Fabric Security Governance

Fabric Security Governance

1. Overview

Microsoft Fabric Security Governance covers the controls that protect data across the entire Fabric platform — from workspace access and item-level permissions, through sensitivity labels and data classification, to audit logs and compliance reporting. This skill provides production-ready patterns for organizations that need to demonstrate least-privilege access, regulatory compliance, and data lineage traceability across their Fabric estate.

Security layers in Fabric:

2. Quick Start

Assess a Workspace for Least-Privilege Compliance

# 1. List workspace role assignments
curl "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/roleAssignments" \
  -H "Authorization: Bearer ${TOKEN}"

# 2. Identify over-privileged users (Admin role with no admin need)
# 3. Identify orphaned access (former employees, dissolved groups)
# 4. Apply principle of least privilege: reduce Admin → Member or Contributor where appropriate

Apply a Sensitivity Label to a Fabric Item

# Apply "Confidential" label to a Lakehouse
curl -X PATCH "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/items/${ITEM_ID}/sensitivityLabel" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"sensitivityLabelId": "<label-guid>"}'

3. Workspace RBAC

Role Definitions

Principle of least privilege:

• Assign Viewer for pure consumers.
• Assign Contributor for developers who should not be able to share data externally.
• Assign Member for lead engineers who publish and share content.
• Reserve Admin for 1-2 platform owners per workspace.

Role Assignment API

# Add a security group as Contributor
curl -X POST "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/roleAssignments" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "principal": {
      "id": "<group-object-id>",
      "type": "Group"
    },
    "role": "Contributor"
  }'

# Change a user from Member to Viewer
curl -X PATCH "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/roleAssignments/${ASSIGNMENT_ID}" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"role": "Viewer"}'

# Remove access
curl -X DELETE "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/roleAssignments/${ASSIGNMENT_ID}" \
  -H "Authorization: Bearer ${TOKEN}"

Bulk Access Audit (PowerShell)

# Install required modules
Install-Module MicrosoftPowerBIMgmt -Force
Connect-PowerBIServiceAccount

# Get all workspaces
$workspaces = Get-PowerBIWorkspace -All

# Build a report of all role assignments
$assignments = @()
foreach ($ws in $workspaces) {
    $users = Get-PowerBIWorkspaceUser -WorkspaceId $ws.Id
    foreach ($user in $users) {
        $assignments += [PSCustomObject]@{
            WorkspaceName = $ws.Name
            WorkspaceId   = $ws.Id
            UserUPN       = $user.UserPrincipalName
            DisplayName   = $user.DisplayName
            Role          = $user.AccessRight
            PrincipalType = $user.PrincipalType
        }
    }
}

# Export to CSV for review
$assignments | Export-Csv "workspace-access-audit.csv" -NoTypeInformation

# Find all Admin assignments
$assignments | Where-Object { $_.Role -eq "Admin" } | Format-Table

4. Item-Level Permissions

Items (Lakehouses, Warehouses, Notebooks, Pipelines, Reports, Semantic Models) can be shared individually below workspace-level access.

Share an Item

# Share a Lakehouse with read permission
curl -X POST "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/items/${ITEM_ID}/permissions" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "recipient": {
      "objectId": "<user-or-group-object-id>",
      "principalType": "User"
    },
    "permissions": ["Read"]
  }'

Lakehouse-Specific Permissions

OneLake Data Access Roles (Preview)

OneLake data access roles provide finer-grained control at the folder/table level within a Lakehouse:

# Create a data access role restricting to specific tables
curl -X POST "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/items/${LAKEHOUSE_ID}/dataAccessRoles" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "SalesTeamAccess",
    "decisionRules": [
      {
        "effect": "Permit",
        "permission": [
          {
            "attributeName": "Path",
            "attributeValueIncludedIn": [
              "Tables/FactSales",
              "Tables/DimProduct",
              "Tables/DimCustomer"
            ]
          }
        ]
      }
    ],
    "members": {
      "fabricItemMembers": [],
      "entraMembers": [
        {
          "objectId": "<group-object-id>",
          "tenantId": "<tenant-id>"
        }
      ]
    }
  }'

5. Sensitivity Labels

Label Taxonomy Best Practices

Label inheritance: When a Lakehouse table has a Confidential label, semantic models and reports built on top of it automatically inherit the Confidential label (if the label has inheritance configured in Purview).

Sensitivity Label REST API

# List available sensitivity labels in the tenant
curl "https://api.fabric.microsoft.com/v1/sensitivityLabels" \
  -H "Authorization: Bearer ${TOKEN}"

# Apply Confidential label to a Semantic Model
curl -X PATCH \
  "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/items/${DATASET_ID}/sensitivityLabel" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"sensitivityLabelId": "<confidential-label-guid>"}'

# Bulk label all items in a workspace (PowerShell)
$items = Invoke-FabricRestMethod -Uri "workspaces/${WORKSPACE_ID}/items"
foreach ($item in $items.value) {
    Invoke-FabricRestMethod -Uri "workspaces/${WORKSPACE_ID}/items/$($item.id)/sensitivityLabel" `
      -Method PATCH `
      -Body @{ sensitivityLabelId = $CONFIDENTIAL_LABEL_ID }
}

Mandatory Label Policy

In Microsoft Purview, configure mandatory labeling policies to require users to apply a label when creating or editing Fabric items. This prevents unlabeled items from existing in the tenant.

Purview portal > Information protection > Label policies > Create policy
- Scope: Microsoft Fabric items
- Require users to apply a label: Yes
- Default label: General

6. Data Lineage

View Lineage in Fabric Portal

1. Open a Fabric workspace.
2. Click the Lineage view icon (graph icon in the top-right toolbar).
3. The lineage view shows:
   • Data sources → Lakehouses/Warehouses → Notebooks/Pipelines → Semantic Models → Reports
   • Click any item to see its upstream and downstream connections.

Lineage for Compliance Reporting

# Extract lineage using Power BI Scanner API
import requests

# Get workspace info with lineage
scanner_url = "https://api.powerbi.com/v1.0/myorg/admin/workspaces/getInfo"
scan_request = requests.post(
    scanner_url,
    headers={"Authorization": f"Bearer {ADMIN_TOKEN}", "Content-Type": "application/json"},
    json={
        "workspaces": [WORKSPACE_ID],
        "datasetSchemas": True,
        "datasetExpressions": True,
        "lineage": True
    }
)
scan_id = scan_request.json()["id"]

# Poll for scan completion
import time
while True:
    status_resp = requests.get(
        f"https://api.powerbi.com/v1.0/myorg/admin/workspaces/scanStatus/{scan_id}",
        headers={"Authorization": f"Bearer {ADMIN_TOKEN}"}
    )
    if status_resp.json()["status"] == "Succeeded":
        break
    time.sleep(10)

# Get results
result_resp = requests.get(
    f"https://api.powerbi.com/v1.0/myorg/admin/workspaces/scanResult/{scan_id}",
    headers={"Authorization": f"Bearer {ADMIN_TOKEN}"}
)
lineage_data = result_resp.json()

Microsoft Purview Integration

Connect Fabric to Microsoft Purview Data Map for enterprise-wide lineage and data catalog:

1. In the Fabric admin portal: Tenant settings > Microsoft Purview hub.
2. Connect the Fabric tenant to a Purview account.
3. Fabric items (Lakehouses, Warehouses, Semantic Models) automatically appear in the Purview Data Catalog.
4. Lineage flows from Fabric sources to downstream consumption.

7. Audit Logs

Access Fabric Audit Events

Fabric activities are logged in the Microsoft 365 Unified Audit Log under the PowerBI and Fabric categories.

# Connect to M365 compliance PowerShell
Connect-IPPSSession -UserPrincipalName admin@contoso.com

# Search Fabric audit events for a date range
$startDate = (Get-Date).AddDays(-7)
$endDate = Get-Date

$auditResults = Search-UnifiedAuditLog `
  -StartDate $startDate `
  -EndDate $endDate `
  -RecordType PowerBI `
  -Operations "ViewReport,ExportReport,CreateLakehouse,DeleteWorkspace,ShareDataset" `
  -ResultSize 5000

# Parse and export
$auditResults | ForEach-Object {
    $data = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Time        = $_.CreationDate
        User        = $_.UserIds
        Operation   = $_.Operations
        WorkspaceId = $data.WorkSpaceId
        ItemName    = $data.DatasetName -or $data.ReportName
        Details     = $data
    }
} | Export-Csv "fabric-audit.csv" -NoTypeInformation

Key Fabric Audit Operations

Audit Log Retention

• Microsoft 365 Unified Audit Log retention: 90 days (E3) or 1 year (E5/Compliance add-on).
• For longer retention, export to Azure Storage or Log Analytics:

# Stream audit logs to Log Analytics (requires Diagnostic settings in M365 compliance center)
# Or export programmatically:
$page = 1
do {
    $results = Search-UnifiedAuditLog `
      -StartDate $startDate -EndDate $endDate `
      -RecordType PowerBI `
      -SessionId "AuditExport" -SessionCommand ReturnLargeSet `
      -ResultSize 5000
    $results | Export-Csv "audit-page-$page.csv" -Append -NoTypeInformation
    $page++
} while ($results.Count -eq 5000)

8. Compliance Reporting

Generate a Data Access Report

import requests
import pandas as pd

def get_workspace_access_report(workspace_ids: list, admin_token: str) -> pd.DataFrame:
    """Generate a report of all role assignments across workspaces."""
    rows = []
    base = "https://api.powerbi.com/v1.0/myorg/admin"

    for ws_id in workspace_ids:
        users = requests.get(
            f"{base}/groups/{ws_id}/users",
            headers={"Authorization": f"Bearer {admin_token}"}
        ).json().get("value", [])

        for user in users:
            rows.append({
                "WorkspaceId": ws_id,
                "UserEmail": user.get("emailAddress"),
                "DisplayName": user.get("displayName"),
                "Role": user.get("groupUserAccessRight"),
                "PrincipalType": user.get("principalType"),
                "Identifier": user.get("identifier")
            })

    return pd.DataFrame(rows)

# Usage
df = get_workspace_access_report(workspace_ids=["ws1", "ws2"], admin_token=TOKEN)

# Flag over-privileged users
admins = df[df["Role"] == "Admin"]
print(f"Total Admin assignments: {len(admins)}")
print(admins[["WorkspaceId", "UserEmail", "DisplayName"]])

Sensitivity Label Coverage Report

# Get all items and their sensitivity labels across all workspaces
$report = @()
$workspaces = Invoke-PowerBIRestMethod -Url "admin/groups?$top=1000&$skip=0" | ConvertFrom-Json

foreach ($ws in $workspaces.value) {
    $items = Invoke-PowerBIRestMethod -Url "admin/groups/$($ws.id)/items" | ConvertFrom-Json
    foreach ($item in $items.value) {
        $report += [PSCustomObject]@{
            WorkspaceName   = $ws.name
            ItemName        = $item.displayName
            ItemType        = $item.type
            SensitivityLabel = $item.sensitivityLabel.name ?? "Unlabeled"
            LabelId         = $item.sensitivityLabel.id
        }
    }
}

# Summary: unlabeled items
$unlabeled = $report | Where-Object { $_.SensitivityLabel -eq "Unlabeled" }
Write-Host "Unlabeled items: $($unlabeled.Count) of $($report.Count)"
$unlabeled | Export-Csv "unlabeled-items.csv" -NoTypeInformation

9. Common Workflows

Workflow 1: Workspace Security Review

1. Export all role assignments using PowerShell (Section 3)
2. Identify:
   - Users with Admin role who do not need it → downgrade to Member
   - Former employees still in workspaces → remove access
   - Groups with overly broad access → replace with scoped groups
3. Review item-level shares for external recipients
4. Check sensitivity label coverage (target: 100% labeled)
5. Review audit log for ExportReport/ShareDataset operations in last 30 days
6. Document findings in access review record
7. Apply remediations via PATCH/DELETE role assignment API

Workflow 2: Regulatory Compliance Onboarding (GDPR/HIPAA)

1. Identify all items containing PII or PHI (via Purview Data Catalog scan)
2. Apply "Highly Confidential" sensitivity label to all PII/PHI items
3. Configure Purview DLP policy to block sharing of Highly Confidential items externally
4. Implement RLS on all semantic models exposing PII (limit rows to user's authorized scope)
5. Apply OLS to hide PII columns from roles that don't require them
6. Enable audit logging for all access to Highly Confidential items
7. Configure 1-year audit log retention
8. Document data lineage from PII sources to all downstream consumers
9. Schedule quarterly access reviews

Workflow 3: New Workspace Provisioning with Security Baseline

# 1. Create workspace
WORKSPACE_ID=$(curl -X POST "https://api.fabric.microsoft.com/v1/workspaces" \
  -H "Authorization: Bearer ${TOKEN}" \
  -d '{"displayName": "Analytics-ProjectX", "capacityId": "'${CAPACITY_ID}'"}' | jq -r '.id')

# 2. Assign capacity
curl -X POST "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/assignToCapacity" \
  -H "Authorization: Bearer ${TOKEN}" \
  -d '{"capacityId": "'${CAPACITY_ID}'"}'

# 3. Add role assignments
# Admins group
curl -X POST "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/roleAssignments" \
  -H "Authorization: Bearer ${TOKEN}" \
  -d '{"principal": {"id": "'${ADMIN_GROUP_ID}'", "type": "Group"}, "role": "Admin"}'
# Contributors group
curl -X POST "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/roleAssignments" \
  -H "Authorization: Bearer ${TOKEN}" \
  -d '{"principal": {"id": "'${DEV_GROUP_ID}'", "type": "Group"}, "role": "Contributor"}'
# Viewers group
curl -X POST "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/roleAssignments" \
  -H "Authorization: Bearer ${TOKEN}" \
  -d '{"principal": {"id": "'${VIEWER_GROUP_ID}'", "type": "Group"}, "role": "Viewer"}'

# 4. Apply default sensitivity label to workspace
curl -X PATCH "https://api.fabric.microsoft.com/v1/workspaces/${WORKSPACE_ID}/sensitivityLabel" \
  -H "Authorization: Bearer ${TOKEN}" \
  -d '{"sensitivityLabelId": "'${GENERAL_LABEL_ID}'"}'

10. Error Handling and Troubleshooting

11. Performance and Limits

Progressive Disclosure — Reference Files