Fabric Planning: Check Access and Data Boundaries
Use a permissions exercise to distinguish viewing, editing, administration, and external transmission.
Artigo de referência em inglês
Start with data and actions
List the information a workload uses and the actions its users need. Reading a report, editing a model, managing a workspace, and changing capacity settings are different permissions. A broad role granted for convenience can expose more than the requested task requires. Use a non-sensitive test workspace when checking an access design.
An illustrative permissions test
Consider three fictional people: a report reader, an analyst editing a model, and an administrator handling workspace access. Write the permitted and forbidden actions for each before assigning roles. Sign in using the test identities and confirm that each can perform its required action while failing the prohibited ones. Record item-level sharing, app access, and data restrictions as well as the workspace role.
Distinguish licensing from authorization
A capacity size does not grant a reader access to a workspace. Free-license organizational Power BI viewing has capacity and access conditions; authoring and administration have separate requirements. Verify the current licensing documentation and the actual tenant settings. Do not infer that a working administrator account proves the reader experience is correct.
Inspect transmission and retention
Document which inputs remain in the browser, which are sent to a tool endpoint, and which are handled by an optional AI or support service. Hosting services can receive normal HTTP request details even when spreadsheet rows are processed locally. Never use a blanket zero-risk or legal-certification claim as a substitute for checking the implementation. Retain a list of approved sources, identities, retention requirements, and recovery owners. Recheck the access tests after a material role or data-model change.