DP-700: how to manage sharing and access policies in Fabric Workspaces

I will teach how to manage sharing and access control policies for Workspaces in Microsoft Fabric — a practical DP-700 skill that ensures users access only the appropriate data and content. On the exam and in real-world practice, understanding identities, permissions and sharing models is crucial to protect pipelines, models and reports.

What you need to know

Workspaces in Fabric group assets (datasets, reports, pipelines, notebooks). Access management involves three main concepts: identities and roles (Azure AD, groups), Workspace-level permissions and external sharing policies. Example: you want the analytics team to create pipelines, but only the reporting team to publish reports. For that you use distinct roles (Owner, Member, Contributor, Viewer) and, when needed, Azure AD groups for bulk assignments.

How it works

The general steps to implement access and sharing policies are:

1. Inventory assets and classify sensitivity — know what needs restriction.
2. Map identities and functions — list users and Azure AD groups and define the required roles.
3. Apply permissions in the Workspace — assign roles to groups/identities at the Workspace or asset level.
4. Configure external sharing and links — control whether assets can be shared outside the organization and manage expirations/elevations.
5. Audit and review — use logs and activity insights to validate access and adjust policies.

Practical example: configure a Workspace for a Data Engineering team and another for Business Intelligence.

# Passos (resumo)
1. Criar grupos no Azure AD: DataEng_Group, BI_Group
2. Criar Workspace em Fabric: "SalesAnalytics"
3. Atribuir DataEng_Group como Contributor (pode criar pipelines e datasets)
4. Atribuir BI_Group como Viewer ou Member (acede a datasets e cria reports)
5. Restringir download/partilha externa em datasets sensíveis
6. Habilitar logging e rever mensalmente

In practice

Step-by-step practical guidance and useful commands (conceptual — the graphical interface also allows these actions):

1. Create and use Azure AD groups: create groups for roles (for example, DataEng_Group). The advantage is managing permissions centrally without editing each Workspace.
2. Assign roles in the Workspace: in the Fabric portal, go to Workspace > Settings > Access. Add the group and choose the role (Owner, Member, Contributor, Viewer). Member allows creating reports; Contributor allows modifying assets; Owner manages permissions.
3. Asset-level permissions: for sensitive datasets, change permissions on the specific asset to prevent downloads or sharing. This is useful when members need to view/use the dataset but not export it.
4. External sharing: when sharing via link, select options such as expiring the link or requiring authentication. For regulated data, block external sharing by Workspace policy.
5. Sensitivity policies: integrate Microsoft Purview labels (if available) to tag assets and apply automated actions (e.g., restrict downloads for files classified as Confidential).

Common mistakes

Some frequent pitfalls:

• Granting excessive permissions: assigning Owner or Contributor to users who only need to view leads to risks of modification or improper sharing.
• Managing permissions per user instead of using groups: makes maintenance unsustainable as the team grows or changes.
• Assuming internal sharing is safe without reviewing sensitivity labels: some assets should never be shared even internally without additional controls.

How to practice

Practice these skills in a sandbox environment or development tenant. Some recommended activities:

• Create multiple Workspaces and Azure AD groups; experiment with different role combinations.
• Configure external sharing and test behavior with guest users (B2B).
• Review audit logs and Activity Insights to validate who accessed what.

For exam preparation, use the OFFICIAL Microsoft Practice Assessment free of charge and the official study guide (both free). These official tools help identify areas to reinforce without relying on unauthorized material.

In summary

• Managing access to Workspaces involves identities (Azure AD), roles and sharing policies.
• Use Azure AD groups for scalability and fewer operational errors.
• Apply permissions at the Workspace level and, when necessary, at the asset level.
• Audit regularly and integrate sensitivity labels to strengthen sharing controls.