Skip to content

Security Admin Quickstart

Last Updated: 2026-05-05 | Role: Security Admin Goal: Secure your Fabric environment with defense-in-depth controls, governance policies, encryption, audit logging, and regulatory compliance frameworks.

Persona & Typical Day

You define and enforce the security posture of your organization's Fabric deployment. A typical day involves reviewing audit logs for anomalous access patterns, managing data classification labels, configuring customer-managed encryption keys, responding to compliance questionnaires, ensuring PII handling meets regulatory requirements, and coordinating with platform admins on network security controls.

You care about data protection, regulatory compliance, least-privilege access, auditability, and being able to prove controls work during audits.

Your First 30 Minutes

Follow these steps to establish baseline security controls:

  1. Understand the security architecture - Review how OneLake Security, workspace roles, and item permissions layer together. OneLake Security

  2. Configure data governance with Purview - Set up data classification, sensitivity labels, and lineage tracking. Tutorial 07: Governance & Purview

  3. Enable SQL audit logging - Configure audit logs to capture all data access and administrative actions for compliance. SQL Audit Logs Compliance

  4. Review RBAC patterns - Ensure workspace and item-level permissions follow least-privilege principles. Identity & RBAC Patterns

  5. Set up customer-managed keys - Configure CMK for encryption at rest to meet data sovereignty requirements. Customer-Managed Keys

Your First Week

Day Focus Resource
1 Complete 30-minute path above OneLake Security, Purview, RBAC
2 Configure network security and outbound access protection Network Security
3 Implement data governance deep dive with lineage Data Governance Deep Dive
4 Map controls to compliance frameworks (SOC2, ISO 27001) SOC2 Readiness
5 Build threat model and review zero-trust architecture Zero Trust Blueprint

Key Features for Security Admins

Feature Doc Link Why It Matters
OneLake Security OneLake Security Fine-grained access control at the data layer across all Fabric workloads
Data Governance Governance Deep Dive Classification, sensitivity labels, lineage, and data cataloging with Purview
Customer-Managed Keys CMK Guide Control encryption keys for data at rest using Azure Key Vault
SQL Audit Logs Audit Logs Immutable audit trail for all data access and admin operations
Network Security Network Security Private endpoints, managed VNets, and workspace IP firewalls
Outbound Access Protection OAP Guide Control what external endpoints Fabric workloads can reach
RBAC Patterns RBAC Guide Workspace roles, item permissions, and Entra ID integration
Zero Trust Zero Trust Never-trust, always-verify architecture for Fabric deployments
SOC2 Readiness SOC2 Guide Map Fabric controls to SOC2 Trust Service Criteria
Threat Modeling STRIDE Model Systematic threat identification using STRIDE methodology
Data Exfiltration Prevention DLP Guide Prevent unauthorized data movement out of the Fabric environment
Audit Trail Immutability Immutability Tamper-proof logging for regulatory evidence

Common Pitfalls

  1. Relying only on workspace roles for security - Workspace roles (Admin, Member, Contributor, Viewer) are coarse-grained. Use OneLake Security for table- and column-level access control when you need fine-grained data protection.

  2. Not enabling audit logs early - Audit logs are essential for incident investigation and compliance evidence. Enable them in your first session, not after an incident. Retroactive logging is not possible.

  3. Using Microsoft-managed keys by default without a decision - For regulated workloads, defaulting to Microsoft-managed keys may not meet data sovereignty requirements. Make an explicit decision about CMK vs. MMK and document the rationale.

  4. Skipping outbound access protection - Without OAP, Spark notebooks and pipelines can reach any internet endpoint, creating data exfiltration risk. Restrict outbound access to approved destinations only.

  5. Treating compliance as a one-time exercise - SOC2, ISO 27001, and GDPR compliance require continuous monitoring, not a point-in-time checklist. Set up recurring control reviews and automated evidence collection. See the ISO 27001 Mapping.

  • OneLake Security

    Fine-grained security at the data layer: row-level, column-level, and object-level access control.

    OneLake Security

  • Data Governance

    Purview integration, sensitivity labels, data classification, and end-to-end lineage tracking.

    Governance Deep Dive

  • Customer-Managed Keys

    Azure Key Vault integration for encryption at rest with customer-controlled keys.

    CMK Guide

  • Compliance Frameworks

    SOC2, ISO 27001, GDPR, and CCPA control mappings for Fabric deployments.

    SOC2 Readiness