Microsoft OneLake is the single data lake that comes with every Microsoft Fabric tenant. Per Microsoft's OneLake overview, you cannot delete it or create a second one. It stores tables in Delta Parquet or Apache Iceberg format, two open standards that any tool can read, and every Fabric workload reads and writes the same copy.
OneLake is Microsoft's implementation of the data lakehouse idea inside Fabric. It is built on Azure Data Lake Storage Gen2 and supports the ADLS Gen2 APIs and SDKs, so tools that already talk to ADLS can talk to OneLake. There is no storage account to provision. A useful comparison is OneDrive: a company's documents live in one OneDrive, and its Fabric data lives in one OneLake. New to the platform? Start with our guide to what Microsoft Fabric is, or our Microsoft Fabric consulting page if you are already planning a rollout.
How OneLake Is Organized
The tenant sits at the top. Workspaces sit underneath it and divide ownership and access by team or project, the same way they do in Power BI. Inside each workspace, items hold the data. Lakehouses, warehouses, eventhouses, KQL databases and mirrored databases are all items, each built for a particular workload, and nearly all of them keep their data in OneLake (KQL databases are the exception, covered below).
That hierarchy shows up in the storage path. Every file in OneLake has an address of the form tenant, then workspace, then item, then the folders inside the item. Microsoft's OneLake access documentation describes the same path exposed through the ADLS Gen2 endpoint, which is why existing Azure Storage tools work against it.
The Storage Format Underneath
Microsoft says OneLake stores tables in Delta Parquet or Apache Iceberg format, and that any tool that reads those open standards can read your data. Your data is not locked into a format that only Fabric understands. Spark, SQL, Power BI's Direct Lake mode and the Fabric Data Factory pipelines all read the same files, so you do not keep a copy per engine.
OneLake vs ADLS Gen2 vs a Fabric Lakehouse
These three names come up together and get mixed up. The table separates them.
| OneLake | Azure Data Lake Storage Gen2 | Fabric lakehouse | |
| What it is | The one logical data lake for a Fabric tenant | An Azure storage account you create and manage | An item inside a Fabric workspace |
| Who creates it | Microsoft, automatically, with the tenant | You, in the Azure portal | You, in a workspace |
| Where the files live | On ADLS Gen2, managed by Microsoft | In your subscription | In OneLake, under the workspace |
| Format | Delta Parquet or Iceberg tables, plus any files | Any files | Delta tables plus a Files area |
| How it is billed | Storage per GB, separate from Fabric capacity | Storage and transactions on your Azure bill | Storage through OneLake, compute through capacity |
| When you touch it | Rarely directly. Through items, shortcuts and APIs | When you run your own lake outside Fabric | Daily, as the place tables and notebooks live |
The short version: ADLS Gen2 is a storage account you run, OneLake is the lake Fabric runs for you, and a lakehouse is one of the things you build inside OneLake.
How to Access OneLake
There are four common routes, and most teams use more than one.
- The Fabric portal. Open a lakehouse or warehouse and browse its tables and files in the browser. This is where analysts spend most of their time.
- OneLake File Explorer. A Windows application that mounts OneLake into File Explorer, so folders in your lakehouses appear next to your local drives and sync the way OneDrive folders do. Microsoft documents it under OneLake File Explorer.
- The ADLS Gen2 APIs. Azure Storage Explorer, the Azure CLI, Python SDKs and any tool that speaks the ADLS Gen2 protocol can point at the OneLake endpoint with your Microsoft Entra credentials.
- Spark and SQL. Notebooks read OneLake paths directly, and the SQL analytics endpoint on every lakehouse exposes its Delta tables to T-SQL clients and Power BI.
For a business user the first two are enough. For an engineer wiring OneLake into an existing pipeline, the third is the one that matters, because it means the pipeline does not need a Fabric-specific connector.
Shortcuts: Referencing Data Without Copying It
A shortcut is an object in OneLake that points at data stored somewhere else, without copying it. Microsoft's documentation compares it to a symbolic link. It is an independent object, so deleting the shortcut leaves the original data untouched.
- External targets: Amazon S3 and S3-compatible storage, Azure Data Lake Storage Gen2, Azure Blob Storage, Dataverse, Google Cloud Storage, OneDrive and SharePoint, and Iceberg tables. On-premises or network-restricted sources connect through the on-premises data gateway.
- Internal targets: other OneLake items, including lakehouses, warehouses, KQL databases and mirrored databases, in the same workspace or another one.
- Limits: up to 100,000 shortcuts per item, and a maximum of five direct shortcut-to-shortcut links. Microsoft says it might take up to a minute for the Table API to recognize new shortcuts.
- Caching: available for Google Cloud Storage, S3, S3-compatible and on-premises gateway shortcuts. It holds files for 1 to 28 days, and files over 1 GB are not cached.
Shortcuts are the feature that makes OneLake practical for a company that already has data in S3 or an existing ADLS account. You do not migrate first. You point Fabric at the data, start building, and move the data later if there is a reason to. If you need to bring data from several systems into OneLake, our data integration services page covers how we approach that.
OneLake Security
Security works at three layers, and it helps to know which one you are looking at.
Workspace roles come first. Admin, Member, Contributor and Viewer control what a person can do with everything in a workspace, and they are the coarsest control. Item permissions come next and apply to one lakehouse or warehouse at a time, so a user can read one item without seeing the rest of the workspace. OneLake security, described in Microsoft's OneLake security overview, is the finest layer. It defines roles on the data itself, down to folders, tables, rows and columns, and the same rule is enforced whichever engine reads the data, whether that is Spark, SQL or Power BI.
That last point is the one to remember. In a traditional estate, row-level security is defined separately in the warehouse, the semantic model and the lake. In OneLake it is defined once on the data.
OneLake Catalog
The OneLake catalog is the front door for finding data across the tenant. Microsoft's catalog overview describes it as a central place to explore, manage and govern Fabric items: you can search for a table, see which workspace owns it, open it, and check its sensitivity label and endorsement status. It is also where data owners see governance insights for the items they are responsible for. For a company with dozens of workspaces it replaces the spreadsheet of "where does this report get its numbers from".
How Storage and Compute Get Billed
Storage and compute are billed separately. That surprises people the first time they read a Fabric invoice. Per Microsoft's consumption documentation, OneLake storage is billed at a pay-as-you-go rate per GB and does not consume Fabric Capacity Units. Requests such as reading, writing or listing data do consume capacity.
The details that catch people out:
- Storage has hot, cool and cold tiers, each at its own rate, like ADLS Gen2.
- Storage keeps billing while a capacity is paused. Pausing stops compute, not storage.
- Soft-deleted data bills at the same rate as active data for the seven-day retention window, until it is permanently removed.
- For shortcuts, requests count against the capacity of the workspace where the shortcut is created, and the capacity that holds the data is billed for the storage. Requests to external services are charged by those services.
- Mirrored databases get a storage allowance tied to the size of the capacity. Above it, or while the capacity is paused, normal storage rates apply.
- Power BI import semantic models stored in OneLake are covered by Power BI licensing rather than billed as ordinary OneLake storage.
We are not quoting a dollar-per-gigabyte figure. Microsoft's Fabric pricing page varies by region and currency, so check it directly before budgeting. The Fabric Capacity Metrics app shows what you are using today.
A Few Limits Worth Knowing
OneLake's disaster recovery guidance applies only when the primary region has an Azure-paired secondary region and Fabric is supported in that region. Replication is asynchronous, and Microsoft warns that a regional failover can cause data loss and inconsistencies between files.
Microsoft's Fabric reliability guide adds two points. Changing a capacity's region requires the Multi-Geo feature, and some data stays in the home region. KQL database data is stored outside OneLake, so it needs a separate disaster recovery approach.
None of this is a reason to avoid OneLake. Check these details against your own region before you plan around them. In our experience the question that decides whether OneLake is the right home for a company's data is not any of these limits. It is whether the company's reporting will run on Power BI. If it will, keeping the data in OneLake removes a copy, a refresh schedule and a security layer that would otherwise exist between the lake and the report.
Frequently Asked Questions
What is Microsoft OneLake? OneLake is the single, logical data lake that every Microsoft Fabric tenant gets automatically. All Fabric workloads store their data in it, in open Delta Parquet or Iceberg format, so one copy of the data serves Spark, SQL and Power BI.
Do I need to set up OneLake myself? No. Every Fabric tenant comes with one OneLake instance, with nothing to provision.
What is the difference between OneLake and a lakehouse? OneLake is the storage layer for the whole tenant. A lakehouse is one of the item types you build inside it, in a workspace, with Delta tables and a Files area. Many lakehouses, warehouses and databases share the same OneLake. See What Is a Data Lakehouse? for the broader concept.
How do I access OneLake? Through the Fabric portal, the OneLake File Explorer app for Windows, any tool that uses the ADLS Gen2 APIs with your Microsoft Entra sign-in, or directly from Spark notebooks and the SQL analytics endpoint.
What is OneLake security? A set of roles defined on the data in OneLake, down to folder, table, row and column level, that every Fabric engine enforces the same way. It sits underneath workspace roles and item permissions.
Can I point OneLake at data I already have in Amazon S3? Yes, through a shortcut, without copying the data into Fabric first.
Does OneLake cost extra on top of Fabric capacity? Storage is billed separately, on a pay-as-you-go basis per GB, and keeps billing while a capacity is paused. Reading and writing that data draws on your Fabric capacity.
What happens to my data if I delete a shortcut? The original data is untouched. A shortcut points at the data without copying it.
Can I have more than one OneLake? No. Microsoft says every tenant has a single OneLake instance that you cannot delete or duplicate.
Working through what OneLake means for your current setup? Talk to Alphabyte or see our Microsoft Fabric consulting page.
