Microsoft Fabric Governance Interview Questions (2026 Guide)

Tenant (top level, bound to Entra ID) → Domain (logical business-unit grouping) → Workspace (security and billing boundary) → Item (Lakehouse, Warehouse, Report, etc.). Every governance policy — tenant settings, capacity limits, sensitivity labels — cascades through this structure.

Domains enable federated governance (Data Mesh) — group workspaces by business unit (Finance, HR) and delegate Domain Admin rights to business owners instead of centralizing every workspace decision in IT. Departments manage their own workspace creation and policy while still adhering to tenant-wide baseline settings.

Tenant Settings apply globally (e.g., “Allow creating Fabric items”). Capacity Settings apply to specific compute infrastructure (e.g., an F64’s Spark configuration). Some tenant settings can be delegated for override at the Domain or Capacity level, enabling granular control over features like Copilot or export permissions per business unit.

Avoid one workspace per user. Align workspaces with projects or lifecycle stages (Sales_Dev, Sales_Prod). Separate data workspaces (Lakehouses) from reporting workspaces (Power BI Apps) to enforce a “Golden Dataset” architecture with stricter security on the data layer than on the consumption layer.

Workspace Identity is a managed identity feature letting the workspace itself authenticate against trusted Azure services (ADLS Gen2, Key Vault) without depending on a specific user’s credentials. Pipelines keep running reliably even if the original creator’s account is disabled or leaves the organization.

No. “My Workspace” is a personal sandbox that cannot be assigned to a Fabric Capacity (except in Trial) and lacks collaborative and governance features. Enterprise Microsoft Fabric Governance strategy should explicitly prohibit production content in personal workspaces via tenant policy.

Database Hub (announced FabCon 2026) is a unified surface for managing Azure SQL, Cosmos DB, PostgreSQL, and on-premises databases via Arc — all from within Fabric, with AI-assisted management surfacing what changed, why it matters, and recommended next steps. It extends governance visibility beyond Fabric-native items into the broader database estate.

Admin (full control including deletion), Member (create/edit/share), Contributor (create/edit, no sharing), Viewer (read-only report access). The risk: Viewers may still query underlying data via SQL Endpoints if workspace settings allow it — “read-only” doesn’t always mean what it sounds like.

Workspace roles grant access to every item in the workspace. Item-level sharing grants access to a single report or Lakehouse without adding the user to the workspace at all — the correct choice when someone needs one specific artifact and nothing else, adhering to least-privilege.

If “Users can view artifacts” is enabled at the workspace level, Viewers can connect directly to a Lakehouse’s SQL Endpoint and query tables — well beyond viewing a report. Close this gap with SQL DENY commands or, as of 2026, OneLake Security roles that enforce access consistently regardless of entry point.

OneLake Security reached GA at FabCon Atlanta 2026 — a unified RBAC model with row-level, column-level, and folder-level controls, including column masking and predicate row-level security, all enforced through a single model that follows the data across Spark, T-SQL, and Power BI. It supersedes the narrower, folder-only OneLake Data Access Roles.

Warehouse RLS via T-SQL policies only protects SQL-routed queries — Spark reading the underlying Delta files directly has historically bypassed it. OneLake Security closes this gap by enforcing row and column rules at the OneLake layer itself, so the same restriction applies regardless of whether Spark, T-SQL, or Power BI reads the data.

Shortcuts typically use delegated authorization — the reading user’s access is evaluated using the shortcut creator’s identity or a bound credential. For ADLS Gen2 shortcuts specifically, you can configure passthrough identity so the end-user’s own ACLs are checked at the source instead.

Define a OneLake Security role scoped to a table or folder, attach a column mask (e.g., partial redaction on a phone number column) and a predicate condition (e.g., row visible only where Region = user's assigned region). The role, once defined, enforces identically whether the table is queried via Spark, the SQL Endpoint, or Power BI Direct Lake.

Fabric integrates with Microsoft Purview Information Protection (MIP). Apply labels (e.g., “Highly Confidential”) to items, and they travel with the data — export a labeled Lakehouse’s data to Excel and the resulting file is automatically encrypted and labeled to match.

Microsoft replaced parent labels with label groups, offering more flexible organization of label hierarchies. Tenants created after October 2025 use the new schema automatically; older tenants may still be on the legacy parent-label structure and should verify before assuming label group functionality is available.

As of March 2026, sensitivity labels are accessible via public APIs. List Items and Get Item API responses now include the Sensitivity Label ID, and the Create Item API accepts a label ID so new items are created pre-labeled. This enables infrastructure-as-code governance pipelines and partner tooling to manage labeling at scale without manual per-item intervention.

Security insights previously in the Microsoft Purview Hub have moved to the Govern tab of the OneLake catalog, consolidated into an enhanced Admin Report. The Purview Hub report was fully removed by the end of January 2026 — any documentation or muscle memory pointing to “Purview Hub” for Fabric governance reporting is now stale.

Nearly every interaction: viewing reports, running Spark jobs, executing SQL queries, exporting data, and modifying permissions. For OneLake specifically, data access events (reading a file) are also logged, giving a complete trail for compliance investigations, accessible via the Microsoft Purview audit log.

Purview DLP policies on structured data in OneLake reached GA (announced FabCon Vienna, September 2025), covering lakehouses, warehouses, and KQL/SQL databases. Policies detect uploads of sensitive data (credit card numbers, SSNs) into OneLake and can trigger policy tips for users or enforce access restrictions on classified assets.

Purview Insider Risk Management (IRM) is GA for Fabric, extending built-in risk indicators to Power BI user activities — viewing, downloading, exporting, and managing sensitivity labels. These indicators feed directly into data theft and data leak policies, correlating signals across activities to surface potential insider threats like unauthorized data sharing.

Data Security Posture Management (DSPM) for AI began public preview in December 2025, with GA expected around May 2026. It flags sensitive data appearing in AI agent prompts and responses — a governance layer specifically for AI interactions, distinct from traditional data-at-rest protections. It also ingests third-party signals from partners like Varonis, BigID, Cyera, and OneTrust for multi-cloud visibility.

F-SKUs are the unified compute units for all Fabric workloads — Spark, SQL, Power BI — ranging from F2 to F2048. Unlike P-SKUs, F-SKUs support pay-as-you-go billing via Azure and can be paused and resumed to control cost.

Fabric doesn’t throttle immediately on a usage spike. Interactive usage (reports) smooths over 5 minutes; background usage (ETL) smooths over 24 hours. This lets you burst temporarily without penalty, as long as average usage stays within capacity limits over the smoothing window.

Bursting lets a job use more CUs than purchased, borrowing against future idle capacity. Smoothing averages that usage over time. Sustained bursting accumulates a CU “debt” — eventually Fabric applies Interactive Delay (throttling) until idle time repays the debt.

The Capacity Metrics App shows CU consumption by item, workspace, and operation. A “noisy neighbor” — a poorly written Spark job or query consuming a disproportionate share of capacity — is identified by comparing per-item consumption against total capacity, then either optimizing or moving the offending workload.

Pausing an F-SKU stops compute billing entirely, but data and reports become inaccessible. OneLake storage costs continue regardless of pause state. Ideal for Dev/Test capacities only needed during business hours.

No. As of 2025, Fabric Copilot and AI capabilities became accessible to all paid SKUs, not just F64 and above. Tenant admins must still explicitly enable the relevant AI settings, but F64 is no longer the access gate it originally was.

Impact Analysis shows every downstream item affected by a proposed change. In Lineage View, selecting a Lakehouse reveals all Semantic Models and Reports depending on it — run this before any schema change to avoid breaking production dashboards.

The Admin APIs (Scanner API) programmatically extract tenant-wide metadata — workspaces, items, users, access rights — used to build custom catalogs or audit compliance questions like “find all reports shared with external users.” The Scanner API remains the programmatic layer beneath the OneLake catalog’s UI-level Govern tab reporting.

Promoted: any content owner can self-promote an item as “ready for use.” Certified: a restricted status controlled by governance settings, used by central IT to designate “Golden Data” that has passed formal quality checks. Certified items rank higher in the OneLake Data Hub / catalog.

Lineage typically breaks at the tenant boundary. With External Data Sharing (in-place sharing) from another Fabric tenant, the external data source appears in the lineage view, but detailed upstream lineage inside the other tenant is usually hidden for security reasons.

Sub-Domains (nested domains) mirror complex org structures — e.g., Finance → Tax — with Domain Admins assignable at each level. This improves discoverability in the OneLake catalog, letting users filter by “Finance” or drill into “Finance → Tax” specifically.

The Admin Monitoring workspace still exists and provides feature usage and adoption reports, but the security and compliance-specific insights that used to require cross-referencing the Purview Hub are now consolidated into the OneLake catalog’s Govern tab alongside it — reducing the number of places an admin needs to check for a complete governance picture.

Private Endpoints secure access to the Fabric portal and OneLake from your Azure VNet, keeping traffic off the public internet but requiring careful DNS configuration and blocking public access entirely. Trusted Workspace Access instead lets Fabric Pipelines in specific workspaces reach firewall-protected Azure resources (like ADLS Gen2) using Workspace Identity as a trusted Microsoft service credential, without needing a VNet Gateway at all.

Fabric integrates with Entra ID Conditional Access, enforcing policies like mandatory MFA or geo-blocking for Fabric users. This adds identity-layer security on top of Fabric’s internal permission model — the two layers are complementary, not substitutes for each other.

External Data Sharing (in-place sharing) lets you share a Lakehouse or KQL Database with a user in another tenant without copying data — they see it directly in their own OneLake. Separately, Mirroring interoperability expanded significantly in 2026: Oracle and SAP Datasphere mirroring reached GA, SharePoint lists and Dremio are in Preview, and Databricks Unity Catalog can now read OneLake data natively (Public Preview), with Snowflake interoperability GA.

CMK lets regulated organizations bring their own encryption key (stored in Key Vault) to encrypt OneLake data at rest. Revoking the key makes the data instantly unreadable to everyone — including Microsoft — providing a hard kill-switch for the most sensitive workloads.

Microsoft manages OneLake storage replication (ZRS/GRS depending on region) and control-plane resiliency during a regional outage. Customers are responsible for their own recovery strategy for code artifacts (via Git) and data pipeline re-deployment — Fabric’s built-in BCDR does not cover application-level recovery.

Delegate Capacity Admin rights to IT leads and Domain Admin rights to business unit leads, so routine tasks — workspace access requests, capacity monitoring — are handled locally rather than queuing through a single tenant admin. This mirrors the federated governance model Domains were designed to enable.