How is data stored at rest and in transit Between Dataverse and Fabric (DV Direct Fabric Link)

[fabricpribeiro]

Dears,

I am creating a Technical Design Document (TDA)

I have a Dataverse Fabric Direct Link my Raw Fabric Workspace:

Can you please help undertand the best language to describe this from a security perspective?

1 - I have a workspace identity which has contributor permissions in my workspace

2 - This is then mappend to a Dataverse App user which has admin previleges in DV

3 - For the above two points, I am clear

3 - But I don't know how to descrive the rest , meaning,

4 - When data is flowing (in transit) is it encrypted betwen dataveerse and fabric? and if so, using which proptocol ?

5 - How can I describe the data at Rest , when it lands into the lakehouse  in Raw? is it encrypted by Fabric using the azure encryption?

Can you please help clarify this two points?

Thanks a lot,

Pedro

[v-pnaroju-msft]

Hi fabricpribeiro,

We are pleased to note that your issue has been resolved. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.

[deborshi_nag · Accepted solution]

Hello @fabricpribeiro 

4) Data in transit  

Both Dataverse and Fabric being SaaS services in Microsoft, Service‑to‑service communication occurs over Microsoft‑managed Azure backbone networking and is not exposed to the public internet.

All data transferred between Microsoft Dataverse and Microsoft Fabric is encrypted in transit using TLS 1.2 or higher. Dataverse is using the latest TLS 1.3 and TLS 1.2 cipher suites as approved by the Microsoft Crypto Board. 

So in summary:

• Dataverse runs on Azure
• Fabric runs on Azure
• Service-to-service traffic:
  • Uses HTTPS
  • Uses TLS 1.2+
  • Uses Microsoft’s internal network where possible
• You do not manage certificates yourself

On your diagram, in the arrow between Dataverse and Fabric you can indicate this by using this text -

All service-to-service data flows over Microsoft backbone and encrypted using industry‑standard TLS 1.2+ protocols.

5) Data at rest

When data is created in Fabric in Tables/, it is stored in OneLake. OneLake is backed by Azure Data Lake Storage Gen2 - encryption is On by default. Data is persisted in OneLake and encrypted at rest using Azure Storage Service Encryption (SSE), using Microsoft‑managed keys and AES‑256 encryption. This is Azure's built-in encryption standard. 

On you Fabric side of your diagram you can indicate this using this text - 

Data stored in Fabric OneLake is encrypted at rest using Azure Storage Service Encryption with Microsoft‑managed keys.

[fabricpribeiro]

This reply was perfect. Thank you very much, I have two similar questions, for other sources but I will put them in a separated thread 

Thank you very very much