Dr. Estera Kot

FabCon Europe 2026 in 18 demos · Part 6 of 18 · Reading Fabric data from outside Fabric

Unity Catalog and Iceberg REST on OneLake: one table, no copy

Two open catalog protocols serve the same Delta tables in OneLake, so engines outside Fabric query them in place.

By Dr. Estera Kot, Microsoft MVP, CTO at Clouds on Mars, and former Microsoft Principal Product Manager for the Apache Spark runtime in Fabric. Published .

The OneLake table APIs expose Fabric lakehouse tables through two open catalog protocols: the Apache Iceberg REST Catalog and a Unity Catalog compatible API for Delta metadata. An external engine asks the catalog for a table's schema and location, then reads the Parquet files from OneLake. One copy of the data answers both protocols.

It can replace export jobs that copy Fabric tables into another lake for Snowflake or Spark. It belongs to the "reading Fabric data from outside" group in FabCon Europe 2026 in 18 demos.

In short

  1. One host, two protocols: /iceberg/v1 for the Iceberg REST Catalog, /delta/…/unity-catalog for Unity Catalog. Both return metadata, and your engine reads the files.
  2. Delta tables appear as Iceberg only with Delta Lake to Iceberg metadata conversion on. Iceberg clients get read-only V2 metadata for the latest version.
  3. OneLake security does not filter rows here. It blocks a restricted user from a table with RLS or CLS.
A terminal reads the synthetic formulas table through the Unity Catalog compatible API, then lists and loads the same lakehouse tables through the Iceberg REST Catalog. 25 seconds, no sound, recorded Oct 21, 2026.

Same demo in Polish and German. Step-by-step runbook: D18.

How the OneLake Iceberg REST Catalog and Unity Catalog API work

Both protocols live on onelake.table.fabric.microsoft.com, the host of the OneLake Table Read API. Both take a Microsoft Entra ID token for https://storage.azure.com. These are the read calls the demo makes, relative to that host:

# Unity Catalog compatible API: Delta metadata, read only
GET /delta/<WorkspaceID>/<ItemID>/api/2.1/unity-catalog/schemas?catalog_name=<ItemID>
GET /delta/<WorkspaceID>/<ItemID>/api/2.1/unity-catalog/tables?catalog_name=<ItemID>&schema_name=dbo
GET /delta/<WorkspaceID>/<ItemID>/api/2.1/unity-catalog/tables/<TableName>

# Iceberg REST Catalog: config first, then the returned prefix
GET /iceberg/v1/config?warehouse=<WorkspaceID>/<ItemID>
GET /iceberg/v1/<Prefix>/namespaces
GET /iceberg/v1/<Prefix>/namespaces/dbo/tables
GET /iceberg/v1/<Prefix>/namespaces/dbo/tables/<TableName>

Authorization: Bearer <token for https://storage.azure.com>

The Delta side lists, gets, and checks schemas and tables, and nothing else. The Iceberg side also vends temporary storage credentials on X-Iceberg-Access-Delegation: vended-credentials, and creates, commits, and drops native Iceberg tables. A lakehouse without schemas shows one namespace, dbo.

The Iceberg view of a Delta table is generated. With Delta Lake to Iceberg metadata conversion on for the tenant or workspace, OneLake writes Iceberg V2 metadata into a metadata folder in the table folder, 5 seconds to 2 minutes after a commit. It converts the latest version only. Iceberg clients read it but cannot commit to it.

OneLake security acts at the file read, and it blocks. Learn treats a nonauthorized external engine as user access. If the user may not see every row and column of a table, the read is blocked. Nothing is filtered on this path.

One Delta table, two catalog protocols, one copy of the files A table folder in OneLake holds the Delta log, virtual Iceberg metadata that OneLake generates, and one set of Parquet files. The Unity Catalog compatible endpoint reads the Delta log, the Iceberg REST Catalog reads the Iceberg metadata. Your engine outside Fabric gets metadata from either endpoint, then reads the Parquet files directly. At that file read, OneLake security blocks a restricted user from a table with RLS or CLS instead of filtering it. OneLake Your engine Operated by Microsoft. One copy of the data. Outside Fabric Tables/dbo/preference_trials/ _delta_log/ the table as Fabric writes it metadata/ Iceberg V2 metadata, generated by OneLake Parquet data files one set, read by both protocols onelake.table.fabric.microsoft.com /delta/…/unity-catalog Unity Catalog compatible API Delta metadata, read only /iceberg/v1/… Iceberg REST Catalog metadata, vended credentials Unity Catalog client reads schema and storage location Iceberg client PyIceberg, Snowflake, or DuckDB in Learn's samples the engine reads the Parquet files itself OneLake security: blocked, not filtered A restricted user cannot read a table with RLS or CLS through this path, unless the engine is an authorized engine. One Delta table, two catalog protocols, one copy of the files From top to bottom: the table folder in OneLake with the Delta log, generated Iceberg metadata, and one set of Parquet files. Two catalog endpoints serve its metadata. Your engine outside Fabric reads the metadata, then reads the Parquet files from OneLake, where a restricted user is blocked from a table with RLS or CLS. OneLake, operated by Microsoft Your engine, outside Fabric Tables/dbo/preference_trials/ _delta_log/ the table as Fabric writes it metadata/ Iceberg V2, generated by OneLake Parquet data files one set, read by both protocols /delta/…/unity-catalog Unity Catalog API, Delta, read only /iceberg/v1/… Iceberg REST Catalog Your engine Unity Catalog or Iceberg client, such as PyIceberg, Snowflake, DuckDB Reads the Parquet files in OneLake OneLake security blocks, not filters: a restricted user cannot read a table with RLS or CLS this way. The files are the ones at the top.
Figure 1. One table folder, two catalogs, one set of Parquet files. OneLake security decides at the file read whether a restricted user gets the table at all.

What the demo shows

The clip replays output from a real run against lh_oud_rd, the synthetic lakehouse of a made-up oud perfume house.

The single snapshot fits Learn's note that conversion covers only the latest Delta version. The runbook's sample lists ten tables. The recording also showed gold_formula_scorecard, the gold table from the Project Osmos demo.

Which door to use: Table Read API, Iceberg REST, Unity Catalog, or SQL endpoint

Pick the door by two questions. Who runs the query? Must OneLake security filter rows for this caller?

IDDoorWhat you getWho runs the queryRLS and CLSStatus, Nov 3, 2026
D1Table Read APIRows as Apache ArrowOneLakeFiltered per callerPreview
D2Iceberg REST CatalogIceberg metadata, vended credentialsYour engineRestricted users blockedGA, no preview label
D3Unity Catalog compatible APIDelta metadata, read onlyYour engineRestricted users blockedGA, no preview label
D4Authorized engineA user's effective accessYour engineFiltered by the enginePreview
D5SQL analytics endpointT-SQL result setsFabric SQL engineFiltered in user's identity access modeGA
Figure 2. Five doors to Fabric tables from outside Fabric. Only D1, D4, and D5 filter rows for the caller.

Use D2 and D3 when an engine you already run should query tables without RLS or CLS in place. Use the Table Read API when an app needs secured rows, and D5 for joins and aggregates. OneLake security roles decide which doors stay open for which user.

Limits and catches

The catch: on the catalog path, OneLake security blocks instead of filtering. A user under an RLS or CLS role loses the whole table in Snowflake or PyIceberg, not only the hidden rows. The tempting workaround, an unrestricted service principal for the external team, undoes the security model.

Learn lists more limits for the conversion:

Iceberg namespaces are one level deep, and vended SAS credentials are secrets that expire. A materialized lake view persists as a Delta table, so check that yours appears in the table list before you promise it to another team.

Run the demo yourself

You need the tables that python3 fabdemo.py up from the recap repo loads, the Azure CLI signed in, and, for the Iceberg calls, Delta to Iceberg metadata conversion turned on for the tenant or workspace. Then run:

python3 fabdemo.py uc formulas
python3 fabdemo.py irc
python3 fabdemo.py irc preference_trials

Expected result: the formulas table as Delta with seven columns, the table list through Iceberg, and preference_trials as an Iceberg table. Time and cost: about 2 minutes. Calls are small, the capacity must be Active. Full steps: runbook D18.

The script asks the Unity Catalog side for tables/<ItemID>.dbo.formulas, a three-part name, and reads the Iceberg prefix from the config response.

What to do on Monday

On Monday: Check which tables carry OneLake RLS or CLS before you point an Iceberg or Unity Catalog client at them.

Tables without row or column rules suit the catalog path. Tables with rules belong behind the Table Read API, an authorized engine, or the SQL analytics endpoint.

Key facts at a glance

Checked on Microsoft Learn on November 3, 2026.

IDFactSource
K1Endpoints: https://onelake.table.fabric.microsoft.com/iceberg and /delta, token audience https://storage.azure.comLearn: Iceberg metadata API
K2Delta metadata API: list and get schemas and tables, read onlyLearn: Delta metadata API
K3Iceberg API: reads, credential vending, and writes for native Iceberg tablesLearn: Iceberg metadata API
K4Delta to Iceberg: Iceberg V2 metadata, latest version only, under 5,000 commitsLearn: Iceberg tables with OneLake
K5Conversion not available in Qatar Central and Norway West, or with private linksLearn: Iceberg tables with OneLake
K6Nonauthorized external engines are blocked from tables a user cannot fully seeLearn: Read secured data

Frequently asked questions

Can Snowflake read Microsoft Fabric lakehouse tables without a copy?

Yes. Snowflake can connect to the OneLake Iceberg REST Catalog with a catalog integration and vended credentials, and Microsoft Learn includes a sample. For Delta tables, turn on Delta Lake to Iceberg metadata conversion first. The data stays in OneLake.

Does OneLake support the Iceberg REST Catalog?

Yes. OneLake serves the Iceberg REST Catalog at https://onelake.table.fabric.microsoft.com/iceberg. It lists and loads tables, vends temporary storage credentials, and writes native Iceberg tables.

Is there a Unity Catalog API for OneLake?

Yes. OneLake offers a Unity Catalog compatible API for Delta metadata at https://onelake.table.fabric.microsoft.com/delta. It lists and gets schemas and tables and does not support metadata writes.

Do the OneLake Iceberg and Unity Catalog APIs respect row-level security?

They do not filter rows. A nonauthorized external engine counts as user access, so a user who may not see every row and column of a table is blocked from it. Use the OneLake Table Read API or an authorized engine when rows must be filtered.

Why does my Delta table not show up as an Iceberg table in OneLake?

Delta Lake to Iceberg metadata conversion must be on for the tenant or workspace. It also does not run for tables with 5,000 or more commits, in Qatar Central and Norway West, or with private links. Check the conversion log in the table's metadata folder.

About the author

Dr. Estera Kot is CTO at Clouds on Mars, a Microsoft and Databricks partner for data and AI in Europe and the Middle East. At Microsoft she was Principal Product Manager for the Apache Spark runtime in Azure Synapse Analytics and Microsoft Fabric, and she created the Native Execution Engine. She is a Microsoft MVP and holds a Ph.D. in Computer Science from the Warsaw University of Technology. She presented this series as the FabCon Europe 2026 recap in Gdynia on October 21, 2026, and online on October 23, 2026. Slides, recordings, and runbooks are in the public recap repository.

Sources

Microsoft Learn and the Microsoft Fabric blog, checked on November 3, 2026.