Preventing Confidential Data Exfiltration

[DAJones91]

Working pretty much exclusively with confidential financial data in Fabric and I'm wondering if there is any way to prevent a user from (maliciously) using the Copy activity in pipelines to send data to an external data sink (e.g. a personal cloud storage account or that of another corporate?). Assuming the user can authenticate to the sink of their choice, this scenario seems entirely possible and it's not clear from the literature if it can be prevented at all.

[NandanHegde · Accepted solution]

Hey,

unfortunately in case if a user has access on both the source (confidential data) and sink and if the user has the necessary permission to create pipelines within Fabric, we cannot restrict users from moving the data.

But in the PaaS equivalent of Data factory, you can restrict users from creating linked services thereby restricting the movement into unwanted sinks.

But this access granularity is not yet supported in Fabric (and might not be because this being a SaaS application)

[Anonymous]

Hello @DAJones91 ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet .
In case if you have any resolution please do share that same with the community as it can be helpful to others .
Otherwise, will respond back with the more details and we will try to help .