Fabric Real-Time Hub: the complete 2026 guide
Every Eventstream output. Every KQL table. Every Fabric Job event. One catalog, automatically populated, with no setup step anyone has to remember to run. This is the part of Real-Time Intelligence that doesn’t get its own headline feature announcement — but it’s the thing that makes the rest of the workload actually discoverable at tenant scale.
Real-Time Hub is a single, tenant-wide, unified, logical place for streaming data in Microsoft Fabric. Every tenant is automatically provisioned with it — no extra setup required. It lists every Eventstream output and every KQL table you have access to, alongside out-of-box connectors spanning other clouds, Kafka clusters, database CDC feeds, Microsoft streaming sources, and Fabric/Azure events. From that one catalog you can discover, process (transform a stream), analyze (query it in KQL), and act (set alerts) — without leaving the hub. (per Microsoft Learn, updated February 2026)
What Real-Time Hub actually is, separated from the marketing description
Most introductions to this feature lean on the word “unified” and stop there. Concretely, here’s what that means: every time someone in your tenant creates an Eventstream with an active output, or stands up a KQL database with a table in it, that stream or table shows up automatically in Real-Time Hub — for every other user who has permission to see it, regardless of which workspace created it.
Nobody registers anything. There’s no manifest file, no manual catalog entry, no separate metadata step. Per Microsoft Learn, every Microsoft Fabric tenant is automatically provisioned with the hub, and each user in the tenant can view and edit all the events or streams they have access to. The access model rides on top of whatever workspace and item permissions already exist — Real-Time Hub doesn’t introduce a separate permission system, it just makes everything you already have access to visible in one place instead of scattered across however many workspaces your organization runs.
Before this existed, finding out “does anyone already have a stream of our payment events” meant asking around, checking workspace by workspace, or just building a duplicate Eventstream because nobody knew one already existed. Real-Time Hub turns that into a search box.
Real-Time Hub vs Eventstream vs Eventhouse — three names people conflate constantly
This is the single most common confusion in Real-Time Intelligence terminology, and it’s worth resolving in one place before going any further, because every section after this one assumes you know the difference.
| Component | What it actually is | What you do there |
|---|---|---|
| Eventstream | The item you build — a no-code canvas connecting a source to a destination | Configure sources, apply transformations (filter, aggregate, group by), route output |
| Eventhouse | The analytical engine — contains one or more KQL Databases that store the data | Run KQL queries, build materialized views, set up update policies |
| Real-Time Hub | The tenant-wide catalog sitting above both of the above | Discover, preview, endorse, and act on every stream and table you have access to |
You build inside an Eventstream. You query inside an Eventhouse. You discover and govern from Real-Time Hub. None of the three replaces the others — they’re three different layers of the same workload, and Real-Time Hub is specifically the layer that makes the other two findable across an entire organization rather than locked inside whichever workspace created them.
The full connector catalog, by category
Per Microsoft Learn’s official connector table, Real-Time Hub’s out-of-box connectors span six distinct categories. This is the complete, current list — not a partial sample.
Two categories deserve a second look because of how recently they’ve changed. The database CDC row has grown the fastest — June 2026’s feature summary added a Mirrored Database Change Feed connector specifically, letting teams stream Delta Change Data Feed output from a mirrored database directly into an Eventstream without writing a custom Spark notebook to poll for changes. And as of June 2026, the Azure Service Bus connector under Microsoft Streaming reached general availability, after running in preview — giving production-grade stability to a connector that handles a large share of enterprise messaging traffic in financial services and healthcare specifically.
Inside Real-Time Hub, select Connect data sources from the top task cards. That takes you to the Data sources page, which is the live, current version of this exact catalog — useful to check periodically, since Microsoft adds connectors on a rolling monthly basis rather than batching them into quarterly releases.
Process, analyze, act — the three things you do with any stream
Once a stream or table is visible in Real-Time Hub, there are exactly three categories of action available on it, and Microsoft’s own documentation frames the entire workflow around this three-way split.
Reshape the stream
Open the parent Eventstream in its editor. Add transformations — Aggregate, Expand, Filter, Group by, Manage fields, Union — to reshape the data, then send the transformed output to a supported destination.
Query the data
Add a KQL Database destination to the Eventstream so output lands in a KQL table. Open the Eventhouse and run KQL queries against it directly — or, for a table already in the catalog, open its parent KQL database and query from there.
Trigger a response
Set alerts based on conditions evaluated against the stream or against Fabric events, and specify an action to run automatically when those conditions are met — the same Data Activator mechanism covered in our dedicated Activator guide.
This is a useful mental model precisely because it maps onto a real decision tree. If the data needs reshaping before it’s useful, you’re processing. If you need to ask questions of historical or current values, you’re analyzing. If you need something to happen automatically when a condition is met, you’re acting. Most production scenarios use all three in sequence — process to clean the stream, analyze to validate it’s behaving correctly, act once you’re confident in the signal.
OneLake events and Job events — the two shortcuts that remove the most setup friction
Two cards sit at the top of every Real-Time Hub home page, present whether or not you already have any streams configured. They exist because the scenarios they cover used to require building an entire Eventstream from a blank canvas just to monitor something Fabric already knows about internally.
Two additional cards appear once you already have at least one stream or table: Visualize data (a shortcut to build a Real-Time dashboard from a KQL table) and Explore data in motion (a shortcut to preview a source before committing to building anything on top of it). A Connect weather data card is also present in both states, wiring in a live public weather feed — genuinely useful as a zero-setup way to learn the Eventstream-to-KQL pattern on data that’s already flowing, before pointing the same pattern at your own production sources.
Inside the All Data Streams table — what every column and action actually means
This is the section most write-ups about Real-Time Hub skip entirely, because it requires actually being in the product rather than describing the concept from the outside. The All Data Streams table is where the catalog lives day to day, and every column carries a specific meaning worth knowing before you’re staring at it during an incident.
| Column | What it shows |
|---|---|
| Data | Name of the stream or KQL table itself — not its parent item |
| Source item | Name of the parent artifact: the Eventstream name for a stream, the KQL database name for a table |
| Item owner | Who owns the parent artifact — the person to find when you need to ask a question about the source |
| Workspace | Which workspace the parent artifact actually lives in |
| Endorsement | Whether the parent artifact has been endorsed as reviewed and trustworthy (covered in Section 07) |
| Sensitivity | The sensitivity label on the parent artifact, inherited from Purview classification |
The action menu — what the ellipsis actually does, per row
Hovering a row and selecting the ellipsis (...) surfaces a different action set depending on whether the row is a stream or a KQL table. For a stream:
Preview the live contents of the stream or a derived stream, without opening the full Eventstream editor
Jump directly to the parent Eventstream to add transformations or destinations
Mark the parent Eventstream as reviewed and trustworthy for the rest of the tenant
For a KQL table, the action set shifts to reflect that you’re working with data at rest rather than a live stream:
Open the table in a Real-Time dashboard, using Copilot to help construct the initial view
Jump to the parent KQL database to write and run queries directly
Mark the parent KQL database as reviewed and trustworthy
Run anomaly detection against the table’s historical pattern, without writing a custom KQL anomaly query by hand
Generate a starting dashboard from the table’s schema automatically
The filters above the table — Data type, Item owner, Item, and Workspace — combine with the search box, and one filter in particular is worth knowing about deliberately: setting the Workspace filter to My workspace narrows the entire catalog down to just what your own workspace produced, which is the fastest way to confirm “is this stream actually mine” when the tenant-wide view has gotten large enough to be noisy.
Endorsement and sensitivity — two different signals that look similar at a glance
The Endorsement and Sensitivity columns sit right next to each other in the catalog table, and it’s easy to assume they mean roughly the same thing. They don’t, and conflating them leads to a specific kind of governance mistake.
Endorsing a stream or KQL table is a deliberate action taken from the ellipsis menu. It tells everyone else browsing the same catalog that this particular source has been reviewed and is considered reliable for production use — the same endorsement concept Fabric already applies to datasets and reports, extended to data in motion. Endorsement changes nothing about who can access the data. It’s a recommendation, not a permission.
The Sensitivity column reflects a label applied through Microsoft Purview’s classification system on the parent artifact — Public, General, Confidential, Restricted, or whatever taxonomy your organization has configured. Unlike endorsement, sensitivity labeling is genuinely tied into governance and compliance tooling, and it travels with the data even when it’s exported outside Fabric.
The mistake this distinction prevents: assuming an endorsed stream is automatically safe to build on without checking its sensitivity label. A stream can be both endorsed (a colleague has reviewed it and considers it technically sound) and Restricted (it still contains data that only specific roles should have access to). Endorsement answers “should I trust this technically.” Sensitivity answers “who is actually allowed to see this.” Checking only one of the two columns before building a new report on top of a catalog entry is a recurring, avoidable mistake.
Starting from a sample scenario instead of a blank canvas
Real-Time Hub’s home page includes two end-to-end sample cards specifically so a new user can see all the components working together before connecting any real data. Per Microsoft Learn, selecting either one creates a full group of Real-Time Intelligence items in one action — not just a single Eventstream.
| Sample | What gets created | Best for learning |
|---|---|---|
| Bicycle rentals | A full grouped solution: source data, Eventstream, KQL database, and a dashboard built on top | Seeing the streaming → storage → visualization pipeline end to end on operational, IoT-style data |
| Stock market | The same grouped pattern, applied to financial tick-style time series data | Time series patterns specifically — windowed aggregation, rate-of-change calculations |
| Yellow taxi (via View more samples) | A single Eventstream pre-loaded with the Yellow Taxi sample as an input — not a full grouped solution | Learning Eventstream transformations specifically, without the overhead of the full pipeline |
The practical value here isn’t the sample data itself — it’s that you get a fully wired, already-functioning reference implementation sitting in your own tenant that you can open, inspect, and deliberately break to see what happens. That’s a faster way to understand how an Eventstream destination actually connects to a KQL table than reading about the connection in the abstract.
Where teams actually get stuck after the first week
Treating the catalog as a permissions boundary
Real-Time Hub shows you everything you already have access to — it doesn’t grant you anything new, and it doesn’t hide anything you already have access to behind an extra click. If a stream appears in the catalog, you could already see it through its parent Eventstream; the catalog is a discovery layer riding on existing permissions, not a separate access tier.
Building a duplicate Eventstream because the catalog wasn’t checked first
The most common waste of effort this guide has seen reported: a team builds a new Eventstream for a source that someone else in a different workspace already connected weeks earlier. A 30-second search in the All Data Streams table, filtered by item name, would have surfaced the existing stream before any duplicate work started.
Confusing “Connect weather data” as a production-relevant connector
It’s a genuinely useful learning tool and a poor mental model for what your organization’s actual connector catalog looks like. New users sometimes assume the home page cards represent the full breadth of available connectors — they’re shortcuts to common starting tasks, not the complete catalog, which lives on the Data sources page covered in Section 03.
Skipping endorsement entirely because it feels optional
It is optional in the sense that nothing breaks if you never use it. But on a tenant with more than a handful of active workspaces, an unendorsed catalog quickly becomes indistinguishable noise — every stream looks equally trustworthy or equally suspect, because nobody signaled otherwise. Endorsing the handful of genuinely production-grade sources early is cheap insurance against that noise compounding later.
Questions, answered directly
Sources and further reading
Cited in this guide
Related on UIG Data Lab
Accuracy note
Connector catalog, table columns, and action menus are verified against Microsoft Learn’s Real-Time Hub overview and Get Started guide as of June 2026. Features marked Preview (Detect anomalies, Create real-time dashboard) may change or reach general availability without notice — verify current status on Microsoft Learn before relying on them in production workflows. UIG Data Lab is an independent publication and is not affiliated with or endorsed by Microsoft Corporation.