Overview Microsoft Fabric provides strong governance constructs for data, semantic models, workspaces, and capacity usage. However, email subscriptions remain governed by a single tenant-wide on/off setting that does not align with how Fabric is operated in controlled enterprise environments. There is currently no supported way to allow managed subscriptions for administrators or reporting teams while preventing end-user self-service subscriptions. Context In many Fabric tenants: Only designated reporting teams are permitted to publish content to Fabric capacities Workspaces, apps, and access are centrally governed Reports often contain sensitive or regulated information Distribution of report outputs is considered a controlled operational activity These tenants do not operate as self-service environments. Instead, reporting teams act as trusted publishers responsible for both content and distribution. Current Limitation Fabric email subscriptions are controlled by a single tenant setting: Enabled: Any user with access to a report can create subscriptions Disabled: No subscriptions can be created, including by tenant admins, workspace admins, app owners, or service principals There is: No security group scoping No role-based permission No admin override No publisher-owned subscription model Fabric capacity, workspace roles, sensitivity labels, and admin APIs do not provide governance over subscription creation or ownership. Why This Is a Problem This design assumes that: Viewing data implies authority to distribute it Subscriptions are an end-user convenience feature In governed Fabric environments, this assumption does not hold. As a result: Native subscriptions must be disabled entirely Organizations are forced to build custom delivery solutions using Power Automate or REST APIs Reporting teams cannot use a built-in Fabric capability for a common enterprise requirement This creates unnecessary complexity for a basic reporting scenario. Requested Capabilities Fabric needs a governed subscription model aligned with enterprise usage patterns. Examples include: Security-group scoped subscription control Allow subscriptions only for specified Azure AD groups (e.g., reporting teams) Publisher-managed subscriptions Subscriptions owned by a workspace, app, or report — not by individual users Role-based permission separation Distinct permission for “Create subscriptions” separate from “View content” Admin override capability Allow tenant or workspace admins to manage subscriptions even when end-user subscriptions are disabled Business Impact Without a governed subscription model: Fabric’s native subscription feature cannot be used in sensitive or regulated environments, e.g., PII or publicly traded entity. Reporting teams cannot provide managed, auditable report delivery using first-party Fabric features. Reporting teams cannot control subscription distributed to Outlook, which leadership considers unsafe. This is not a request for additional self-service functionality, but for controlled, publisher-owned distribution consistent with Fabric’s governance direction. Closing Fabric has made significant progress in enterprise governance. Email subscriptions remain an exception that assumes a low-risk, self-service usage model. Introducing a governed, publisher-managed subscription capability would enable Fabric to better support mature, security-conscious tenants without compromising existing self-service scenarios.
... View more