Subscribe
Share
Share
Embed
A Fabric workspace isn't a folder — it's a cut through OneLake carrying every access rule, capacity bill, and residency commitment. Fabia and Matthias trace the boundaries hiding inside one object, starting with the documented fact that Contributor overrides OneLake security and ending with why a cross-region move is a deletion disguised as a dropdown.
Episode 36 • 2026-09-04 Duration: 10:19
A Fabric workspace isn't a folder — it's a cut through OneLake carrying every access rule, capacity bill, and residency commitment. Fabia and Matthias trace the boundaries hiding inside one object, starting with the documented fact that Contributor overrides OneLake security and ending with why a cross-region move is a deletion disguised as a dropdown.
AI-generated voices. Matthias — cloned voice. Fabia — designed AI co-host. See Matthias live on YouTube (Fabric Friday), at his meetups, and at conferences like FabCon.
Hosted by Matthias Falland — Microsoft Data Platform MVP and community architect behind the Fabric Periodic Table. New episodes every Friday.
Have an architecture decision you are wrestling with? DM Matthias on LinkedIn — find him as Matthias Falland. Three to five sentences about the decision, your team size, and your current stack. We anonymize before airing.
This podcast was generated by AI. Both voices are synthetic: Matthias is a cloned voice, Fabia is a designed AI co-host.
Brand design based on fabricperiodictable.com.
Architecture decisions for Microsoft Fabric. Anonymized real customer scenarios, cost realism, counter-arguments included. Weekly episodes aligned with Fabric Friday recordings.
The Folder That Carries Four Boundaries
Episode 36 | 2026-09-04
Fabric Architecture Podcast | Hosted by Matthias Falland with AI co-host Fabia
---
[00:08] Matthias: Same table. Same person. She queries it in SQL — full result set. Opens a Spark notebook on the same data — access denied.
[00:16] Fabia: Same lakehouse, same bytes in OneLake. Two different answers depending on which door she walked through.
[00:23] Matthias: How do you design a security model around that?
[00:26] Fabia: You start by understanding what a workspace actually is — because it's carrying more than anyone draws on the whiteboard. Today we're pulling it apart.
[00:36] Fabia: The documentation says something most people skim past. A workspace sits on top of OneLake and divides the data lake into separate containers that can be secured independently. That word — divides. You're not grouping items into a UI folder. You're partitioning the lake. And once you've cut it, that partition has to carry everything — every access rule, every capacity bill, every residency commitment. More than any architecture diagram accounts for.
[01:06] Matthias: Which explains why the role system feels heavier than it should.
[01:10] Fabia: Admin, Member, Contributor, Viewer — and the line people miss is inside the bottom one. A Viewer gets ReadData. That's T-SQL through the SQL analytics endpoint. The endpoint can be a gate — object-level and row-level security applied on the way out. But only once somebody switches it: a new lakehouse endpoint starts in delegated identity mode, and OneLake security isn't enforced there until an Admin or Member moves it to user's identity mode. ReadAll — Spark, the OneLake APIs, reading the Parquet files directly — the Viewer doesn't get. A Spark job opening those files never passes through any gate. Nothing can filter it.
[01:52] Matthias: So granting SQL read is granting a filtered view of the file. Granting Spark read is granting the file itself.
[02:00] Fabia: They can't be the same permission because they can't be enforced the same way. In Fabric, read-only isn't a level — it's a route.
[02:08] Matthias: Git integration is Admin-only — and so is workspace identity. I keep running into teams that hand out Member assuming it covers everything important, and CI/CD is dead because nobody can connect the repo.
[02:22] Fabia: Member gets you people management — adding members, allowing reshares. The infrastructure capabilities sit one step higher. And what compounds it is that workspace roles are confined to that specific workspace. They say nothing about other workspaces, the capacity, or the tenant. Your Admin in one workspace is nobody in the next.
[02:44] Matthias: What about revocation latency?
[02:46] Fabia: Next sign-in. The permission change only takes effect the next time the user logs into Fabric.
[02:52] Matthias: So you revoke at 2 PM. They're still querying production at 4.
[02:56] Fabia: Documented behaviour. And the access list itself carries a second gap — permissions follow the highest role across nested groups. The audit shows which groups are assigned. The actual permission comes from the transitive closure. What the list says and what's true are two different readings.
[03:16] Fabia: A question came in that walks straight into the most expensive sentence in this documentation. "We gave the team Contributor and restricted the sensitive folder with OneLake security. Why does it not apply?"
[03:30] Matthias: That's the design I've seen on every whiteboard that ends up getting redrawn.
[03:35] Fabia: And it cannot work. The documentation is explicit — Workspace Admin, Member, and Contributor roles automatically grant Write permissions to OneLake. They override any OneLake security Read permissions. OneLake security refines access downward from Viewer. It doesn't work upward against a role that carries Write, because Write is a strictly higher grant than any Read restriction can limit.
[04:01] Matthias: So there's no "Contributor, but only this folder."
[04:05] Fabia: The fix is the inverse of the instinct. Put the team on Viewer. Use OneLake security to grant the specific folders they need. Fabric ships a DefaultReader role on lakehouses for exactly this shape — the restrictive path is actually the low-effort one.
[04:22] Matthias: And this reaches back to the cold open. The Viewer who queries SQL but can't touch Spark — that's the security model working. The gate is where filtering happens. You want people behind it.
[04:34] Fabia: And it cascades further. Row-level security — the thing most teams treat as a property of the semantic model — its enforcement depends on the workspace role. The documentation says: to enforce RLS on Power BI items for Pro users browsing content in a workspace, assign them the Viewer role.
[04:54] Matthias: — so promoting someone from Viewer to Contributor to let them fix a report —
[04:59] Fabia: Silently removes the row filter they were behind. The definition is still there. It's just not being enforced. No error. No warning. The data simply appears unfiltered.
[05:10] Matthias: And you can't undo it fast. Give them Contributor for the afternoon, plan to pull it back — the permission change only takes effect the next time they sign in. Both directions wait. So the afternoon you meant to lend them can outlast the afternoon.
[05:26] Matthias: Security boundary, fine. What about the cost boundary? Who decides what capacity my workspace sits on?
[05:33] Fabia: Depends on which era of capacity you're running. Fabric capacity — F SKUs — the capacity admin must also be a Workspace Admin of that specific workspace to reassign it. Same rule for A SKUs. But Premium capacity — P SKUs — and Embedded — EM — predate the Fabric permission model. A P or EM capacity admin can claim any workspace in the organization.
[05:57] Matthias: — by name? They just search for it?
[05:59] Fabia: By name. No Workspace Admin role required. A Global Admin or Fabric Admin can move any workspace to any capacity type regardless.
[06:07] Matthias: So every organization migrating from Premium to Fabric right now has a window where the legacy capacity admins can claim workspaces the Fabric governance team thinks they own. The cost boundary and the security boundary are being drawn by different people, and neither group is watching the other's whiteboard.
[06:28] Fabia: The newer rule is tighter. The older one is still in force. And during the transition, both run at the same time.
[06:36] Fabia: The counter-argument deserves its weight, though. Viewer plus OneLake security for everyone means more configuration surface. Every folder grant is an explicit decision. In a team of eight under cost pressure, that overhead in attention might cost more than the risk it prevents.
[06:54] Matthias: If your team needs to build inside the workspace, Contributor is the minimum role that lets them do the work. Viewer plus OneLake security gives read access to data, but it doesn't give you a workspace you can build in.
[07:09] Fabia: The split that holds: a development workspace where the builders are Contributors, and a serving workspace where consumers are Viewers with OneLake security grants. The boundary between who builds and who reads is a workspace boundary. Trying to draw it inside one workspace with role negotiations is the shape the documentation says won't hold.
[07:32] Matthias: And the item limit reinforces it. A thousand items per workspace, counting children — a single lakehouse brings its SQL analytics endpoint along. Two items for the one thing you consciously created. A shared workspace where everyone builds and everyone reads hits that ceiling long before anyone forecasts it.
[07:53] Fabia: The fourth boundary is residency, and it's the quietest. Moving a workspace to a capacity in a different region works for exactly seven item types. Everything else has to be removed first, or the reassignment fails — and even when it proceeds, it can start successfully and finish with errors. That's documented.
[08:14] Matthias: That's a migration project disguised as a dropdown menu.
[08:17] Fabia: And one more quiet door — a My Workspace owner can move their personal workspace back to Pro type, which can relocate content to a different region. There's a tenant setting to block it: "Block users from reassigning personal workspaces." It exists because the default lets someone break data residency with one click they thought was a cleanup.
[08:40] Matthias: Four boundaries. Creating a workspace means deciding who reads the data, what capacity it burns, which region holds it, and how it moves through your release cycle. The one people hear is the first. The other three sit there, quietly accumulating consequences nobody budgeted for.
[08:59] Fabia: Somewhere in your tenant right now, a workspace someone created in thirty seconds is quietly running up a bill in a region nobody chose. Simplicity on the slide is not simplicity at runtime.
[09:12] Matthias: If you're drawing workspace boundaries and want to argue about where to cut — DM me on LinkedIn. Find me as Matthias Falland.
[09:21] Fabia: And if your workspace count is still in single digits — enjoy it while it lasts.
---
End of episode. ~09:26 estimated.