How to

Two steps from you. OneLake Guard does the rest.

Identity is service principal only (not managed identity). Nothing leaves your Fabric / Azure tenant — results stay in the Lakehouse you choose.

  1. Deploy the container with a service principal

    Install from Azure Marketplace (public or VNet-integrated ACI). Configure API_AUTH_KEY and service principal credentials for Fabric. Choose Daily at a set time (hour/minute) or API only (POST /run — no automatic cron). Managed identity is not used.

  2. Grant access to monitored workspaces + output Lakehouse

    Assign the service principal Viewer on workspaces to monitor and Contributor on the output workspace / Lakehouse you selected.

Then OneLake Guard runs on your trigger

On each scan (scheduled cron or POST /run) it discovers Delta tables, runs detectors, writes results back into the selected output Lakehouse, and surfaces them in the deployed Direct Lake Power BI report. API runs can optionally scope to a workspace / item / schema / table; list in-flight scans via GET /runs/active — see FAQ — Control API.

Nothing goes outside Fabric. No external SaaS data plane — scan output and the report stay in the customer’s Azure / Fabric environment.

Quick start guide — watch on YouTube

Inside Fabric

Lakehouse + report in your workspace

Deployed OneLake Guard Overview report in Fabric
Trust signals open automatically in the deployed Overview report
OneLake Guard Detail page with schema drift diff
Detail — schema drift and recommended action in the same report

Ready to install?

$49 / month license — container infra billed separately.

Open Marketplace Pricing