Home > Docs > Compliance > FedRAMP

☁️ FedRAMP Compliance Mapping for Microsoft Fabric¶

Last Updated: 2026-05-05 | Version: 1.0.0

📑 Table of Contents¶

• 🎯 Overview
• 📊 Fabric FedRAMP Authorization Status
• 🗺️ Control Mapping Table
• 🤝 Shared Responsibility Model
• ⚠️ Gap Analysis and Limitations
• ✅ Implementation Checklist
• 📚 References

🎯 Overview¶

The Federal Risk and Authorization Management Program (FedRAMP) provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by US federal agencies. FedRAMP is built on NIST 800-53 controls with additional requirements for cloud service providers (CSPs).

Applicability to Fabric¶

FedRAMP applies to Microsoft Fabric when:

• A federal agency consumes Fabric services (directly or via system integrator)
• Fabric processes, stores, or transmits federal data
• Fabric is part of a system boundary seeking an Authority to Operate (ATO)
• The deployment handles Controlled Unclassified Information (CUI)

FedRAMP Impact Levels¶

📊 Fabric FedRAMP Authorization Status¶

Current State (May 2026)¶

Key Point: Microsoft Fabric in Azure Commercial inherits the FedRAMP Moderate Provisional ATO through Azure's authorization. However, Fabric-specific capabilities (OneLake, Eventhouse, Data Engineering) may require additional agency-level assessment.

Authorization Path¶

flowchart LR
    subgraph CSP["Cloud Service Provider (Microsoft)"]
        A[Azure FedRAMP P-ATO] --> B[Fabric Inherits P-ATO]
        B --> C[3PAO Assessment of Fabric-Specific Controls]
    end

    subgraph Agency["Federal Agency"]
        D[Agency Security Assessment] --> E[Agency ATO for Fabric Workload]
        E --> F[Continuous Monitoring]
    end

    C --> D

🗺️ Control Mapping Table¶

The following maps key FedRAMP Moderate baseline controls to Fabric implementations. FedRAMP uses NIST 800-53 controls with additional cloud-specific requirements. See the NIST 800-53 mapping for the full control family breakdown.

🤝 Shared Responsibility Model¶

FedRAMP defines explicit CSP and customer responsibilities. In the Fabric context:

⚠️ Gap Analysis and Limitations¶

✅ Implementation Checklist¶

Pre-Authorization¶

• Determine FedRAMP impact level (Low/Moderate/High) based on data classification
• Verify Azure region has FedRAMP P-ATO at required impact level
• Confirm Fabric availability in target region (Commercial vs. GCC)
• Identify inherited controls from Azure P-ATO vs. customer-configured controls
• Engage 3PAO for Fabric-specific security assessment if required

Identity & Access¶

• Configure Entra ID Conditional Access with MFA for all Fabric users
• Configure certificate-based authentication (CBA) for PIV/CAC if required
• Implement privileged access policies (phishing-resistant MFA for admins)
• Configure workspace RBAC with least privilege roles
• Enable automated access reviews for quarterly recertification

Audit & Monitoring¶

• Enable Fabric admin audit logging with required event coverage
• Configure SQL audit logs for all Fabric SQL databases
• Set up Microsoft Sentinel with Fabric data connector
• Create ConMon dashboards for weekly audit log review
• Configure automated alerting for security-relevant events
• Set audit log retention to meet agency requirements (min 1 year for Moderate)

Network & Encryption¶

• Deploy managed VNet for Fabric workspace
• Configure private endpoints for data sources
• Enable Outbound Access Protection
• Verify TLS 1.2+ enforcement for all connections
• Configure CMK for Fabric SQL Database via Azure Key Vault
• Document encryption status for all data stores in SSP

Configuration & Change Management¶

• Implement Bicep templates for all infrastructure (version-controlled)
• Deploy fabric-cicd pipeline with PR review gates
• Document tenant settings baseline and hardening rationale
• Establish Spark runtime migration schedule for patching

Continuous Monitoring¶

• Develop ConMon plan with monthly scan schedule
• Configure Defender for Cloud vulnerability assessments
• Schedule annual security assessment with 3PAO
• Establish POA&M tracking for open findings
• Set up automated monthly reporting to agency AO

📚 References¶

Internal Best-Practices¶

External References¶

• FedRAMP Marketplace
• FedRAMP Security Assessment Framework
• Microsoft FedRAMP Documentation
• Azure Government Compliance
• NIST 800-53 Rev. 5

This mapping reflects FedRAMP Moderate baseline requirements and Microsoft Fabric capabilities as of May 2026. Federal agencies must conduct their own security assessment and obtain an agency-specific ATO before processing federal data in Fabric.