees.

Caching is supported for:

• Amazon S3 (including on-premises S3 with service principal authentication)

• S3 Compatible storage

• Google Cloud Storage (GCS)

• On-premises data gateway shortcuts

ADLS Gen2 shortcuts typically do not need caching because Azure does not charge egress for same-region reads.

Configuring Cache

1. Open Workspace settings.

2. Navigate to the OneLake tab.

3. Toggle the cache setting to On.

4. Select a retention period (1 to 28 days).

5. Save.

The retention period determines how long cached data is kept. Longer retention reduces egress costs but uses more OneLake storage. You can clear the cache at any time using the “Reset cache” button.

DP-700 Exam Tip

If a question describes high egress costs from frequent S3 or GCS reads via shortcuts, the answer is to enable shortcut caching. Remember: caching is not needed for ADLS Gen2 shortcuts.

Shortcut Transformations (GA): Data Prep Without Pipelines

As of 2026, shortcut transformations are generally available. This is a significant capability: OneLake can automatically transform data as it is read through a shortcut, without requiring a Pipeline or Notebook.

Available Transformations

• Structured file to Delta (GA): Automatically converts CSV, Parquet, and JSON files in a shortcut target to Delta tables. Fabric polls the source every 2 minutes, handles schema inference, and flattens nested JSON structures up to 5 levels deep.

• Excel to Delta (Preview): Brings Excel data directly into Fabric Lakehouse Delta tables with a few clicks.

• AI-powered transformations (Public Preview): Apply summarization, translation, sentiment analysis, or document classification to unstructured text files in a shortcut target.

These transformations work on any shortcut target, including data shared from other tenants via External Data Sharing. OneLake keeps the transformed Delta table in sync with the source automatically.

Use Cases

• Ingest raw CSV files from an S3 bucket and have them instantly queryable as Delta tables in your Lakehouse.

• Apply sentiment analysis to customer feedback files in Dataverse without writing any code.

• Translate multilingual documents in a GCS bucket for downstream analytics.

DP-700 Exam Tip

If a question asks how to convert CSV files referenced by a shortcut to Delta tables without building a pipeline, the answer is shortcut transformations.

External Data Sharing: Cross-Tenant Sharing Without Copying

External Data Sharing is Fabric’s built-in mechanism for sharing data across Microsoft Entra tenant boundaries. It uses shortcuts under the hood but adds a layer of governance and a Fabric-to-Fabric authentication model.

How It Works

1. A user in the provider tenant creates an external data share on a lakehouse, warehouse, KQL database, SQL database, or mirrored database.

2. The provider invites a user from another tenant to accept the share.

3. The consumer accepts the share and chooses a lakehouse in their tenant where the shortcut will be created.

4. A read-only shortcut is created in the consumer tenant, pointing back to the provider’s data.

5. The consumer can query the shared data through any OneLake-compatible workload: Power BI, Spark notebooks, SQL analytics endpoint, data science experiments.

Key Characteristics

• Data is shared in place. No copies, no ETL.

• The consumer has read-only access.

• Changes at the source are immediately visible to the consumer.

• The Fabric-to-Fabric authentication mechanism does not require Entra B2B guest users.

• Both tenants must have Fabric capacity.

Governance Implications

External Data Sharing preserves a single version of truth, but governance controls from the provider tenant do not flow across tenant boundaries. The consumer tenant applies its own governance policies (sensitivity labels, access controls, DLP) to the incoming data. This is critical to understand from a compliance perspective.

DP-700 Exam Tip

For sharing data with users in the same Fabric tenant, use OneLake shortcuts. For sharing data across Fabric tenants, use External Data Sharing. The question’s tenant context determines the answer.

Quick Decision Guide

• Use a shortcut when data should stay at the source (compliance, cost, residency) and reads are reasonable in frequency.

• Use mirroring when you need high-performance queries, the source is a supported database (SQL Server, PostgreSQL, Snowflake, Cosmos DB, Databricks), and continuous replication is acceptable.

• Use a pipeline copy when you need transformations during ingestion or the source is not supported by shortcuts or mirroring.

DP-700 Exam Tip

The exam frequently tests the distinction between shortcuts (reference), mirroring (replicated copy), and pipeline copy (scheduled copy). Read the scenario carefully to identify which approach fits.

Common Mistakes to Avoid

Using shortcuts for high-frequency workloads without caching. Every query hits the source, incurring egress costs and latency. Enable caching or consider mirroring for frequently accessed cross-cloud data.

Forgetting to enable Hierarchical Namespaces on ADLS Gen2. Shortcuts require HNS. Without it, the shortcut creation fails.

Using Organizational Account authentication in production. If the creator’s account is disabled, the shortcut stops working. Always use Workspace Identity or Service Principal for production.

Creating shortcuts to ADLS containers directly. The Copy function does not work on shortcuts that point directly to ADLS containers. Create the shortcut at least one level below the container (to a directory).

Trying to create nested shortcuts inside ADLS shortcuts. You cannot create more shortcuts inside an ADLS shortcut. Plan your shortcut hierarchy in advance.

Expecting governance policies to flow across tenants. With External Data Sharing, sensitivity labels and RLS defined in the provider tenant are NOT enforced in the consumer tenant. Each tenant applies its own governance.

Not using Trusted Workspace Access for private storage. If your ADLS Gen2 is behind a firewall and you do not configure Trusted Workspace Access, the shortcut will fail to read data.

DP-700 Exam Tip

The exam tests gotchas: HNS requirement, copy limitation on direct container shortcuts, nested shortcut restriction, cross-tenant governance, and Trusted Workspace Access. Pay attention to these details in scenario questions.

What is Next

In the next article, we will explore AI Integration and Copilot Features in Microsoft Fabric, covering Copilot for Data Engineering, Copilot for Power BI, AI functions in the Warehouse, data agents, and how Fabric IQ brings AI-powered reasoning over your business data.

Make sure to bookmark this series so you do not miss any upcoming articles.