How-to guideApplies to: Unified engine deployments
Use this Azure identity to read an existing OneLake table.
Before you start
Register the certificate with the Azure application outside Unified. Save its
PEM certificate and unencrypted PEM private key as separate secrets
recipe_azure_certificate and recipe_azure_private_key. Use the secret form for
multiline material. Grant the application access to the workspace and data.
Use an existing catalog with at least one readable Iceberg table. The engine and
workers must reach the catalog and its table storage. Have the remote identity
and permissions ready before creating the Unified registration. Replace the
namespace and table with one you know has data. The service must return usable
temporary storage credentials, or the table location must already have
configured storage access in Unified. Requesting delegation alone does not grant
access. This recipe covers the restricted OneLake read interface.
Values to collect
- Identity-specific values below; OneLake REST URI, warehouse, namespace, and
table.
Run the SQL
Replace every <placeholder> before running. Use unused names for the resources
below. Run the statements in order in Workbench.
Check the result
The SELECT should return up to five rows from the chosen table. Use a nonempty
table for this check. This verifies both metadata and table-file access;
creating the registration alone does not verify either.
Clean up
This removes only the Unified registrations. It leaves the remote catalog and
its tables in place.
Remove the input secrets only if you created them for this recipe and no other
consumer uses them.Last modified on November 4, 2026
