Microsoft Sentinel
Cloud and workloadsSet up federated data connectors in Microsoft Sentinel data lake (Preview)
In brief
The page now labels the capability as Preview, clarifies storing the client secret in Azure Key Vault, reorganizes connector sections, and adds Azure Databricks prerequisites for hybrid workspaces, external data access, and Delta Parquet tables.
What Defender admins need to know
Administrators configuring Azure Databricks federation should verify these prerequisites and retain the client secret for Key Vault.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Set up federated data connectors in Microsoft Sentinel data lake (Preview)
This article explains how to configure federated data connectors to enable querying of external data sources from the Microsoft Sentinel data lake. You can federate with Azure Databricks, Azure Data Lake Storage (ADLS) Gen 2, and Microsoft Fabric. The article walks through creating a service principal, storing credentials in Azure Key Vault, and setting up a connector instance for each supported data source. Use this guide if you're a security administrator who needs to bring external data into Microsoft Sentinel for investigation and analysis.
Select New client secret.
Enter a description and select an expiration period.
Select Add.
Copy the client secret value immediately
for use in the next section. Youbecause you can't retrieve it later. You need this valueafterwhen youleavestore thepage.secret in Azure Key Vault.Note the application details:
- Application (client) ID
The process for creating a connector instance varies depending on whether you're connecting to Microsoft Fabric, Azure Data Lake Storage Gen 2, or Azure Databricks. Follow the instructions for your specific data source type.
Microsoft Fabric
Use this tabthe following steps to create a federated connector instance for Microsoft Fabric.
Create a Microsoft Fabric connector instance
Before configuring the Fabric connector instance, you must set up permissions within the Microsoft Fabric environment to allow Microsoft Sentinel to access the data.
- Select Connect to create the connection instance.
Azure Data Lake Storage Gen 2
Azure Data Lake Storage Gen 2
Use this tabthe following steps to create a federated connector instance for Azure Data Lake Storage (ADLS) Gen 2.
Create an ADLS Gen 2 connector instance
Before creating the connector, prepare your storage account:
Select Connect, to complete the setup for the ADLS Gen 2 connector instance. The wizard closes and the instance count for Azure Data Lake Storage Gen2 increases.
Azure Databricks
Use this tabthe following steps to create a federated connector instance for Azure Databricks.
Create anPrepare the Azure Databricks connector instance
environment
Before creating the connector, configure access in your Databricks environment as follows:
- Select the service principal you created earlier and select Add.
Create the Azure Databricks connector instance
Follow these steps to create the Azure Databricks connector instance in the Defender portal:
- On the Data federation > Catalog page, select the Azure Databricks row.
- In the side panel, select Connect a connector.
After selecting Connect, the wizard closes and the instance count for Databricks increases.
Verify tables from your connector instance
After creating a connector instance check that the tables you federated are available in Microsoft Sentinel.
:::image type="content" source="./media/data-federation-setup/verify-tables.png" lightbox="./media/data-federation-setup/verify-tables.png" alt-text="Screenshot showing the federated table schema.":::
Manage connector instances
To modify or delete a connector instance:
Verify the Sentinel platform managed identity prefixed by
msg-resources-has the correct permissions on Azure Key Vault.If your connection source is Azure Databricks or Azure Data Lake Storage Gen2, ensure the Key Vault secret contains the correct client secret for your service principal.
If your connection source is Azure Databricks, confirm the target uses hybrid workspace type and that external data access has been enabled for the workspace.
The Key Vault networking must be set to Allow public access from all networks during the connector configuration, which is the default configuration of Key Vault. It can be changed after connector creation or editing.
Confirm the external data source is publicly accessible.
Check that the service principal has appropriate permissions on the target data source for Azure Databricks and ADLS.
Tables don't appear
Verify the service principal has read access to the target tables for ADLS and Azure Databricks, and the service principal is in the same tenant as these data sources.
Verify the target tables are in delta parquet format.
- For Databricks, ensure you granted both the built-in Data Reader privilege preset plus the External Use Schema permission to the service principal.
For ADLS Gen 2, confirm the Storage Blob Data Reader role is assigned to the service principal.
@@ -8,15 +8,15 @@ ms.reviewer: amyhari ms.service: microsoft-sentinel ms.subservice: sentinel-platform ms.topic: how-to-ms.date: 06/12/2026+ms.date: 07/01/2026 ms.collection: ms-security ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a security administrator, I want to set up federated data connectors so that I can query external data sources from the Microsoft Sentinel data lake. --- -# Set up federated data connectors in Microsoft Sentinel data lake+# Set up federated data connectors in Microsoft Sentinel data lake (Preview) This article explains how to configure federated data connectors to enable querying of external data sources from the Microsoft Sentinel data lake. You can federate with Azure Databricks, Azure Data Lake Storage (ADLS) Gen 2, and Microsoft Fabric. The article walks through creating a service principal, storing credentials in Azure Key Vault, and setting up a connector instance for each supported data source. Use this guide if you're a security administrator who needs to bring external data into Microsoft Sentinel for investigation and analysis. @@ -48,7 +48,7 @@ For Azure Databricks and ADLS Gen 2 federation, you need a service principal wit 1. Select **New client secret**. 1. Enter a description and select an expiration period. 1. Select **Add**.- 1. Copy the client secret value immediately for use in the next section. You can't retrieve this value after you leave the page.+ 1. Copy the client secret value immediately because you can't retrieve it later. You need this value when you store the secret in Azure Key Vault. 1. **Note the application details**: - Application (client) ID@@ -105,11 +105,11 @@ Federated connectors are managed on the Data connectors page in Microsoft Sentin The process for creating a connector instance varies depending on whether you're connecting to Microsoft Fabric, Azure Data Lake Storage Gen 2, or Azure Databricks. Follow the instructions for your specific data source type. -# [Microsoft Fabric](#tab/fabric)+### [Microsoft Fabric](#tab/fabric) -Use this tab to create a federated connector instance for Microsoft Fabric.+Use the following steps to create a federated connector instance for Microsoft Fabric. -## Create a Microsoft Fabric connector instance+#### Create a Microsoft Fabric connector instance Before configuring the Fabric connector instance, you must set up permissions within the Microsoft Fabric environment to allow Microsoft Sentinel to access the data. @@ -143,14 +143,11 @@ To configure the Fabric connector instance: 1. Select **Connect** to create the connection instance. -> [!NOTE]-> For Microsoft Fabric federation, the files in the target data source must be in delta parquet format to be read from the Sentinel data lake.--# [Azure Data Lake Storage Gen 2](#tab/adls)+### [Azure Data Lake Storage Gen 2](#tab/adls) -Use this tab to create a federated connector instance for Azure Data Lake Storage (ADLS) Gen 2.+Use the following steps to create a federated connector instance for Azure Data Lake Storage (ADLS) Gen 2. -## Create an ADLS Gen 2 connector instance+#### Create an ADLS Gen 2 connector instance Before creating the connector, prepare your storage account: @@ -190,11 +187,11 @@ Before creating the connector, prepare your storage account: Select **Connect**, to complete the setup for the ADLS Gen 2 connector instance. The wizard closes and the instance count for Azure Data Lake Storage Gen2 increases. -# [Azure Databricks](#tab/databricks)+### [Azure Databricks](#tab/databricks) -Use this tab to create a federated connector instance for Azure Databricks.+Use the following steps to create a federated connector instance for Azure Databricks. -## Create an Azure Databricks connector instance+#### Prepare the Azure Databricks environment Before creating the connector, configure access in your Databricks environment as follows: @@ -212,7 +209,9 @@ Before creating the connector, configure access in your Databricks environment a 1. Select the service principal you created earlier and select Add. <a name="create-the-connector-instance"></a>-### Create the Azure Databricks connector instance+#### Create the Azure Databricks connector instance++Follow these steps to create the Azure Databricks connector instance in the Defender portal: 1. On the **Data federation** > **Catalog** page, select the **Azure Databricks** row. 1. In the side panel, select **Connect a connector**.@@ -247,6 +246,8 @@ Before creating the connector, configure access in your Databricks environment a After selecting **Connect**, the wizard closes and the instance count for Databricks increases. +---+ ## Verify tables from your connector instance After creating a connector instance check that the tables you federated are available in Microsoft Sentinel.@@ -263,6 +264,8 @@ After creating a connector instance check that the tables you federated are avai :::image type="content" source="./media/data-federation-setup/verify-tables.png" lightbox="./media/data-federation-setup/verify-tables.png" alt-text="Screenshot showing the federated table schema."::: + + ## Manage connector instances To modify or delete a connector instance:@@ -287,6 +290,8 @@ Use the following checks to diagnose common issues with federated data connector - Verify the Sentinel platform managed identity prefixed by `msg-resources-` has the correct permissions on Azure Key Vault. - If your connection source is Azure Databricks or Azure Data Lake Storage Gen2, ensure the Key Vault secret contains the correct client secret for your service principal.+- If your connection source is Azure Databricks, confirm the target uses hybrid workspace type and that external data access has been enabled for the workspace.+ - The Key Vault networking must be set to **Allow public access from all networks** during the connector configuration, which is the default configuration of Key Vault. It can be changed after connector creation or editing. - Confirm the external data source is publicly accessible. - Check that the service principal has appropriate permissions on the target data source for Azure Databricks and ADLS.@@ -299,7 +304,7 @@ Use the following checks to diagnose common issues with federated data connector ### Tables don't appear - Verify the service principal has read access to the target tables for ADLS and Azure Databricks, and the service principal is in the same tenant as these data sources.-+- Verify the target tables are in delta parquet format. - For Databricks, ensure you granted both the built-in Data Reader privilege preset plus the External Use Schema permission to the service principal. - For ADLS Gen 2, confirm the Storage Blob Data Reader role is assigned to the service principal.