Implement and Manage an Analytics Solution · Topic 3 of 5
Workspace and Item Access, Labels, Endorsement and Audit Logs
DP-700 security and governance: workspace roles, item permissions, sensitivity labels, endorsement (promoted, certified, master data) and audit logs.
- 5 min
- Workspace roles: Admin, Member, Contributor, Viewer; only Admin and Member manage access.
- ReadData means T-SQL reads; ReadAll means OneLake and Spark reads.
- Admin, Member and Contributor bypass granular data security because they can write.
What it is
Fabric security starts with two coarse layers. Workspace roles give a person rights over every item in a workspace, and item permissions share a single item without giving access to the rest of the workspace.
Governance features sit alongside access. Sensitivity labels classify and protect data, endorsement tells users which items they can trust, and audit logs record who did what.
How it works
Workspace-level access controls
Assign roles in Manage access to users, security groups or Microsoft 365 groups. Groups are easier to manage than individuals.
| Role | Key rights |
|---|---|
| Admin | Everything, including deleting the workspace and managing all roles |
| Member | Contributor rights plus sharing items and adding people with Member, Contributor or Viewer roles |
| Contributor | Create, edit and delete items; run notebooks and pipelines; cannot manage access |
| Viewer | View items and read data through SQL endpoints and reports; cannot edit |
Admin, Member and Contributor can write to every item, so the finer controls on the next page cannot reliably restrict them. Give analysts who only need to read the Viewer role or item permissions instead.
Item-level access controls
Sharing an item grants Read (open it and connect to it) plus optional extra permissions.
| Permission | Allows |
|---|---|
| ReadData | Read all data through the SQL analytics endpoint or warehouse with T-SQL |
| ReadAll | Read the underlying files in OneLake, for example with Spark |
| Build | Build reports on a semantic model |
| Write | Edit the item (granted through workspace roles) |
For a lakehouse, the share dialog shows these as "Read all SQL endpoint data" and "Read all Apache Spark". Sharing with Read only lets the user connect, and you then grant table permissions with T-SQL GRANT statements.
Sensitivity labels
Sensitivity labels come from Microsoft Purview Information Protection, for example Public, General, Confidential and Highly Confidential. You apply a label from the item header or its settings once the Fabric administrator has enabled labels and the user has the right license.
Labels inherit downstream: a label on a semantic model flows to reports built on it, and protected labels travel into exported files such as Excel. A domain admin can set a default label for a domain, and a mandatory labeling policy forces users to label new items.
Endorsement
| Badge | Who can apply it | Meaning |
|---|---|---|
| Promoted | Anyone with write permission on the item | The owner thinks it is ready to share |
| Certified | Reviewers authorized by the Fabric administrator | Meets the organization's quality standards |
| Master data | Users authorized by the Fabric administrator | The authoritative source for core data, such as customers or products |
Endorsed items rank higher and show badges in the OneLake catalog. You set endorsement in the item's settings.
Audit logs
Fabric records user and admin activities, such as viewing a report, running a notebook or changing permissions, in the Microsoft Purview unified audit log.
| Method | Use |
|---|---|
| Purview portal, Audit | Search by user, activity and date, then export results |
PowerShell Search-UnifiedAuditLog | Scripted search of the unified audit log |
| Activity events REST API | Fabric administrators pull activity events for their own reporting |
| Admin monitoring workspace | Prebuilt reports on feature usage and adoption |
Searching the audit log needs a Purview audit role, not just a Fabric role. A warehouse can also keep its own SQL audit logs of queries and logins, configured in the warehouse settings.
A worked example
An analyst must query three of a lakehouse's twenty tables with T-SQL, must not open other workspace items, and must not read the raw files with Spark.
Share only that lakehouse with Read (no ReadData, no ReadAll), and do not add the analyst to the workspace. Then GRANT SELECT on the three tables in the SQL analytics endpoint. If all tables were allowed, sharing with ReadData would be enough, and the analyst's queries show in the Purview audit log either way.
How the exam asks about this
- "A user must create and edit pipelines but must not add other users." Contributor.
- "Mark a lakehouse as the official source of product data." Master data endorsement.
- "Find out who changed the permissions on a warehouse last week." Search the Microsoft Purview audit log.
What to remember for the exam
- Workspace roles: Admin, Member, Contributor, Viewer; only Admin and Member manage access.
- ReadData means T-SQL reads; ReadAll means OneLake and Spark reads.
- Admin, Member and Contributor bypass granular data security because they can write.
- Sensitivity labels inherit downstream and follow data into exported files.
- Promoted needs write permission; Certified and Master data need admin-authorized users.
Giving a read-only analyst the Contributor role "so they can see everything" also lets them delete items and bypass row and folder security. Use Viewer or item sharing.
Common mistakes
Sharing a lakehouse with ReadAll when only SQL access is needed. ReadAll exposes every file through Spark; ReadData is enough for T-SQL.
Expecting Promoted to be restricted. Any writer can promote an item; restrict trust with Certified.
Looking for audit history in the Monitor hub. The Monitor hub shows runs and refreshes; who did what is in the Purview audit log.
Check yourself
Which workspace role can edit items but cannot manage access?
Contributor; managing access needs Member or Admin.
Which item permission lets a user read lakehouse files with Spark?
ReadAll ("Read all Apache Spark"); ReadData only covers T-SQL reads through the SQL analytics endpoint.
Who can certify an item?
Only users or groups the Fabric administrator has authorized to certify content.
Topic 3 of 5 in Implement and Manage an Analytics Solution
Test yourself on Implement and Manage an Analytics Solution
The full Microsoft DP-700 question bank has 645 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.