Forum Discussion
Securing Fabric
Hi Guys, I need help securing Fabric for a client. The ultimate goal is to only allow VPN or On-Prem users to access the Fabric Portal in any way shape or form. At first, we wanted to configure a Private instance. However, if you check the Disable Public Access checkbox, a lot of things break, like CoPilot. Second, we looked at Conditional Access Policies. However, there is no Enterprise Application for Fabric! So a simple Block CAP Policy will not work without having to lump in Power BI Service, Azure Data Explorer, Azure SQL Database, Azure Storage, and Azure Cosmos DB. (per this article https://learn.microsoft.com/en-us/fabric/security/security-conditional-access) We don't want to block PowerBI behind the same rules, because some external clients use our PowerBI instance. The main concern is accidental leakage of data, not nuclear-secret hardening . What can we do to help mitigate public access to their Fabric instance in a reasonable but substantial way while preserving most of the features?Securing Fabric
Hi workdata,
If you want full functionality, I don't think this is possible for just fabric. This would be a fantastic idea to post over at Fabric Ideas - Microsoft Fabric Community
Right now the only two methods of controlling access are private links (which break a lot of things right now) and conditional access.
Protect inbound traffic - Microsoft Fabric | Microsoft LearnConditional access - Microsoft Fabric | Microsoft Learn
Conditional access explicitly states that the policy needs to be applied to:
- Power BI Service
- Azure Data Explorer
- Azure SQL Database
- Azure Storage
- Azure Cosmos DB
which is far wider than just Fabric itself.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
2 Replies
Hi workdata,
If you want full functionality, I don't think this is possible for just fabric. This would be a fantastic idea to post over at Fabric Ideas - Microsoft Fabric Community
Right now the only two methods of controlling access are private links (which break a lot of things right now) and conditional access.
Protect inbound traffic - Microsoft Fabric | Microsoft LearnConditional access - Microsoft Fabric | Microsoft Learn
Conditional access explicitly states that the policy needs to be applied to:
- Power BI Service
- Azure Data Explorer
- Azure SQL Database
- Azure Storage
- Azure Cosmos DB
which is far wider than just Fabric itself.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
