Identity & Access Management (Entra ID)
Never grant direct user permissions on workspace items. Manage all access through governed Microsoft Entra ID groups. Enforce Multi-Factor Authentication (MFA), Conditional Access policies, and Managed Identities for automated service pipelines. Ensure non-human service principals adhere to least-privilege scoping across Fabric tenant settings.
Implementation & Verification Checklist
4 Verification Checks- Enforce Conditional Access and MFA for all Fabric administrative accounts
- Use Entra security groups for workspace assignment instead of individual user accounts
- Use Service Principals with Managed Identities for Data Factory and Spark automation
- Disable public tenant-wide sharing unless specifically authorized by SecOps
OneLake Security, RLS/CLS & Audit Evidence
Fabric security is multi-layered: Workspace Roles (Admin, Member, Contributor, Viewer), Item Permissions (Read, ReadAll, Build), OneLake Data Access Roles, and Row/Column Level Security (RLS/CLS). Always validate effective access using delegated test user personas to ensure sensitivity labels and security boundaries remain unbroken.
Implementation & Verification Checklist
4 Verification Checks- Configure OneLake Data Access Roles for fine-grained folder and table level security
- Test delegated-user Row-Level Security (RLS) across DirectLake semantic models
- Export Fabric Activity Logs and diagnostic audit events to monitored Log Analytics / Sentinel
- Verify that sensitivity labels automatically propagate from OneLake source to Power BI reports