Skip to content
DP-700 Fabric Engineer Hub

Implement Security and Governance for Fabric Data Engineering

Implement Security and Governance for Fabric Data Engineering

Source

Summary

This module covers enterprise access control, fine-grained data security (RLS, CLS, OLS, Dynamic Data Masking), workspace roles, item permissions, Microsoft Purview sensitivity labels, and secure networking in Microsoft Fabric.

Security Architecture & Controls

1. Workspace Roles vs Item Permissions

RoleCapabilitiesPrimary Persona
AdminFull control: delete workspace, assign roles, manage capacitiesPlatform Administrator
MemberCreate items, edit workspace, share items, configure permissionsLead Data Engineer / Architect
ContributorCreate, edit, and delete workspace items (cannot modify workspace roles)Data Engineer / Developer
ViewerRead-only access to items; cannot edit code or execute pipelinesBusiness Analyst / Stakeholder
  • Item-Level Permissions: Read, ReadAll (bypasses downstream SQL security to read raw OneLake files), Write, Reshare.

2. Fine-Grained Data Security in SQL Analytics Endpoint & Warehouse

  • Row-Level Security (RLS): 
    -- Security predicate function
    CREATE FUNCTION Security.fn_securitypredicate(@Region AS VARCHAR(50))
        RETURNS TABLE
    WITH SCHEMABINDING
    AS
        RETURN SELECT 1 AS fn_securitypredicate_result
        WHERE @Region = USER_NAME() OR USER_NAME() = 'Admin';
    

    -- Apply security policy
    CREATE SECURITY POLICY Security.SalesFilter
    ADD FILTER PREDICATE Security.fn_securitypredicate(Region)
    ON dbo.fact_sales
    WITH (STATE = ON);
  • Column-Level Security (CLS): Granting SELECT on specific columns while restricting sensitive columns (e.g., SSN, Salary).
  • Dynamic Data Masking (DDM): Obfuscates sensitive fields in query output for unauthorized users (e.g., MASKED WITH (FUNCTION = 'partial(1, "XXXXXXX", 0)')).

3. Microsoft Purview & Information Protection

  • Sensitivity labels applied to Fabric items automatically inherit encryption and data protection policies.
  • Lineage tracking and automatic discovery in Microsoft Purview Data Map.

Exam Traps & Gotchas

[!CAUTION]

  • ReadAll Permission Security Bypass: Granting ReadAll on a Lakehouse allows users to read underlying Delta parquet files directly via Spark or Azure Storage APIs, bypassing SQL-defined Row-Level Security (RLS) and Column-Level Security (CLS).
  • Direct Lake Fallback to DirectQuery: If RLS or CLS is applied directly on SQL Analytics Endpoint tables consumed by Power BI, Direct Lake mode will fallback to DirectQuery.