Home > Docs > Compliance > PCI DSS

💳 PCI DSS Compliance Mapping for Microsoft Fabric¶

Last Updated: 2026-05-05 | Version: 1.0.0

📑 Table of Contents¶

• 🎯 Overview
• 📊 Control Mapping Table
• 🤝 Shared Responsibility Model
• ⚠️ Gap Analysis and Limitations
• ✅ Implementation Checklist
• 📚 References

🎯 Overview¶

The Payment Card Industry Data Security Standard (PCI DSS) v4.0 defines security requirements for organizations that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD). PCI DSS is mandated by the major payment card brands (Visa, Mastercard, American Express, Discover, JCB) and enforced through acquiring banks and payment processors.

Applicability to Fabric¶

PCI DSS applies to Microsoft Fabric when:

• Fabric ingests or processes cardholder data (PAN, cardholder name, expiration date, service code)
• Fabric stores payment transaction data that includes full or partial PAN
• Fabric is used for payment analytics, fraud detection, or transaction reporting
• The Fabric deployment is within the cardholder data environment (CDE) boundary

Cardholder Data Elements¶

Critical: Sensitive Authentication Data (SAD) must NEVER be stored in Fabric after payment authorization, even if encrypted. Ensure data pipelines strip SAD before ingestion.

CDE Scoping in Fabric¶

flowchart TB
    subgraph CDE["Cardholder Data Environment"]
        WS1["CDE Workspace<br/>(Restricted)"]
        LH1["Lakehouse<br/>Tokenized PAN"]
        SQL1["SQL Database<br/>Transaction Data"]
    end

    subgraph Connected["Connected Systems"]
        GW["Data Gateway<br/>(Encrypted)"]
        PE["Private Endpoint"]
    end

    subgraph OutOfScope["Out of Scope"]
        WS2["Analytics Workspace<br/>(No CHD)"]
        WS3["BI Workspace<br/>(Aggregated Only)"]
    end

    GW -->|Encrypted| WS1
    PE -->|Private| SQL1
    WS1 -->|Tokenized/Aggregated| WS2
    WS2 --> WS3

📊 Control Mapping Table¶

PCI DSS v4.0 requirements mapped to Microsoft Fabric implementations:

🤝 Shared Responsibility Model¶

⚠️ Gap Analysis and Limitations¶

✅ Implementation Checklist¶

Scoping¶

• Define CDE boundary: identify all Fabric workspaces that store, process, or transmit CHD
• Document data flows: map CHD from source systems through Fabric to reporting
• Identify connected systems: gateways, data sources, downstream consumers
• Minimize scope: tokenize/hash PAN at earliest point; use aggregated data outside CDE

Network Security (Req. 1)¶

• Deploy managed VNet for CDE Fabric workspace
• Configure private endpoints for all data sources containing CHD
• Enable Outbound Access Protection to prevent data exfiltration
• Configure IP firewall rules restricting access to authorized networks
• Document network segmentation approach for QSA review

Data Protection (Req. 3, 4)¶

• Implement PAN hashing (SHA-256 with secret salt) or tokenization at Bronze ingestion
• Verify no Sensitive Authentication Data exists in any Fabric storage
• Configure CMK for Fabric SQL databases in CDE via Azure Key Vault
• Set up key rotation policy (annual minimum, per PCI DSS v4.0)
• Verify TLS 1.2+ enforcement for all connections
• Configure data retention policies — destroy CHD when no longer needed

Access Control (Req. 7, 8)¶

• Create dedicated CDE workspace with restricted membership (need-to-know only)
• Configure OneLake data access roles limiting CHD folder access
• Implement RLS in semantic models to restrict CHD visibility
• Enforce MFA for all CDE workspace users via Conditional Access
• Require phishing-resistant MFA (FIDO2/passkey) for CDE admins
• Use managed identities for automated processes (no shared credentials)

Logging & Monitoring (Req. 10)¶

• Enable Fabric admin audit logging for CDE workspace
• Configure SQL audit logs for all CDE databases
• Integrate audit logs with Microsoft Sentinel
• Create PCI-specific Sentinel analytics rules for anomalous CHD access
• Establish daily log review procedure with documented sign-off
• Set audit log retention to minimum 12 months (3 months immediately accessible)

Security Testing (Req. 11)¶

• Schedule quarterly ASV scans for in-scope external components
• Conduct annual penetration test including Fabric configuration review
• Implement continuous vulnerability scanning via Defender for Cloud
• Test incident response procedures annually

Policies & Procedures (Req. 12)¶

• Document PCI DSS security policy covering Fabric CDE
• Train all personnel with CDE access on PCI DSS requirements
• Conduct annual risk assessment including Fabric workloads
• Maintain incident response plan with Fabric-specific procedures

📚 References¶

Internal Best-Practices¶

External References¶

• PCI DSS v4.0 Standard
• PCI DSS Cloud Computing Guidelines
• Microsoft PCI DSS Attestation
• Azure PCI DSS Blueprint

This mapping reflects PCI DSS v4.0 requirements and Microsoft Fabric capabilities as of May 2026. Organizations must engage a Qualified Security Assessor (QSA) for formal PCI DSS compliance validation. This guide supports scoping and control implementation but does not replace a formal assessment.