What's changed: Deepened DP-700 Chapter 1 (ja figures; comparison tables/scenarios/FAQ/traps/deep paragraphs in all sections)
1.3Workspace Security and Governance
Understand Fabric workspace roles (Admin/Member/Contributor/Viewer), item/row-level access control, sensitivity labels and governance with Purview, and deployment pipelines. Operate the analytics platform securely.
A data platform needs control over "who can do what to which data" and organization-wide governance. Fabric handles this with roles, labels, and Purview integration.
1.3.1Security and governance
- Workspace roles: grant permissions via the Admin / Member / Contributor / Viewer hierarchy.
- Data-level control: fine-grained control via row-level security (RLS), column-level, and object permissions.
- Sensitivity labels/governance: classify data with sensitivity labels and use Microsoft Purview for auditing and lineage.
- Deployment pipelines: promote items across dev → test → prod stages for safe releases.
Common on DP-700: workspace permissions = four roles (Admin/Member/Contributor/Viewer), filter rows per user = RLS, data classification = sensitivity labels, auditing/lineage = Microsoft Purview, dev→test→prod promotion = deployment pipelines. Assign roles by least privilege.
Layer access control. Workspace roles are coarse: Admin (full management) > Member (share, almost all actions) > Contributor (create/edit) > Viewer (read-only). Narrow further with item permissions (share just a specific Lakehouse/Warehouse/report) and data-level RLS (row-level), column-level/object permissions (show a Viewer only minimal data). Governance uses Microsoft Purview and the Purview hub for classification (sensitivity labels via Information Protection, applying encryption/watermarks), lineage, auditing, and data catalog/search, improving compliance and discoverability. Manage releases with deployment pipelines (three stages dev→test→prod, promoting artifacts with diff comparison) and Git integration (connect a workspace to a repo for CI/CD). Tenant-wide feature availability is governed by admin-portal tenant settings. Summary: “coarse = workspace roles, fine = item permissions/RLS, org governance = Purview/tenant settings, releases = pipelines/Git.”
| Role | Main permissions | Use |
|---|---|---|
| Admin | Full mgmt, grant access | Administrators |
| Member | Share/reshare, almost all | Team leads |
| Contributor | Create/edit items | Developers |
| Viewer | Read-only (RLS can limit rows) | Consumers/viewers |
Scenario: show a report company-wide, but each department sees only its rows and sensitive columns only to some. → Grant viewers the Viewer role, restrict rows per department with RLS, and limit sensitive columns with column-level permissions. Classify data with sensitivity labels and track audit/lineage in Purview. Promote releases to prod via deployment pipelines.
FAQ: Q. Workspace role vs RLS? → A. Roles are coarse control of “what you can do in the workspace”; RLS is data-level control of “which rows you can see.” Use both. Q. Safe dev→prod releases? → A. Promote across three stages with deployment pipelines, or wire CI/CD via Git integration.
Trap: “the Viewer role automatically limits which rows each user sees” is wrong—row restriction is RLS (configured separately); roles are coarse action permissions. Also “sensitivity labels are the primary means to block access” is wrong—they classify/track/protect; access control is primarily roles/RLS.
1.3.2Section summary
- Permissions = workspace roles + RLS/column/object
- Governance = sensitivity labels, Purview, releases = deployment pipelines
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which are valid Fabric workspace roles for granting permissions?
Q2. You want to restrict which rows a user sees. What do you use?
Q3. Which Microsoft governance platform handles data classification, auditing, and lineage?