Subscribe
Share
Share
Embed
A sensitivity label says Highly Confidential in the header, but inside Fabric it never decides who opens the item. This episode traces where labels actually control access and where the appearance of a lock is just a sign.
Episode 43 • 2026-10-30 Duration: 9:02
A sensitivity label says Highly Confidential in the header, but inside Fabric it never decides who opens the item. This episode traces where labels actually control access and where the appearance of a lock is just a sign.
AI-generated voices. Matthias — cloned voice. Fabia — designed AI co-host. See Matthias live on YouTube (Fabric Friday), at his meetups, and at conferences like FabCon.
Hosted by Matthias Falland — Microsoft Data Platform MVP and community architect behind the Fabric Periodic Table. New episodes every Friday.
Have an architecture decision you are wrestling with? DM Matthias on LinkedIn — find him as Matthias Falland. Three to five sentences about the decision, your team size, and your current stack. We anonymize before airing.
This podcast was generated by AI. Both voices are synthetic: Matthias is a cloned voice, Fabia is a designed AI co-host.
Brand design based on fabricperiodictable.com.
Architecture decisions for Microsoft Fabric. Anonymized real customer scenarios, cost realism, counter-arguments included. Weekly episodes aligned with Fabric Friday recordings.
A Label Is Not a Lock
Episode 43 | 2026-10-30
Fabric Architecture Podcast | Hosted by Matthias Falland with AI co-host Fabia
---
[00:08] Matthias: A lakehouse. Labeled Highly Confidential. A viewer queries it.
[00:12] Fabia: Five hundred rows come back. Every one of them.
[00:15] Matthias: So what did that label actually do?
[00:17] Fabia: That's what this episode settles. A sensitivity label looks like access control. The distance between that appearance and what it actually does is where teams get hurt.
[00:28] Matthias: Because I keep running into this. Someone rolls out labels, the compliance team's happy, and then a contributor writes to everything that says Highly Confidential.
[00:39] Fabia: There are two questions that sound like one. Who may open this lakehouse? And how sensitive is it? Fabric answers them with completely different mechanisms. Workspace roles and item permissions handle access. The label handles classification.
[00:55] Matthias: So the label is... it's metadata. A tag that travels.
[00:59] Fabia: It's more than a tag. It flows downstream, it inherits, it encrypts files on export. What it doesn't do is decide who opens the item in the service. The documentation says it plainly: sensitivity labeling does not affect access to content.
[01:15] Matthias: And that's the sentence nobody reads.
[01:17] Fabia: Or they read it and don't believe it, because the header says Highly Confidential in red.
[01:23] Matthias: Walk me through what it does do. If it isn't gating access, where does the label matter?
[01:29] Fabia: A label gets onto an item through eight routes. Two are explicit: a person applies it, or an admin pushes it through the bulk API. The other six are automatic, and they all follow the same two rules.
[01:43] Matthias: Which are?
[01:43] Fabia: They never overwrite a label someone chose by hand. And they never swap a stronger label for a weaker one. Automation can only push up, and only where no human decided.
[01:54] Matthias: So once someone picks the wrong label manually... it just sits there until a human fixes it.
[02:01] Fabia: And downstream inheritance has a cliff at eighty items. Above that, a semantic model gets zero propagation to its reports.
[02:09] Fabia: Someone posted this on the Fabric Community forum. "if I assign viewer access through the sensitivity label and contributor access through the Fabric Workspace, I am still able to edit the Fabric items. Has anyone else experienced this?"
[02:25] Matthias: And the accepted answer was one sentence.
[02:28] Fabia: "Sensitivity labels do not control access. They control the ability to share after access."
[02:34] Matthias: They expected the label's viewer right to override the workspace contributor role.
[02:40] Fabia: The workspace role won. It always wins inside the service.
[02:44] Fabia: At the export boundary, the label gains real force. Export a report to Excel or download the pbix, and Fabric stamps the file with the label. If that label has protection, the file's encrypted with the label's usage rights.
[02:59] Matthias: So inside Fabric it's shown. Outside, it decides.
[03:02] Fabia: And the gap you'd lose sleep over is CSV. A CSV export carries no label. No encryption. Same for every unsupported export path.
[03:10] Matthias: So the label protects the formal route and the convenient one's just—
[03:15] Fabia: —open. Unless the admin blocks unsupported export paths in the tenant settings.
[03:20] Matthias: What about lakehouses and warehouses?
[03:23] Fabia: No export from a non-Power BI item carries a label today. Fabric warns you. That's it.
[03:28] Matthias: If someone genuinely needs a label to control who opens an item inside Fabric, what's the path?
[03:35] Fabia: One path. A Purview protection policy. You tie it to a label. Every item carrying that label: the people on the policy's list keep their permissions. Everyone else is blocked.
[03:46] Matthias: Blocked even with a workspace role?
[03:49] Fabia: Even with Admin. One exception: the person who last applied the label is never blocked.
[03:55] Matthias: That's... actually powerful. Why isn't everyone using it?
[03:58] Fabia: Fifty policies per tenant. A hundred users and groups per policy. Up to twenty-four hours before a new policy protects anything.
[04:07] Matthias: Twenty-four hours.
[04:08] Fabia: And it covers native items like lakehouses and semantic models. Reports and dashboards are outside its reach.
[04:15] Matthias: So the thing people actually share with executives—
[04:19] Fabia: —isn't covered. You protect the semantic model underneath. The report inherits the label for classification, but the policy doesn't reach it.
[04:28] Matthias: What's the licensing picture?
[04:30] Fabia: Applying a label needs a Purview Information Protection license at the tenant level. The person applying it needs Pro or Premium Per User, and the label has to be published to them in their Purview policy – if it isn't, they won't see it.
[04:46] Matthias: And protection policies?
[04:48] Fabia: Microsoft 365 E3 or E5. That's the gate for the one mechanism that makes a label decide access inside the service.
[04:55] Matthias: So the classification layer's one license. The enforcement layer's another. I'd check what your organization actually holds before designing around protection policies. That's the kind of assumption that falls apart when someone checks.
[05:11] Fabia: And here's the honest argument for when labels are the right investment. If your data regularly leaves Fabric – someone downloads a pbix or exports to Excel – and it needs to stay protected on their laptop, there's nothing else that travels with the file. The workspace role stops at the service boundary.
[05:32] Matthias: That's fair. Once the file's on someone's laptop, the workspace role doesn't exist anymore. Only the encryption baked into the file still says who opens it.
[05:42] Fabia: And for compliance reporting, labels give you the OneLake catalog's govern view. Coverage gaps, unlabeled items. That's a conversation with your compliance team you can't have with workspace roles alone.
[05:56] Matthias: Here's where I'd land. Design the workspace boundary first. That's your access control. The label is classification on top of it.
[06:04] Fabia: And when one workspace genuinely has to hold items at different sensitivity levels?
[06:10] Matthias: Then you've got two moves. Split the workspace, which costs you pipeline complexity and maybe duplicate items. Or add a protection policy, which costs you twenty-four hours of delay and the gap around reports. I'd split most of the time. The protection policy's for the case where splitting would break more than it protects.
[06:32] Fabia: One risk that doesn't show up until the audit: mandatory labeling isn't enforced for lakehouses, pipelines, or warehouses. A default label on those items only triggers on a create dialog or a name change in the flyout. Work inside the editor doesn't fire it.
[06:49] Matthias: So a lakehouse created through an API or a deployment pipeline might never get a label.
[06:55] Fabia: Check the OneLake catalog. Don't assume coverage.
[06:58] Matthias: That's the kind of gap nobody discovers until the audit.
[07:02] Fabia: And deployment pipelines. A normal deploy into a stage that already has items doesn't carry the label. Protection policies don't travel with CI/CD at all.
[07:12] Matthias: So your staging workspace and production workspace can end up with completely different label coverage.
[07:19] Matthias: I keep going back and forth on this. Part of me wants to say... if you're reaching for a label to control access, you've already missed something in workspace design.
[07:30] Fabia: I'd push back. Regulated industries need classification that follows the item AND controls what happens after export. The workspace handles access. The label handles the audit trail and the encryption at the boundary. Asking one to do the other's job is where it breaks.
[07:48] Matthias: OK. I'm not saying labels are wrong. I'm saying reaching for a label when you mean "only these people may open this" is the wrong tool for that job.
[07:58] Fabia: Show me the query pattern. If the pattern is "restrict who opens this," design the workspace. If the pattern is "protect what leaves," design the label. Conflating them is where every thread on that forum starts.
[08:12] Matthias: And the protection policy sits in between. For the narrow case where you can't separate items into different workspaces but you need label-driven access. Know what you're buying: fifty policies, twenty-four hours, no reports.
[08:27] Fabia: Right now, somewhere, there's a lakehouse with Highly Confidential in the header. And a contributor writing to it. And everyone assumes the label is what's keeping them out.
[08:39] Matthias: It's a sign. It was always a sign.
[08:41] Matthias: If you're untangling labels from permissions in your tenant, DM me on LinkedIn – find me as Matthias Falland.
[08:49] Fabia: See you next Friday.
---
End of episode. ~08:50 estimated.