OneLake delegated shortcut still denies users: test both permission paths

A producer lakehouse is exposed in a consumer workspace through a delegated OneLake shortcut. The service principal can read the producer, yet an end user still sees an access error. A Fabric practitioner question describes that expectation gap. The question is useful evidence of confusion, not proof that Fabric ignores delegated authentication.

Identify the shortcut's actual mode

Record shortcut type, creation date, target path and connection. Microsoft documents passthrough and delegated modes for same-tenant OneLake shortcuts. Passthrough is the default; delegated must be selected when the shortcut is created. Changing the intended mode later requires recreating the shortcut, so a service-principal connection elsewhere in the workspace does not prove this shortcut uses it.

Test both sides of the intersection

For a delegated shortcut, verify the configured connection identity can read the producer target. Then verify the end user has the required permission on the consumer shortcut path and item. Microsoft's model says effective access is constrained by both paths. Make an access matrix with three personas: producer owner, connection identity and ordinary consumer. Test with the same file or table through the same engine; an admin's success is not evidence that a Viewer can read it.

Account for query-engine exceptions

Direct Lake over SQL and T-SQL in delegated identity mode can use the item owner's identity for target access, then apply OneLake roles to the caller's view. Spark and direct API access have their own item-read requirements for external shortcuts. Do not generalize a notebook result to a SQL endpoint, or the reverse. Write down the engine and identity mode in every support ticket.

Adovo’s view

A shortcut is a route to data, not a new owner of the data. Delegation changes which identity reaches the target; it does not remove the need to define what the caller may see. Access becomes predictable when the team can name the identity, path and engine for every read.