> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to Microsoft OneLake using OAuth client credentials

> Register Microsoft OneLake in Unified and read an existing table with OAuth

How-to guideApplies to: Unified engine deployments

Register Microsoft OneLake in Unified and read an existing table with OAuth
client credentials.

## Before you start

Use an existing catalog with at least one readable Iceberg table. The engine and
workers must reach the catalog and its table storage. Have the remote identity
and permissions ready before creating the Unified registration. Replace the
namespace and table with one you know has data.

Use the OneLake Iceberg REST URI and warehouse supplied for your workspace. The
identity needs access to both the selected table and its files. This recipe
covers the supported read interface.

The service must return usable temporary storage credentials, or the table
location must already have configured storage access in Unified. Requesting
delegation alone does not grant access. Local secret values require the
[encrypted secret store](https://docs.e6data.com/transformation/operations/configuration/secrets.md).

## Values to collect

* Catalog API URI, warehouse, namespace, and table.
* Client ID, client secret, and token endpoint. The example requests the OneLake storage scope.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_onelake_oauth_secret AS '<client-secret>';

CREATE CREDENTIAL recipe_onelake_oauth_auth USING oauth2
OPTIONS (
  'authentication' = 'client_credentials',
  'client_id' = '<client-id>',
  'token_endpoint' = '<token-endpoint>'
)
SECRETS ('client_secret' = 'recipe_onelake_oauth_secret');

CREATE CATALOG recipe_onelake_oauth USING `iceberg-rest`
OPTIONS (
  'uri' = '<catalog-api-uri>',
  'warehouse' = '<warehouse>',
  'catalog.type' = 'onelake',
  'auth.type' = 'oauth2',
  'oauth2-server-uri' = '<token-endpoint>',
  'scope' = 'https://storage.azure.com/.default',
  'header.x-iceberg-access-delegation' = 'vended-credentials'
)
CREDENTIALS ('auth' = 'recipe_onelake_oauth_auth');

SELECT *
FROM recipe_onelake_oauth.`<namespace>`.`<table>`
LIMIT 5;
```

## Check the result

The SELECT should return up to five rows from the chosen table. Use a nonempty
table for this check. This verifies both metadata and table-file access;
creating the registration alone does not verify either.

## Clean up

This removes only the Unified registrations. It leaves the remote catalog and
its tables in place.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_onelake_oauth;
DROP CREDENTIAL recipe_onelake_oauth_auth;
DROP SECRET recipe_onelake_oauth_secret;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.