Last updated: November 11, 2026
By ZapAI Team
Microsoft Fabric governance is how you decide who owns data in Fabric, who can see it, which items people should trust, and how you prove all of that to an auditor. Our Microsoft Fabric consulting team splits it into two layers. Fabric itself gives you domains, workspace roles, OneLake security, endorsement, lineage and the Govern section of the OneLake catalog. Microsoft Purview adds sensitivity labels, data loss prevention, insider risk signals and an enterprise catalog, and most of those need extra licenses or pay-as-you-go billing.
Microsoft Fabric governance combines built-in Fabric controls (domains, workspace roles, OneLake security, endorsement, lineage, audit) with Microsoft Purview features like sensitivity labels and DLP. Start with the built-in controls, then add Purview where licenses and risk justify it.
Most Fabric tenants we see at SMB and mid-market firms got governance backwards. Somebody bought an F SKU, a few analysts built lakehouses, reports went out, and six months later IT asks who can see payroll data. Nobody knows. Normal. And fixable in about a quarter.
This guide covers what Fabric gives you natively, what Purview adds, which pieces cost extra, and how a small data team can run it without a governance office, with every product fact checked against Microsoft Learn in November 2026. New to the platform? Read what Microsoft Fabric is and our Fabric architecture explainer, which introduces the security layers we build on here. Capacity and CI/CD get separate posts.
What Does Microsoft Fabric Governance Actually Cover?
Four jobs. Organizing data by owner, controlling access, helping people find trusted data, and recording what happened.
Microsoft’s governance and compliance overview for Fabric says a good share of these capabilities ship with your Fabric license, while some need additional Microsoft Purview licensing, and the overview flags which is which as it walks through each capability. That split is the whole game for a small team. Built-in features cost nothing beyond capacity. Purview features cost licenses, meters, or both. So the order you switch things on matters more than the feature list.
The built-in pieces now sit in one place. The Govern section of the OneLake catalog holds domains, endorsement, tags, metadata scanning, policies and governance insights, plus admin experiences like tenant settings, workspaces and capacities. If Govern hasn’t reached your region yet, the admin portal still works.
What Governance Does Fabric Give You Without Purview?
Quite a lot. Tenant settings, domains, workspace roles, item permissions, OneLake security roles, endorsement, tags, lineage, impact analysis, the Govern section and the admin monitoring workspace all come with Fabric.
Tenant settings
Start here. Tenant settings decide who can create workspaces, share externally, call admin APIs with service principals, and reach OneLake from tools outside Fabric, and every later control on this page assumes somebody set those few switches deliberately instead of leaving the defaults. Admins can let everyone, nobody, or specific security groups create workspaces. We restrict it to one security group on day one. Sprawl starts with open workspace creation.
Domains and subdomains
Domains group workspaces by business area, like Finance or Operations, and subdomains refine that grouping. Microsoft’s Fabric domains documentation lists three roles. Fabric admins create domains and name domain admins. Domain admins manage their own domain’s description, contributors, workspace assignments and delegated settings. Domain contributors assign their own workspaces.
One detail surprises people. Domain assignment doesn’t change who can see or open an item. Access still comes from workspace roles and item permissions, and every user in the tenant can see every domain name. Even Finance. Domains organize the catalog, scope the Govern insights, and carry delegated settings such as a domain default sensitivity label and domain-level certifiers. That’s it.
Subdomains are thinner. They inherit the parent domain’s admins, and today they only have general settings.
Workspaces, roles and item permissions
Workspaces are your real security boundary. Each has four roles, Admin, Member, Contributor and Viewer, per Microsoft’s workspace roles reference. Assign them to security groups. Not people. Someone in several groups gets the highest role among them.
Item sharing sits one level down. A user given a single item sees only that item, not the rest of the workspace, and permissions such as Read, ReadData, ReadAll and Write decide what they can query and through which endpoint.
OneLake security roles
This is the data layer. Workspace Admins and Members can define OneLake security roles on an item that grant Read or ReadWrite on tables, folders or schemas, with row-level and column-level rules on individual tables. Microsoft’s OneLake data security overview spells out the catch. Admins, Members and Contributors already read and write everything in the workspace, so OneLake roles only restrict Viewers and people holding Read on the item.
Two more traps. Every lakehouse ships with a DefaultReader role that gives anyone with ReadAll access to its data, and you can edit or delete it, while OneLake security on shortcuts needs the tenant setting that lets apps outside Fabric reach OneLake data. Enforcement in third-party engines is still a preview.
Endorsement
Endorsement is your trust signal. Microsoft’s endorsement overview describes three badges. Promoted means the creator thinks an item is ready to share, and anyone with write permission can apply it. Certified means an authorized reviewer checked it against your standards, and only people a Fabric admin names can grant it. Master data marks a data item, such as a lakehouse or semantic model, as the authoritative source for things like customer lists or product codes.
Certification and master data stay off until a Fabric admin enables them. Certification can be delegated to domain admins, so Finance can name its own certifiers while Operations names different ones, and neither has to wait for the central Fabric admin to approve each badge. Useful.
Lineage and impact analysis
Every workspace gets a lineage view automatically. It shows how items in the workspace connect, plus data sources one step upstream even when they live elsewhere. Downstream items in other workspaces don’t appear. For those, open impact analysis on the item before you change it. Viewers see lineage but not data sources. Cheap insurance.
Audit and the admin monitoring workspace
Fabric user activity lands in the Microsoft Purview audit log, and searching it needs an audit role, not a separate Purview product, and Audit (Standard) keeps those records for 180 days by default. Keeping them up to a year needs the acting user to hold Office 365 E5, Microsoft 365 E5, the Microsoft Purview Suite (formerly E5 Compliance) or an E5 eDiscovery and Audit add-on, and ten years needs another add-on, per Microsoft’s audit log retention page.
The admin monitoring workspace is the other half. A Fabric admin installs it simply by opening it, its semantic models refresh daily, and it feeds the tenant-wide Govern report. Three gotchas from Microsoft’s admin monitoring documentation. The admin who installs it needs a directly assigned admin role, because a role granted through a group makes refreshes fail. Access you grant can’t be removed without reinitializing the workspace. And viewers need Power BI Pro unless you move the workspace onto a capacity.
The Govern section
Govern pulls it together. The All data view gives admins governance insights, recommended actions, label coverage, DLP activity, and endorsement and description coverage across the tenant, while the My items view does the same for one owner’s items. Microsoft’s Govern section documentation notes three limits. Estate data refreshes once a day. Guest users aren’t supported. Private Link turns it off.
What Does Microsoft Purview Add on Top?
Protection and compliance reach. Purview supplies sensitivity labels, data loss prevention, protection policies, insider risk signals, audit for Copilot and agents, and an enterprise catalog that spans non-Fabric sources.
Purview extends the OneLake catalog. It doesn’t replace it. Read the guide to using Purview with Fabric and that’s Microsoft’s own position.
Sensitivity labels from Information Protection
Labels classify items, follow data through supported exports, and can drive access control. The Information Protection in Fabric page lists what works where. Support is uneven.
- Manual labeling works for all Fabric items.
- Default labeling works everywhere, with limits outside Power BI.
- Mandatory labeling is fully supported for Power BI items only.
- Downstream inheritance is on by default, except Power BI item to Fabric item.
- Inheritance from data sources covers Power BI semantic models only.
- Labels travel with exports only for Power BI items.
Our Fabric migration best practices guide already covers the CSV export gap. The governance angle is different. A label on a gold-layer lakehouse or warehouse flows down to the semantic models and reports built on it, so labeling the right layer first lets inheritance do most of the work, and our lakehouse vs warehouse comparison explains where that gold layer usually sits.
Protection policies
These turn a label into an access rule. A protection policy tied to a label lets named users and groups keep their existing access to labeled items and blocks everyone else. They cover native Fabric items and Power BI semantic models, not reports. Plan around the limits Microsoft lists. Up to 50 policies. Up to 100 users and groups each. No guest users. Up to 24 hours before a new policy bites. And no link to deployment pipelines or Git, which use workspace permissions only.
Data loss prevention
DLP scans data for sensitive info types or labels and reacts. Per Microsoft’s DLP for Fabric and Power BI overview, policies cover semantic models, lakehouses, warehouses, KQL databases, mirrored databases, SQL databases and Cosmos databases. Actions are a policy tip, an alert, and restrict access, which is still a preview.
Read the limits before promising anything to compliance. Policies apply only to workspaces on Fabric or Premium capacity, only to Delta tables, and not to DirectQuery, live connection or mixed-storage semantic models. Exact data match, trainable classifiers and named entities aren’t supported. Neither are policy templates. Semantic models refreshed by a service principal skip evaluation entirely. Handling PHI? Pair this with the controls in our Dynamics 365 HIPAA guide.
Insider Risk Management
Insider Risk Management has ready-made Fabric indicators for Power BI and lakehouse activity, like downloading reports, downgrading labels or sharing lakehouse data outside the organization. Microsoft’s indicator documentation says they need pay-as-you-go billing turned on. For most SMB tenants we treat this as a later phase, because it pays off only after labels exist and someone actually has time to triage alerts every single week.
Unified Catalog and the Data Map
Here Purview goes beyond Fabric. The Data Map can scan your Fabric tenant for metadata and lineage, including lakehouse tables and files, alongside Azure SQL, ADLS and other sources. Unified Catalog then layers governance domains, data products, glossary terms, critical data elements and data quality on top, which starts to earn its cost once you have important data outside Fabric worth governing in the same place. Not before.
Scanning has a sharp edge. When you let Purview’s identity use Fabric’s read-only admin APIs, it can read metadata for every Fabric item in the tenant, and once that metadata sits in Purview, Purview permissions decide who sees it, not Fabric. Set Purview roles before the first scan. Items protected by OneLake security also need a OneLake role granting Read to the Purview identity.
Data quality for Fabric lakehouse tables runs from Unified Catalog against Delta or Iceberg tables, with Purview’s managed identity holding Contributor on the workspace. The Learn pages disagree on scan authentication. The lakehouse data quality page says only service principal works for the Data Map scan. The newer Fabric scanning page says managed identity now works for lakehouses. Test both.
Purview for Copilot in Fabric and data agents
Purview can capture and assess AI interactions. Microsoft’s Purview page for Copilot in Fabric lists DSPM, audit, classification, insider risk, communication compliance, eDiscovery and retention for Copilot in Power BI prompts and responses. Coverage for other Fabric Copilots and the Fabric data agent is a preview. Sensitivity labels and DLP aren’t supported for those AI interactions. It also requires pay-as-you-go billing and the enterprise version of Purview data governance.
Planning data agents on an ontology? Our Fabric IQ explainer covers what’s GA. Copilot reaching SharePoint and OneDrive files is a separate problem with separate tools, covered in our Microsoft 365 Copilot oversharing guide.
Looking for the Purview hub? Gone. Its Learn page now redirects to the Govern section.
Which Fabric Governance Features Need Extra Licenses?
Everything built into Fabric costs only capacity. Sensitivity labels need a Purview Information Protection license, Fabric DLP needs an E5-tier license for the admin who builds policies per the Fabric DLP configuration page, and Unified Catalog, Fabric insider risk indicators and Purview for Fabric Copilot run on pay-as-you-go Azure billing.
| Feature | Where it lives | What you need, November 2026 |
|---|---|---|
| Tenant settings, domains, workspace roles, item permissions | Fabric | Included |
| OneLake security roles with row and column rules | Fabric | Included |
| Endorsement, tags, lineage, impact analysis | Fabric | Included |
| Govern section and admin monitoring workspace | Fabric | Included, viewers need Power BI Pro unless the workspace sits on capacity |
| Fabric activity in the audit log | Purview Audit | 180 days standard, a year needs E5-tier licensing for the acting user |
| Sensitivity labels on Fabric items | Purview Information Protection | A labeling license such as Microsoft 365 E3 or E5, plus Power BI Pro or PPU to label Power BI items |
| Protection policies | Purview Information Protection | Microsoft 365 E3 or E5 and a label configured with Control access |
| DLP for Fabric and Power BI | Purview DLP | Policy admin holds Microsoft 365 E5, E5 Compliance, E5 Information Protection and Governance, or Purview capacities, and workspaces sit on Fabric or Premium capacity |
| Insider risk Fabric indicators | Purview Insider Risk Management | Pay-as-you-go billing enabled |
| Unified Catalog, data products, data quality | Purview data governance | Pay-as-you-go per governed asset per day, plus processing units |
| Purview for Copilot in Fabric and data agents | DSPM and related | Pay-as-you-go plus the enterprise version of Purview data governance |
Unified Catalog billing is the part people misread. Per Microsoft’s data governance billing page, you pay for governed assets, meaning tables or views linked to a data product, critical data element, glossary term or data quality rule, counted once a day. Assets in the Data Map that aren’t linked to anything aren’t billed. Data quality and health controls consume data governance processing units, and the default health control job runs daily once a business domain exists, so switch off any controls nobody reads on the schedule page.
Prices are another matter. Microsoft’s Azure pricing page for Purview shows rates through a regional calculator, and we couldn’t verify a flat public number, so we won’t print one. Run the calculator.
DLP raises a meter question too. Microsoft’s Purview billing models page lists Fabric item types covered by DLP and protection policies as pay-as-you-go assets, counted daily while they sit in a policy’s scope, yet the Fabric DLP setup page lists only per-user license options. The two pages don’t line up neatly. Ask your licensing partner before scoping DLP to every workspace.
On Business Premium? Third-party guides and a Microsoft Q&A answer say it includes manual labeling but not auto-labeling. We couldn’t confirm that on a current service description. Check yours.
Who Should Own Fabric Governance on a Small Team?
Three to five named people, not a committee. In ZapAI practice, a small team needs a platform owner, a data owner and a steward per domain, a short certifier list, and one security contact who owns the Purview side.
| Role | Typical person at a 200 to 800 person firm | Owns |
|---|---|---|
| Fabric admin | BI manager or data lead | Tenant settings, workspace creation, capacity assignment, domains |
| Domain admin | Finance or operations manager | Workspaces in the domain, contributors, delegated settings |
| Data steward | Senior analyst in the domain | Descriptions, tags, endorsement requests, label checks |
| Certifier | One or two people per domain | Granting Certified and Master data badges |
| Security and compliance admin | IT or security lead | Labels, DLP, audit searches, Purview roles |
Notice who isn’t listed. Report builders. They create and promote. They don’t certify their own work.
A certification process that fits a small team
Our view? Certification works only if it’s boring and fast.
- The builder promotes the item and requests certification.
- The steward checks five things, covering a named owner, a written description, a healthy refresh schedule, an applied label and reviewed lineage.
- A certifier who didn’t build it grants the badge within five business days.
- Certified items get reviewed every six months, or when the source changes.
- Anything not reviewed loses the badge.
Keep master data rarer still. One customer table. One product table. One chart of accounts. If everything is master data, nothing is.
Certified semantic models are where this pays off, since report authors pick them first in the catalog, so our Power BI consulting team usually starts certification with the five or ten models that feed executive reporting.
What Should a 30/60/90-Day Fabric Governance Rollout Look Like?
Built-in controls in the first 30 days, labels and certification by day 60, Purview DLP and catalog decisions by day 90. That order is our view, not a Microsoft rule, and it front-loads everything that costs nothing extra.
Days 1 to 30, get control
- Name two or three Fabric admins, assigned directly.
- Lock down workspace creation.
- Open the admin monitoring workspace and Govern.
- Read the inventory.
- Archive or delete orphaned workspaces.
- Move workspace roles from individuals to security groups.
- Create two to four domains matching real budget owners, then assign workspaces.
- Set a default domain for frequent workspace creators so new workspaces land somewhere sensible.
- Test an audit search.
Days 31 to 60, build trust
- Enable certification, delegated to domain admins.
- Certify your top 10 models.
- Publish a short label set if you lack one.
- Enable sensitivity labels in Fabric.
- Label the gold layer first.
- Add OneLake security roles where Viewers need partial data.
- Review every DefaultReader role.
- Check impact analysis before schema changes to certified items.
Days 61 to 90, decide on Purview
- Review label coverage and recommended actions in Govern.
- Pilot one DLP policy, tips and alerts only, on one regulated workspace.
- Decide on Unified Catalog based on non-Fabric sources and real demand for data products.
- If Copilot or data agents are live, decide on Purview pay-as-you-go for AI interaction audit.
- Write a one-page governance guide people will actually read.
Take a hypothetical example. A 400-person distributor with ERP data in one lakehouse, 30 reports and three analysts could finish days 1 to 30 with a few hours a week from the BI manager, because nearly every step is a setting or a group change, while labels and certification would take longer since they need decisions from Finance, not clicks. If AI agents sit on the roadmap, our AI readiness assessment checklist treats this governance baseline as a prerequisite.
What Mistakes Do Teams Make With Fabric Governance?
Buying Purview before using what Fabric already includes. Treating domains as security. And handing out Contributor because it’s easier.
- Assuming domains restrict access. They don’t.
- Making everyone Contributor, then wondering why OneLake security roles have no effect.
- Leaving DefaultReader untouched on lakehouses with sensitive tables.
- Letting builders self-certify.
- Scanning Fabric into Purview before setting Purview roles, which can expose item names and owners for the whole tenant.
- Installing the admin monitoring workspace with a group-assigned admin account, then losing refreshes.
- Switching on DLP restrict access on day one. Start with tips and alerts.
- Expecting DLP to catch data in DirectQuery models or non-Delta files.
- Assuming every Fabric user needs E5 for DLP. Check user-level terms.
One more, and it’s cultural. Governance that takes three weeks to grant access teaches people to export to Excel and email the file around, which is the exact outcome every control on this page exists to prevent, so measure how long an access request takes and keep it short. We made the same point in our Power Platform governance guide. It holds for Fabric.
Fabric Governance Checklist
Use this as a quarterly review. Each line takes under an hour to check.
- Workspace creation restricted.
- Fabric admins assigned directly.
- Every workspace in a domain.
- Roles granted to groups.
- No orphaned workspaces.
- Certifiers named per domain.
- Master data kept rare.
- Gold layer labeled.
- DefaultReader reviewed.
- OneLake roles tested as Viewer.
- Admin monitoring refreshing daily.
- Audit search tested.
- DLP licensing confirmed in writing.
- Purview roles set before scanning.
What Could Change After Ignite 2026?
Possibly a lot. Ignite runs November 17 to 20, 2026, in San Francisco, and Fabric and Purview features tend to move from preview to GA around events like it, so expect a refresh of this post by early December.
First on our list. DLP restrict access leaving preview, Purview support for the Fabric data agent, third-party engine enforcement for OneLake security, any Unified Catalog pricing change, and whether Microsoft clarifies which licenses cover Fabric DLP.
Wrapping Up
Fabric governance in November 2026 is mostly free to start. Restrict workspace creation, map domains to owners, move roles to groups, turn on certification, and label your gold data. Then decide where Purview DLP, insider risk and Unified Catalog earn their license and meter costs. Order beats features.
ZapAI is a Microsoft Dynamics 365, Power Platform, Fabric and AI consulting firm in Irving, Texas, working with businesses across Dallas-Fort Worth and nationwide. Our Fabric lakehouse consultants set up domains, OneLake security, certification and labels on live tenants. Talk to us about a Fabric governance review, and we’ll start with your Govern report and tenant settings before recommending a single license.
Questions Teams Ask About Fabric Governance
Do I need Microsoft Purview to govern Microsoft Fabric?
Not for the basics. Domains, workspace roles, OneLake security, endorsement, lineage and the Govern section come with Fabric. Purview becomes necessary for sensitivity labels, DLP, insider risk, and cataloging data outside Fabric.
Do domains control who can access data in Fabric?
No. Microsoft states that domain assignment doesn’t affect item visibility or access. Workspace roles and item permissions control access, while domains organize content and carry delegated settings like certification.
Which license do I need for DLP policies in Fabric?
Per Microsoft’s Fabric DLP page, the admin who sets up rules needs Microsoft 365 E5, E5 Compliance, E5 Information Protection and Governance, or Purview capacities. Workspaces must sit on Fabric or Premium capacity, and Purview’s billing page also lists Fabric DLP assets as pay-as-you-go.
Why don’t OneLake security roles restrict my Contributors?
By design. Workspace Admins, Members and Contributors already read and write all data in the workspace, so OneLake roles only apply to Viewers and users with Read permission on that specific item.
Who can certify items in Fabric?
Only users a Fabric admin specifies, after certification is enabled. Admins can delegate certification settings to domain admins, who then name certifiers for their own domain.
Is Purview Unified Catalog free for Fabric data?
Partly. Live view, a preview, shows Fabric workspaces and items without scanning. Governing assets through data products, glossary terms or data quality is billed pay-as-you-go per governed asset per day, plus processing units for quality jobs.
Can Purview govern Copilot in Fabric and Fabric data agents?
Partly. Copilot in Power BI interactions support audit, DSPM, insider risk, eDiscovery and retention. Other Fabric Copilots and the data agent are in preview, labels and DLP don’t apply to those interactions, and pay-as-you-go billing is required.