'%3e%3cg%20transform='translate(0%200)'%20clip-path='url(%23a)'%3e%3cpath%20d='M115.449,63.552a36.148,36.148,0,0,1-5.422-.418A43.162,43.162,0,0,1,86.866,51.671L65.554,31.142,49.589,47.105a4.338,4.338,0,1,1-6.136-6.132L59.3,25.118l-6.5-6.266A4.342,4.342,0,1,1,58.82,12.6l6.623,6.377L81.894,2.521a4.356,4.356,0,0,1,6.147,0,4.36,4.36,0,0,1,0,6.144L71.7,25,92.853,45.379a34.433,34.433,0,0,0,18.512,9.167,26.307,26.307,0,0,0,4.047.32,24.116,24.116,0,0,0,10.812-2.548c5.818-2.9,10.991-8.25,15.376-15.906a4.322,4.322,0,0,1,5.92-1.616,4.338,4.338,0,0,1,1.617,5.92c-5.25,9.183-11.661,15.7-19.051,19.377a32.516,32.516,0,0,1-14.636,3.459'%20transform='translate(12.691%200.377)'%20fill='%23fff'%3e%3c/path%3e%3cpath%20d='M155.17,40.416a4.926,4.926,0,1,1,4.926-4.926,4.932,4.932,0,0,1-4.926,4.926'%20transform='translate(45.206%209.196)'%20fill='%23ab00f1'%3e%3c/path%3e%3cpath%20d='M44.06,0a4.346,4.346,0,0,0-4.341,4.341V6.218l-1.3-.952A23.922,23.922,0,0,0,24.2.63a24.2,24.2,0,0,0,0,48.4,23.95,23.95,0,0,0,14.242-4.645l1.2-.882.1,1.49a4.336,4.336,0,0,0,8.663-.3V4.341A4.346,4.346,0,0,0,44.06,0M24.2,40.339A15.514,15.514,0,1,1,39.719,24.825,15.532,15.532,0,0,1,24.2,40.339'%20transform='translate(0%200)'%20fill='%23fff'%3e%3c/path%3e%3cpath%20d='M103.077.481a24.2,24.2,0,1,0,24.2,24.2,24.229,24.229,0,0,0-24.2-24.2m0,39.717a15.516,15.516,0,1,1,15.514-15.516A15.535,15.535,0,0,1,103.077,40.2'%20transform='translate(23.732%200.145)'%20fill='%23fff'%3e%3c/path%3e%3cpath%20d='M164.56,35.221a4.349,4.349,0,0,1-4.344-4.344V23.9a15.209,15.209,0,1,0-30.419,0,4.342,4.342,0,1,1-8.685,0,23.895,23.895,0,0,1,47.789,0v6.982a4.349,4.349,0,0,1-4.342,4.344'%20transform='translate(36.441%200)'%20fill='%23fff'%3e%3c/path%3e%3cpath%20d='M46.655,10.867A4.926,4.926,0,1,1,51.582,5.94a4.932,4.932,0,0,1-4.926,4.926'%20transform='translate(12.556%200.305)'%20fill='%23ab00f1'%3e%3c/path%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
Identity and access
Fabric uses Entra ID (formerly Azure AD) for identity, so users, groups, and conditional access policies you already have apply automatically. Permissions are layered: tenant settings control what is available, workspaces control who can build, and item-level permissions control who sees specific reports, lakehouses, or warehouses. Use groups, not individual users, for anything you expect to last more than a quarter.
Workspace design
Workspaces are where most governance lives in practice. A clean pattern: one workspace per domain (finance, ops, sales), with development, test, and production variants. Avoid the temptation to have one shared workspace for everything; it becomes ungovernable fast and you lose the ability to promote changes safely.
Sensitivity labels
Microsoft Purview sensitivity labels flow into Fabric. Labels applied to a dataset travel with the data when it is exported to Excel, PowerPoint, or PDF, and they show up in Power BI reports. If your business already classifies documents, extending the same labels to Fabric is one of the highest-value governance moves you can make.
OneLake security
Because OneLake is shared across the tenant, getting OneLake permissions right matters more than getting any single workload right. Use OneLake security to control read access at the data level, and remember that shortcuts inherit the permissions of the source, not the workspace you put them in.
Auditing and monitoring
Fabric activity flows into the Microsoft 365 audit log, so the same tooling your security team uses for Teams and SharePoint covers Fabric. The Fabric admin portal also has its own monitoring views for capacity usage, which is worth watching weekly during rollout to catch a runaway dataset before it slows everything down.
Five controls to set up before you scale
One: restrict who can create workspaces (default is everyone, which gets messy fast). Two: define a naming convention for workspaces and items. Three: turn on sensitivity labels and require them on new items. Four: set up domain-based workspace structure rather than department-based. Five: review tenant settings monthly during the first quarter, then quarterly thereafter.
Row-level and object-level security
Beyond workspace permissions, Fabric supports row-level security (RLS) and object-level security (OLS) in semantic models. RLS filters what individual users see within the same report - a regional sales manager only sees their region, even though the dashboard is shared with the whole sales team. OLS hides specific tables or columns - HR data can live in a model that other users access, but salary fields stay invisible to anyone outside HR. Both flow through to Copilot, so a Copilot answer never reveals data the user could not otherwise see.
Compliance and certifications
Fabric inherits the compliance posture of the wider Microsoft cloud. That includes ISO 27001, ISO 27018, SOC 1 and SOC 2, GDPR, HIPAA in regions where it applies, and the UK Cyber Essentials Plus scheme. For UK businesses in regulated sectors (financial services, healthcare, legal) that means there are usually no fresh certifications to chase before adopting Fabric - the existing Microsoft 365 compliance evidence covers most of it. Your data residency follows your tenant region, so a UK tenant keeps OneLake data in UK Azure regions by default.
Governance roles worth defining
Two roles make the difference between a tidy Fabric estate and a chaotic one. A platform owner (usually in IT) who controls tenant settings, capacity, and the workspace catalogue. And a domain owner per major business area (finance, sales, ops) who controls what gets published into that domain and approves new datasets. Without the second role, every dashboard tends to land in a shared workspace and governance dies a slow death. With it, each domain self-governs within a clear shared framework.
If you want help setting this up, see our Microsoft Fabric and data readiness pages.