Skip to content
DP-700 Fabric Engineer Hub

Cheatsheet: Security, Roles & Governance Decision Matrix

Cheatsheet: Security, Roles & Governance Decision Matrix

Source

  • Content type: Quick-Reference Cheatsheet
  • Target Exam: Exam DP-700
  • Date captured: 2026-08-15
  • Last reviewed: 2026-08-15

1. Workspace Roles Matrix

ActionAdminMemberContributorViewer
Update / Delete Workspace✅❌❌❌
Add / Remove Admins & Members✅❌❌❌
Add / Remove Contributors & Viewers✅✅❌❌
Create / Edit / Delete Items (LH, WH, Pipelines)✅✅✅❌
Run Pipelines / Execute Notebooks✅✅✅❌
Read Item Data via SQL Endpoint✅✅✅✅
Bypass SQL RLS/CLS via OneLake Direct Storage✅ (if ReadAll)✅ (if ReadAll)✅ (if ReadAll)❌

2. Item-Level Permissions Reference

  • Read: Allows viewing item metadata and querying data via SQL Analytics Endpoint / Power BI.
  • ReadAll: Grants access to query underlying OneLake files directly via Spark or Azure Storage SDKs (bypasses SQL RLS/CLS).
  • Write: Allows modifying item definitions and writing data.
  • Reshare: Allows sharing the item with other users in the tenant.

3. SQL Security Implementation (Warehouse & SQL Analytics Endpoint)

-- Dynamic Data Masking
ALTER TABLE Customers ALTER COLUMN Email ADD MASKED WITH (FUNCTION = 'email()');
ALTER TABLE Customers ALTER COLUMN CreditCard ADD MASKED WITH (FUNCTION = 'partial(0, "XXXX-XXXX-XXXX-", 4)');


-- Row-Level Security
CREATE FUNCTION Security.fn_UserRegionFilter(@Region VARCHAR(50))
RETURNS TABLE WITH SCHEMABINDING AS
RETURN SELECT 1 AS fn_result WHERE @Region = USER_NAME() OR IS_MEMBER('Executive_Group') = 1;


CREATE SECURITY POLICY Security.RegionPolicy
ADD FILTER PREDICATE Security.fn_UserRegionFilter(Region) ON dbo.Sales
WITH (STATE = ON);