How to

Two steps from you. OneLake Guard does the rest.

Identity is service principal only (not managed identity). Nothing leaves your Fabric / Azure tenant — results stay in the Lakehouse you choose.

  1. Deploy the container with a service principal

    Install from Azure Marketplace (public or VNet-integrated ACI). Configure API_AUTH_KEY and service principal credentials for Fabric. Managed identity is not used.

  2. Grant access to monitored workspaces + output Lakehouse

    Assign the service principal Viewer on workspaces to monitor and Contributor on the output workspace / Lakehouse you selected.

Then OneLake Guard runs automatically

It discovers Delta tables, runs detectors, writes results back into the selected output Lakehouse, and surfaces them in the deployed Direct Lake Power BI report.

Nothing goes outside Fabric. No external SaaS data plane — scan output and the report stay in the customer’s Azure / Fabric environment.

Inside Fabric

Lakehouse + report in your workspace

Deployed OneLake Guard Overview report in Fabric
Trust signals open automatically in the deployed Overview report
OneLake Guard Detail page with schema drift diff
Detail — schema drift and recommended action in the same report

Ready to install?

$49 / month license — container infra billed separately.

Open Marketplace Pricing