Fabric Security for Admins

Securing the foundation

At the heart of our governance model lies the principle of role-based access control within Fabric workspaces. Security posture is defined by the roles assigned to its members.

• Workspace Admins hold full control, including the ability to manage permissions, configure settings, and deploy resources.

Data Pipelines

Although all workspace Admins possess full access to the workspace and its items, their ability to maintain specific pipelines may be constrained by access limitations to the underlying source systems.

To address this governance challenge, we utilise shared connections. By default, when a pipeline is shared via Git or deployed across environments, the connection details may not transfer or may break due to authentication context.

Notebooks

In Microsoft Fabric, notebooks inherit the access permissions of the workspace in which they reside. Any user with workspace access can view the contents of a notebook.

Execution rights, however, are governed not only by workspace roles but also by the user's access to the underlying data the notebook reads or writes.

Dataflows

In Microsoft Fabric, Dataflows Gen2 are governed primarily by workspace-level permissions. Any user assigned a role above Viewer — Contributor, Member, or Admin — can view, edit, and execute Dataflows Gen2 within the workspace.

However, successful execution depends on the connection credentials used by the Dataflow.

Workspace roles in Fabric

Lakehouse Data Access — Roles, Permissions, and Controls

Accessing data in the Lakehouse is governed by a layered security model that reflects both workspace-level permissions and item-specific controls. While workspace roles determine visibility and edit rights, actual interaction with tables, files, and shortcuts can be further refined.

Access

All workspace members in Microsoft Fabric inherit access to Lakehouses within the workspace by default. However, OneLake Security, when enabled, takes precedence over workspace-level permissions.

RBAC in spl_gold_lh

At this stage, direct access to spl_gold_lh via the SQL endpoint is restricted to members of the PBI Power Users group.

To facilitate controlled access, a dedicated database role named powerusers has been created within the Lakehouse. Schema-level access control is enforced via this role.

RBAC in shared_data_lh

Check the securityRoles query in the Queries → Shared queries section of shared_data_lh.

Who can access all Lakehouses?

• Power BI Admin group
• Fabric_Connector (SPN for Board)
• Roxana Stauber

Access level based on role

flowchart TB
    subgraph SU[Super Users — all Lakehouses]
        SU1[Power BI Admin group]
        SU2[Roxana Stauber]
        SU3[Fabric_Connector SPN]
    end
    subgraph DEV[Developers — spl_gold_lh only]
        D1[Kazerounian Sanaz]
        D2[Dubkov Andrii]
        D3[Alexander Sachsenmaier]
        D4[Diaz Marcos]
    end
    subgraph SPN[SPNs — shared_data_lh only]
        S1[Fabric Odoo Reader]
        S2[Fabric AI Reader]
    end
    SU --> ALL[(All Lakehouses
incl. Bronze + Silver + Gold)]
    DEV --> GOLD[(spl_gold_lh)]
    SPN --> SHARED[(shared_data_lh)]
    classDef gold fill:#ffd54f,stroke:#b45f06,stroke-width:1px,color:#000
    classDef shared fill:#c8e6c9,stroke:#2e7d32,stroke-width:1px
    class GOLD gold
    class SHARED shared

Lifecycle Management

Microsoft Fabric provides a unified platform for managing the full lifecycle of both data assets and workspace content — from ingestion and transformation to deployment and governance.

Lifecycle for workspace items

Fabric supports continuous integration and deployment through core features like Git integration and deployment pipelines.

Git Integration

The Fabric workspace is connected to the Fabric repository in the SPL Tele GitHub. This GitHub repository serves as the source control for the Fabric workspace. Contributors can use this repository to track changes, manage deployments, and collaborate efficiently on workspace enhancements.

→ Setup-Details: Git Integration in Fabric

Deployment pipelines

Deployment pipelines automate the promotion of items across environments (Development → Test → Production). At this stage, only a test deployment pipeline is being used in our implementation. This pipeline serves as a deployment method to push items from the Fabric_Dev workspace.

Data retention policy

In Fabric Lakehouses, data is typically stored in Delta tables, which maintain transactional logs and version history. Over time, these logs accumulate obsolete files and metadata. To manage this:

• A weekly automated VACUUM operation is executed via notebook. This operation cleans up unreferenced files older than the retention threshold.

Separately, data in the Lakehouse as shortcuts from the ADLS Gen2 account has a separate lifecycle management — the blobs are deleted after 30 days.

Disaster recovery

When you delete a table or file from a Lakehouse in Fabric, it is not immediately and permanently erased. Instead, the system retains the deleted object for 7 days, during which it can be recovered.

This applies to:

• Delta tables
• Individual files or folders
• Lakehouse metadata

→ More: Microsoft Fabric disaster recovery experience — specific guidance (Microsoft Learn)

Key points

• GitHub for CI/CD of workspace items
• Deployment pipeline running in Fabric_Dev
• Lakehouse VACUUM runs weekly
• Data is soft-deleted and can be recovered within 7 days