Microsoft Fabric now supports workspace-level private link for SQL database, giving organizations a more targeted way to secure inbound access for sensitive data workloads. A private link is a private network connection that routes traffic over Microsoft’s backbone network instead of the public internet. With workspace-level private link, you can apply that protection to specific workspaces instead of to an entire tenant.
This matters for teams that need stronger network isolation but do not want to lock down every workspace in the environment. Some workspaces may support broad collaboration, while others handle regulated, confidential, or business-critical data. Workspace-level private link helps you protect the workspaces that need tighter controls without forcing the same network posture across the rest of your Fabric environment.
Why this capability is useful
Organizations often need to balance security, operational flexibility, and ease of administration. Tenant-wide controls are useful in some environments, but many teams need a more granular option that matches the sensitivity of a specific project or business unit. Workspace-level private link introduces that flexibility by letting you restrict inbound access at the workspace boundary.
This approach can help teams reduce public exposure, centralize how protected workspaces are managed, and support internal security requirements more precisely. It also gives workspace owners and administrators a clearer path for securing high-sensitivity data experiences without requiring a tenant-wide architecture change. For customers using SQL database in Microsoft Fabric for business applications, analytics workloads, or operational reporting, that translates into stronger control over how users and services connect.
Key benefits include:
- More granular control over which workspaces accept private traffic only.
- Better alignment between workspace security boundaries and project or data sensitivity.
- Greater flexibility than tenant-wide restrictions when only selected workspaces need stronger protection.
How workspace-level private link works
Workspace-level private link maps a workspace to a specific virtual network by using Azure Private Link. When a workspace is configured to restrict inbound public access, that workspace can be reached only through an approved private endpoint. This helps ensure that inbound traffic follows an allowed path rather than arriving from the public internet.
Fabric supports both tenant-level private links and workspace-level private links. Tenant-level private links apply network restrictions across the full tenant, while workspace-level private links secure access to selected workspaces without affecting the rest of the environment. That distinction is important for organizations that want to protect a subset of workspaces while keeping other workspaces open for broader access patterns.
For SQL database in Microsoft Fabric, this preview makes it possible to use the database experience inside workspaces that are secured with workspace-level private link. That gives teams a clearer way to combine SQL database workloads with workspace-scoped inbound network protection as part of a broader security design.
Common scenarios
Workspace-level private link is especially useful when a team needs to isolate one workspace without changing the connectivity model for the full tenant. For example, a finance, legal, or healthcare analytics team may need to restrict inbound access to a workspace that contains sensitive data, while product or reporting workspaces remain accessible through a broader model. This lets organizations align security boundaries more closely to business use.
It is also useful when different projects in the same tenant have different compliance or network requirements. One workspace may need strong inbound protection because it supports confidential customer data, while another workspace may be designed for wider collaboration. Workspace-level private link supports that mixed model more naturally than a single tenant-wide setting.
Set up workspace-level private link
You can set up workspace-level private link by using the public guidance in Set up and use workspace-level private links. The exact implementation depends on your environment, but the core flow in Fabric is straightforward once the required Azure networking configuration is in place.
Use this high-level process:
- Create a new workspace or open an existing workspace that you want to secure.
- Set up the required Azure Private Link resources by following Set up and use workspace-level private links.
- In the workspace, open Workspace settings.
- Select Inbound network.
- Under the workspace connection settings, select Allow connections from selected networks and workspace-level private links.
- Save your changes and validate access from the approved private network path.
After configuration is complete, all connections must flow through the approved private endpoint path associated with the workspace. Access then flows through the approved private endpoint path associated with the workspace. This model gives administrators a more precise way to protect inbound connectivity while keeping the implementation tied to a specific workspace instead of the entire tenant.
What customers gain
The value of this preview is not only stronger protection, but also better fit. Many organizations do not need the same inbound network posture everywhere, and they should not have to choose between leaving sensitive workspaces open or applying a tenant-wide restriction that affects every team. Workspace-level private link gives customers another option that is easier to align with real project boundaries.
For teams using SQL database in Microsoft Fabric, that means they can bring secure workspace-level network controls into environments where SQL development, administration, and data access are already happening. This can simplify security conversations across product, platform, and network teams because the protection boundary is clear and directly attached to the workspace that holds the workload. It also supports a more intentional security design for workspaces that contain data with higher sensitivity.
Plan your rollout
Before enabling workspace-level private link, identify which workspaces truly need inbound access restrictions and which workspaces are intended for broader collaboration. That planning step helps teams apply the capability where it adds value instead of widening administrative overhead unnecessarily. It also makes it easier to coordinate security, networking, and workspace ownership decisions upfront.
As part of rollout planning, review the workspace-level private links overview and the private links for Fabric overview. Those articles explain how workspace-level private links relate to tenant-level private links and how Fabric uses private endpoints for secure inbound access.
Get started
Workspace-level private link for SQL database in Microsoft Fabric gives teams a more granular way to secure inbound access for selected workspaces. If you want stronger network isolation for sensitive SQL database workloads without applying tenant-wide restrictions, this preview is a practical place to start.
To take the next step, review Set up and use workspace-level private links and the workspace-level private links overview. Then identify the workspaces in your environment that would benefit most from workspace-scoped inbound protection and begin validating the setup with your security and networking teams.
For any issues related to this preview, please create a support ticket.
Microsoft Employee