Microsoft Fabric Workload Governance Best Practices in Azure Landing Zone

[wchanus]

What are the best practices for implementing governance for Microsoft Fabric, which operates under a SaaS model, within a new management group and subscription in Azure Landing Zone? Are there any specific guidelines or resources available for this scenario?

[nxross]

Is this of any help to you? - https://community.fabric.microsoft.com/t5/Fabric-platform-Community-Blog/Microsoft-Fabric-CAF-Config... 

[v-aatheeque · Accepted solution]

Hi @wchanus 

Thanks @nxross  for your prompt response. In addition to that let me add some insights here:

• Implementing governance for Microsoft Fabric within a new Azure Management Group and Subscription under an Azure Landing Zone (ALZ) requires aligning with core principles of security, cost control, and operational efficiency. While Fabric operates as a SaaS platform and differs from traditional IaaS/PaaS models.
• It still benefits from the structured governance offered by Landing Zone practices. To ensure effective governance, it's important to establish standardized naming conventions, tagging policies, and resource management practices. Additionally, leverage Azure Policy and role-based access control (RBAC) to enforce compliance, maintain security, and ensure consistent management across the environment.
  
  

  For official documentation on Microsoft Fabric governance, you can explore the following resources:

  1. Governance and compliance in Microsoft Fabric - Microsoft Fabric | Microsoft Learn  Microsoft - Provides a comprehensive overview of governance strategies.

     Hope this helps !!
     
     

     If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

     If you continue to face issues, feel free to reach out to us for further assistance!

[wchanus]

This is one of the key insights I’ve been seeking. I am currently working to identify which Azure Policies should be applied to the dedicated management group—for example: Root Tenant > Contoso > Landing Zones > new created <Data & Analytics> > new subscription <Fabric 16, 32, or 64>.

Based on this management group structure, it’s important to evaluate which Azure components should be included as part of the design. These may include:

• Azure Policy at Data & Analytic and subscription level 

• Entra ID for identity management and workspace-level access control

• Network security for managing endpoints and enforcing access restrictions

• Data transfer mechanisms between source systems and the target Fabric data stores

• External access control for internet-facing endpoints, if required

• Log Analytics workspace to collect and monitor related telemetry and audit logs

These considerations must be addressed within the Azure platform, as Power BI has its own independent management and governance model.

If anyone has implemented a similar setup or has related experience, I’d greatly appreciate your insights—I’m keen to learn more.