Fabric Implementation Guide · Part 3 of 10

Defense-in-Depth Security Standard

Implement multi-layered security spanning Entra ID conditional access, workspace RBAC, OneLake data-access roles, RLS/CLS, and audit logging.

Target Audience: Security Engineers, Fabric Admins, and Compliance Leads
Estimated Read Time: 12 min

01Identity & Access Management (Entra ID)

Never grant direct user permissions on workspace items. Manage all access through governed Microsoft Entra ID groups. Enforce Multi-Factor Authentication (MFA), Conditional Access policies, and Managed Identities for automated service pipelines. Ensure non-human service principals adhere to least-privilege scoping across Fabric tenant settings.

Implementation & Verification Checklist

  • Enforce Conditional Access and MFA for all Fabric administrative accounts
  • Use Entra security groups for workspace assignment instead of individual user accounts
  • Use Service Principals with Managed Identities for Data Factory and Spark automation
  • Disable public tenant-wide sharing unless specifically authorized by SecOps

02OneLake Security, RLS/CLS & Audit Evidence

Fabric security is multi-layered: Workspace Roles (Admin, Member, Contributor, Viewer), Item Permissions (Read, ReadAll, Build), OneLake Data Access Roles, and Row/Column Level Security (RLS/CLS). Always validate effective access using delegated test user personas to ensure sensitivity labels and security boundaries remain unbroken.

Implementation & Verification Checklist

  • Configure OneLake Data Access Roles for fine-grained folder and table level security
  • Test delegated-user Row-Level Security (RLS) across DirectLake semantic models
  • Export Fabric Activity Logs and diagnostic audit events to monitored Log Analytics / Sentinel
  • Verify that sensitivity labels automatically propagate from OneLake source to Power BI reports