… 4 unchanged lines …
  - Listed by Microsoft as **preview** in the data sources connector table. Treat it as preview for contractual purposes even though it works well.
  - **Managed Delta tables only.** CSV and plain Parquet are not supported, and Fabric Data Warehouse tables are not supported either.
  - Two tenant settings must be on in the Fabric admin portal: **"Users can access data stored in OneLake with apps external to Fabric"** under **OneLake settings**, and **"Service principals can call Fabric public APIs"** under **Developer settings**. The first can take about 15 minutes to take effect.
- - The **Dynamics 365 AI for Customer Insights** service principal needs the **Contributor** role on the Fabric workspace. The admin creating the data source needs at least **Viewer** on that workspace.
+ - The **Dynamics 365 AI for Customer Insights** service principal needs the **Contributor** role on the Fabric workspace that Customer Insights connects to. The admin creating the data source needs at least **Viewer** on that workspace.
+ - **Shortcut targets need their own grant.** Where a OneLake shortcut uses passthrough authentication to reach a lakehouse in another workspace in the same tenant, give the service principal either Contributor on that target workspace, or share the target lakehouse with **Read** and **Read all with Apache Spark**. `Read all with SQL analytics endpoint` alone won't work. Keep Contributor on the connected workspace either way. Delegated-authentication and external shortcuts use their configured connection identity instead.
  - Workspace and Customer Insights environment must be in the same Microsoft Entra tenant.
  - **One Fabric OneLake data source per Customer Insights workspace.** If you need tables from several Fabric workspaces, surface them into the one lakehouse using Fabric shortcuts.
  - Each table needs a primary key column with unique, non-null values, typed String, Integer or GUID.