Microsoft Fabric Governance Roles, Labels, and Lineage

What This Covers

• Where Fabric mirrors M365 (labels, DLP, auditing) — and where it breaks the rules

• Why domains + workspaces + object-level permissions upend your “inheritance” muscle memory

• How to make labels, DLP, audit, and lineage work together (without gaps)

• A field-ready checklist to harden access and speed investigations

---

TL;DR

• Don’t assume inheritance. Workspace roles ≠ dataset/report access. Check object-level permissions.

• Labels aren’t magic glue. Sensitivity labels may not auto-enforce through downstream transforms/exports.

• Audit is hybrid. Some events live in M365 Unified Audit; others only in Fabric. Consult both.

• Govern by domain. Data mesh means ownership + policy at the business domain, not just containers.

---

Mental Model Shift (M365 → Fabric)

• Containers → Domains: Organize by business area; delegate ownership and policy locally.

• Site perms → Workspace + Item perms: Roles at workspace level, plus explicit dataset/report overrides.

• Unified audit → Dual lenses: Use M365 Compliance and Fabric activity/audit panes.

• Labels as wrappers → Labels as signals: Treat labels as signals for controls, not guaranteed propagation.

---

Common “Gotchas” (and Fixes)

1. “Member can’t open the dataset.”

   • Cause: Item-level restriction.

   • Fix: Review dataset permissions; align workspace role + item ACL; document exceptions.

2. “Confidential label didn’t block export.”

   • Cause: Label applied to one artifact; downstream object not inheriting.

   • Fix: Apply label policy at data domain; test export paths; enforce with DLP where supported.

3. “I can’t find the audit trail.”

   • Cause: Event only in Fabric logs, not M365.

   • Fix: Check Fabric admin/activity logs; set retention; mirror essentials to a central workspace.

4. “Over-permissioned by accident.”

   • Cause: Workspace role + object overrides collide.

   • Fix: Least-privilege templates; quarterly access reviews; deny-by-default for high-value datasets.

---

Build-It-Right Checklist

Access & Roles

• Define domain owners; publish a RACI for permissions and publishing.

• Standardize workspace role profiles (Viewer/Contributor/Member/Admin) and when to use item-level ACLs.

• Enable Just-In-Time elevation (time-boxed Contributor/Member for admin tasks).

Labels & DLP

• Map sensitivity labels to concrete actions (share/export/mirror rules) per artifact type.

• Pilot DLP policies on risky paths (exports, copy to external, pipeline outputs).

• Maintain a label propagation matrix: dataset → report → export → downstream store.

Audit & Lineage

• Turn on Fabric activity logging + set retention; bookmark where events live (M365 vs Fabric).

• Build a lineage-first investigation view: source → dataflow/ETL → dataset → report.

• Create a “hot queries” library for audits (who changed X yesterday, who exported Y last week).

Change & Release

• Solutionize governance assets; use Dev/Test/Prod workspaces and deployment pipelines.

• Add guardrails tests: label enforcement, export attempts, cross-domain share attempts.

• Quarterly tabletop drills: simulate a leak, prove trace + containment in <60 minutes.

---

Fabric Permission Primer (Fast)

• Workspace roles:

  • Viewer: read artifacts; no build on underlying datasets unless granted.

  • Contributor/Member: create/edit; may still be blocked by item ACLs.

  • Admin: manage workspace; still respect item-level denies.

• Item permissions: Explicit ACLs on datasets/reports override expectations from workspace roles.

• Domains: Policy + ownership boundary; think “Finance,” “Sales,” “HR.” Apply label/DLP baselines per domain.

---

Investigation Playbook (Copy/Paste)

1. Scope: Identify artifact (dataset/report), workspace, domain, label.

2. Lineage map: Trace upstream sources and downstream reports/exports.

3. Event sweep:

   • M365 Unified Audit: sharing, export, external access.

   • Fabric Activity/Audit: dataset permission changes, dataflow runs, pipeline activities.

4. Reconstruct: Who/what/when (user, action, timestamp, IP/device); capture correlation IDs if present.

5. Contain: Revoke object ACLs, pause pipelines, disable share links, raise domain-wide DLP rule.

6. Prevent: Patch label policy, add export guards, create detection rule, document gap.

---

Quick Wins (This Week)

• Run a workspace vs item-level permissions diff and fix mismatches on top-10 datasets.

• Add a Fabric-only audit tile to your compliance dashboard (so you check both places).

• Pilot a “High-Value Data” domain baseline: mandatory label, blocked external share, export advisory.

• Script a quarterly access review report: who has Admin/Contributor across sensitive workspaces.

---

Policies That Scale

• Least privilege by default at item level; grant workspace roles sparingly.

• Label-before-publish: no unlabeled datasets in curated domains.

• DLP-as-guardrails: block/justify on risky actions; log everything.

• No orphan admins: tie Admin rights to groups; expire direct user grants automatically.

---

Terminology Cheat Sheet

• Domain: Business-owned boundary for policy + data stewardship.

• Workspace: Collaboration container; not a guarantee of access to every item.

• Artifact: Dataset, report, dataflow, pipeline, model, warehouse.

• Lineage: End-to-end map of data movement and transformation.