Governance of the Fabric resources “Owner” account

[vivien57]

Hello everyone,

I would like to know what your best practices are in terms of ownership of DataflowGen2, DataPipeline, Lakehouse,...

Indeed, when elements are created, the default Owner is the user. For DataFlows, it's quite simple: if you want to change it, just log in with another account and do a TakeOver...

However, this option does not exist for Lakehouses, DataPipelines etc...

How do you do it? What best practices do you use?

Supplementary question: if I have a DataPipeline for which I am Owner and my AAD account is deactivated, will it continue to work?

Thank you in advance for your help.

Have a nice day,

Vivien

[nilendraFabric]

Hi  , 

I have faced all of these in my experience.

Currently, there is no direct way to transfer ownership of a Lakehouse through the Microsoft Fabric UI or APIs.

If the owner’s Azure Active Directory (AAD) account is deactivated:

• Resources like Data Pipelines may fail if they rely on credentials associated with the deactivated accoun
• Connections authenticated with the owner's organizational account will stop working unless updated with new credentials.
• Resources tied to a workspace should continue functioning if other users in the workspace have sufficient permissions

  https://stackoverflow.com/questions/78599859/microsoft-fabric-change-data-pipeline-owner

  https://community.fabric.microsoft.com/t5/Data-Pipeline/How-to-change-ownership-of-a-pipeline-in-MS-...

  Best Practice is to assign ownership of critical resources to a service account or managed identity rather than an individual user. Service accounts are not tied to a specific person, reducing risks when team members leave or their accounts are deactivated
  
  Hope this helps
  Thanks 

@vivien57

[vivien57]

Hello,

thank you very much for your feedback.

In my situation, for example, the dataPipeline is in my name, but the authentication for the data sources is done at the gateway level with a technical account.

In this scenario, even if my account (which is Owner of the dataPipeline) is deactivated, the dataPipeline will continue to work?

In the scenario where you don't use an AAD account, but a principal service, how do you go about deploying resources under the name of the principal service?

Thanks in advance for your feedback

Vivien

[nilendraFabric]

Hello @vivien57 

Thanks for the follow up question.

The pipeline takes the role of the user who is running it, so all activities you run have to be allowed by the "new" user

so in your case the pipeline should continue to function even if  (AAD) account is deactivated. This is because the actual data source connections rely on the gateway’s technical account credentials, not your personal AAD account. 

Mainly I have used SP for access management, not for deployment for eg get access to sharepoint folder or to DB etc

hope this helps

pleadr accept the solution and give kudos if this is helpful 

thanks

[vivien57]

Hello,

Thank you very much for your feedback, once again.

Is there an official Microsoft or other link to make sure that if authentication is done with the technical account, deactivating the Owner account doesn't stop the data pipeline?

Is this a test that you have been able to carry out yourself?

Thank un advance for your return,

Vivien

[nilendraFabric · Accepted solution]

Hi @vivien57 

I have tested it in one of my projects, no official docs covering specific this scenario I am able to found.

but please see this forum discussion 

https://community.fabric.microsoft.com/t5/Data-Engineering/What-happens-with-a-Fabric-component-if-t...

please accept the answer and give kudos if this resolved the query

Thanks