security
453 TopicsWorkspace IP Firewall: Expected Behavior for Cross-Workspace API Calls?
We are evaluating Workspace IP firewall rules and noticed that cross-workspace API calls may be blocked when the source IP is not included in the workspace allowlist. Example: Workspace A uses its Workspace Identity to call Fabric APIs. Workspace B is protected by Workspace IP firewall rules. Workspace A has the required permissions on Workspace B. The API call fails because the source IP is not allowed. Is this expected behavior? If so, what is the recommended approach for secure Fabric-to-Fabric API communication between workspaces protected by Workspace IP firewall rules? More specifically, are Workspace Identities and Service Principals expected to work in this scenario, or are they also subject to the same IP-based restrictions? Workspace IP firewall rules restrict incoming access based on approved IP addresses. Additionally, is Microsoft currently evaluating any enhancements in this area, such as support for trusted Workspace Identities or Service Principals for cross-workspace API scenarios?Solved159Views1like4CommentsDP-600 Voucher
a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } Hi everyone, I recently passed the DP-700 Microsoft Fabric Data Engineer Associate certification and am now planning to take DP-600 (Microsoft Certified: Fabric Analytics Engineer Associate) while the Fabric concepts are still fresh in my mind. Unfortunately, I wasn't able to use a previous DP-600 voucher when I first received it as I wasn't ready for the exam at the time. I was wondering if anyone is aware of any current voucher opportunities for DP-600, or has an unused voucher that they won't be using and is transferable (if permitted by the voucher terms). Any guidance would be greatly appreciated. Thanks in advance! Regards, Amanul15Views0likes1CommentMicrosoft Fabric Materialized Lake Views (MLVs) – Looking for Confirmation on a Few Points
Microsoft Fabric Materialized Lake Views (MLVs) – Looking for Confirmation on a Few Points Hi everyone, I'm currently working with Materialized Lake Views (MLVs) in Microsoft Fabric and trying to establish the right approach for implementing them in a proper Dev → UAT → Production setup. I have gone through the available documentation, but I would appreciate confirmation from people who are already using MLVs in real projects. MLV Refresh Failure and Monitoring My current understanding is that if an MLV fails during its initial execution or during a scheduled refresh: The MLV run will be marked as Failed. The failure can be investigated through the MLV run history/monitoring experience. The error code, error message and execution details can be used for troubleshooting. If an upstream MLV fails, dependent MLVs may be skipped. Questions: Is there a recommended/native way to send an email or Teams notification whenever an MLV refresh fails? What is the recommended production monitoring approach for MLV refresh failures? Is anything else required in addition to configuring the MLV schedule? ON MISMATCH FAIL vs ON MISMATCH DROP My current understanding is that ON MISMATCH is related to handling schema/structure mismatches encountered during MLV processing, rather than being a general data-quality validation mechanism. For example: ON MISMATCH FAIL would cause the MLV operation to fail when the applicable mismatch occurs, whereas: ON MISMATCH DROP would allow processing to continue while dropping the affected/incompatible data. Questions: Is this understanding correct? What exactly constitutes a "mismatch" for an MLV? What are the recommended scenarios for using FAIL vs DROP? Does ON MISMATCH FAIL affect the entire MLV refresh or only the affected data/operation? Dev → UAT → Production Deployment This is probably my biggest area of uncertainty. Suppose I create and test the following in DEV: DEV Workspace Lakehouse Source tables MLV 1 MLV 2 My expectation is that I should not manually recreate the MLVs in UAT and Production. Instead, I would use Fabric lifecycle/deployment capabilities to promote the artifacts: DEV → UAT → PROD Questions: Are MLV definitions currently supported for this type of Dev → UAT → Prod deployment? Does Deployment Pipeline automatically handle the corresponding Lakehouse/item dependencies? If the workspace names, Lakehouse names and item IDs are different between environments, how are those references handled? Does Fabric automatically rebind supported dependencies to the corresponding target-environment resources? Which MLV-related properties/configurations need to be manually configured or validated after deployment? For example: DEV Workspace: BI_DEV Lakehouse: Sales_LH_DEV ↓ UAT Workspace: BI_UAT Lakehouse: Sales_LH_UAT ↓ PROD Workspace: BI_PROD Lakehouse: Sales_LH_PROD How much of this environment-specific mapping is automatically handled by Fabric? MLV Refresh Schedules Across Environments Suppose my DEV MLV has a refresh schedule of every 1 hour. When I deploy it to UAT and Production: Is the schedule also deployed? If it is, can or should it be different between environments? What is the recommended approach for managing MLV schedules separately in DEV, UAT and PROD? Is schedule configuration considered part of the deployable MLV artifact or environment-specific configuration? MLV Dependencies / MLV on top of MLV Can we create an MLV that references another MLV? For example: Source Tables → MLV 1 – Silver → MLV 2 – Gold → MLV 3 – Aggregation Is this a supported and recommended architecture? If yes: Are there any limitations on the number or depth of MLV dependencies? How does refresh orchestration work? If MLV 1 fails, are MLV 2 and MLV 3 automatically skipped? How is the dependency and lineage handled during deployment from DEV → UAT → PROD? SQL View on top of MLV Can we create a regular SQL View on top of an MLV? For example: Source Tables → Materialized Lake View → SQL View → Semantic Model / Power BI If this is supported: Are there any performance implications? Does the SQL View remain virtual while the MLV remains materialized? Is this a recommended pattern for exposing MLV data to downstream consumers? View → MLV Conversely, can an MLV be created on top of a regular SQL View? For example: Source Tables → SQL View → MLV If supported, are there any restrictions around the types of views or queries that can be used as an MLV source? Recommended Production Architecture For a production implementation, would the following architecture be considered a reasonable pattern? Source Tables → MLV Layer → Silver MLVs → Gold MLVs → SQL Views (if required) → Semantic Model → Power BI Or is it generally better to consume MLVs directly from the semantic model where possible? General Best Practices For anyone using MLVs in production: What are the main limitations you have encountered? What should be considered when designing MLV dependencies? How do you handle monitoring and alerting? How do you manage Dev/UAT/Prod deployment? Are there any MLV-specific CI/CD considerations that are easy to miss? What would you recommend avoiding when designing an MLV architecture? I'd particularly appreciate confirmation from anyone who has implemented MLVs across multiple Fabric environments such as DEV, UAT and PROD. Thanks in advance!73Views1like4CommentsFrom SAP, FSM and SharePoint silos to a Fabric Lakehouse: Medallion + Direct Lake
We recently moved a building-services client at DataToBiz off a reporting setup where data sat across SAP S/4HANA, SAP FSM, SharePoint, and flat files. Pulling together a single report meant manual extraction and reconciliation, with some reporting cycles taking up to two weeks. We rebuilt this on Microsoft Fabric. Dataflows Gen2, Pipelines, and Notebooks handle ingestion from the four source types through automated batch workflows, landing in a single Lakehouse on OneLake with a Bronze/Silver/Gold structure. Spark notebooks and pipelines handle large-scale transformation, cleansing, and KPI standardization across the source systems. Power BI semantic models with DAX and RLS handle role-based access. Reports use Direct Lake mode to work with data in OneLake without the traditional import-based refresh approach. Result: reporting went from 10–14 days to under a day, with 20+ reports automated across roughly 60 users. The interesting part wasn't just bringing the data into Fabric. It was standardizing KPIs when different enterprise systems represented the same metric differently. Question for the group: how are you handling KPI standardization when multiple enterprise systems define the same metric differently? If anyone has a scalable, metadata-driven approach for that, please share.99Views2likes5CommentsFabric Link in Tenant B, connected to Dataverse Tenant A
Fabric Link in Tenant B, connected to Dataverse Tenant A is anyone have this setup. I would like to use a service principal (delegated) using tenant id. But is this actually working? I cant have any Fabric artifacts in tenant A where Dataverse sits. Is there any special requirements that are needed for this service principal? Thanks in advanced.Solved81Views0likes6CommentsOAP for MLVs cross workspace
Hi all, I have a question regarding OAP implementation across multiple workspaces. My current setup consists of three layers: Bronze: OAP enabled Silver: OAP enabled Gold: OAP not enabled In the Bronze layer, I extract all source data using specific endpoints and gateways, with the required connection rules configured. In the Silver layer, I use shortcuts to access the source lakehouses in Bronze. This works as expected. Within Silver, I then create Materialized Lake Views (MLVs) for my entities. For example, I create a Person entity based on multiple source tables and store the result in LH_Silver. This also works correctly. The issue occurs in the next step. On top of the Silver entity, I want to create dim_Person. The MLV reads the entity from LH_Silver, but the output should be written to LH_Gold in the Gold workspace. When OAP is disabled on all workspaces, this cross-workspace setup works and I can successfully write the MLV to Gold. However, as soon as OAP is enabled on the Silver workspace, I can no longer write the MLV to the Gold workspace. I've already tried several connection rules, including: FabricMaterializedLakeView FabricSqlEndpointMetadata Fabric SQL Analytics Endpoint Lakehouse Notebook Web V2 I've also configured an MPE for the Gold (3000) workspace, but so far none of these options have resolved the issue. Does anyone know which connection rule, MPE, or configuration is required to allow an MLV running from an OAP-enabled Silver workspace to write to a Lakehouse in another workspace? Ideally, I would like to keep the notebooks and MLV logic in the Silver layer rather than moving them to the Gold workspace. Thanks in advance! Cel 1: %%pyspark spark.conf.set("spark.sql.caseSensitive", "true") workspace = spark.conf.get("trident.workspace.name") environment = "DEV" if "DEV" in workspace else "TEST" if "TEST" in workspace else "PRD" spark.sql(f"SET TargetEnvironment = 3000_CURATED ({environment})") Cel 2: CREATE OR REPLACE MATERIALIZED LAKE VIEW `${TargetEnvironment}`.LH_3000.Algemeen.dim_Persoon AS SELECT * FROM test.`02_entity`.Person59Views0likes5CommentsHow to efficiently maintain complex multi-table aggregations incrementally in Microsoft Fabric?
How to efficiently maintain complex multi-table aggregations incrementally in Microsoft Fabric? Comparison with Snowflake Dynamic Tables Hi everyone, I have a scenario where source data is continuously/incrementally loaded into Microsoft Fabric. We have multiple entities such as Customer, Product, Orders, Sales, Inventory, Invoices and Payments. We need to create business-ready/precomputed tables by joining multiple entities and performing aggregations. For example, a simplified transformation could be Customer + Orders + Product, followed by joins and aggregation by Customer, Product and Month. The challenge is not simply adding new records. A new incremental record can change an existing aggregation group. For example, suppose we already have Customer C001, Product P001, Month Jan and Sales of 1,000. If a new order arrives for the same Customer, Product and Month with Sales of 250, the existing aggregate needs to become 1,250. This becomes more challenging when the transformation involves multiple joins, GROUP BY, aggregations, DISTINCT counts, multiple related entities, and updates or deletes in source data. If we rebuild the complete precomputed table during every refresh, a large amount of historical data may need to be recomputed. As data volume and the number of entities increase, this could result in more data, larger transformations, more compute and longer refresh times. We are therefore trying to determine the best incremental maintenance pattern for these types of tables in Microsoft Fabric. SNOWFLAKE COMPARISON One approach we have been looking at in Snowflake is Dynamic Tables. Dynamic Tables provide a declarative way to define transformed or materialized results and allow Snowflake to manage refreshes based on changes and the configured refresh mode and target lag. The capability we are particularly interested in is maintaining the derived result incrementally instead of treating every refresh as a complete rebuild. We also understand that Snowflake Dynamic Tables do not make every transformation automatically incremental. Query shape, joins, aggregations and unsupported constructs can affect whether incremental refresh is possible. FABRIC OPTIONS WE ARE EVALUATING The first option we are evaluating is Lakehouse Materialized Lake Views (MLVs). MLVs appear to provide a similar architectural pattern where source tables are transformed into a persisted materialized result and the platform manages refresh. We are particularly interested in the optimal refresh and incremental refresh capabilities. We would like to understand how well MLVs handle transformations involving multiple joins, GROUP BY, aggregations, large historical datasets and new records that affect existing aggregation groups. For example, if Customer, Orders and Product are joined and aggregated by Customer, Product and Month, and a new order affects an existing historical Customer + Product + Month group, how does MLV incremental refresh handle this? The second option we are considering is maintaining physical precomputed or serving tables in Fabric Warehouse. The architecture would be roughly Lakehouse, Clean and Validated Data, Transformation and Aggregation, Warehouse Precomputed or Serving Table, Semantic Model and Power BI. One possibility is to use CTAS or staging-based patterns to generate the serving tables. However, if the transformation is rebuilt from the complete historical dataset, we may still end up recomputing a large amount of data during every refresh. We would therefore like to understand whether there is a recommended Fabric pattern for maintaining these physical tables incrementally, particularly when new or changed source records can affect existing aggregate groups. WHAT WE ARE TRYING TO DETERMINE We are not trying to claim that one approach is better than another. We are trying to identify the closest Fabric architecture to the incremental-maintenance capability we are familiar with from Snowflake Dynamic Tables. Can MLVs efficiently maintain complex multi-table joins and aggregations incrementally as data grows? What types of SQL transformations cause MLVs to fall back to full refresh? How does MLV incremental refresh behave when new records modify an existing aggregation group? For complex transformations, is it better to break the logic into multiple MLVs or intermediate layers? If using Fabric Warehouse physical serving tables, what is the recommended pattern for avoiding full historical recomputation? Are there Fabric-native patterns for identifying and recomputing only the affected partitions, keys or aggregation groups? For large enterprise datasets, what approach have others found most scalable and maintainable? OUR CURRENT ARCHITECTURE Our architecture is roughly Source Systems, Bronze, Clean and Validated Data, Precomputed or Serving Tables, Gold or Consumption Layer, Semantic Model and Power BI. The objective is to perform expensive joins and aggregations during data processing rather than repeatedly during interactive BI queries. The open question is how best to maintain the Precomputed or Serving layer incrementally as source data continues to grow and change. I would really appreciate input from anyone who has implemented this at scale in Microsoft Fabric, particularly comparisons between Fabric MLVs, Warehouse-based serving tables and other Fabric-native incremental processing patterns. Thanks in advance!Solved62Views0likes5CommentsFabric Welcome Popup - Hide/Disable
Team - I am back with another requirement from my end users. They dont want to see the "Welcome to Fabric View " pop-up when they log in using Fabric apps URL. I have gone through all the tenant setting and I dont see any way to hide or disable this pop-up. Did anyone come across similar requirement? Any thoughts or suggestions? -PattSolved100Views0likes4CommentsFabric IQ: Do Ontology entity synonyms work with Data Agent?
Hi, everyone! Short intro Currently I'm using the "super-duper-mega-nano-ultra" product - Microsoft Fabric to build natural language processing flow on-top of Microsoft Fabric Warehouse data. As for now It's rather a POC than production solution. I found a lot of the official Microsoft' documentation related to my task, but I have a little problem... The solution architecture (high-level) I made some investigations and as the result is the following architecture, which I want to implement (picture below): The idea is the next: the Microsoft Fabric Warehouse schema is connected to Microsoft Fabric Lakehouse, using shortcut; the Microsoft Fabric Ontology consumes the Microsoft Fabric Lakehouse as a data source for data binding; the Microsoft Fabric Data Agent uses a Microsoft Fabric Ontology (enriched with business context) to process natural language questions. The Microsoft Fabric Warehouse contains the following (dummy) objects (picture below): Tenant settings Microsoft documentation says, that specific tenant configurations should be applied to use Microsoft Fabric Ontology with Microsoft Fabric Data Agent (https://learn.microsoft.com/en-us/fabric/data-science/data-agent-tenant-settings) - everything is configured properly. Ontology configuration My Microsoft Fabric Ontology is configured as below (the configuration is influenced by Microsoft Fabric Ontology tutorial, which can be found here - https://learn.microsoft.com/en-us/fabric/iq/ontology/overview). Main view - two entities with a single relationship: ETLEntity entity configuration - the entity has the description, one synonym, metadata: ETLEntityRun entity configuration - the entity has the description, one synonym, metadata: As for now the Microsoft documentation says, that Microsoft Fabric Ontology descriptions, synonyms, metadata help Microsoft Fabric Data Agent to better understand the context (https://learn.microsoft.com/en-us/fabric/iq/ontology/how-to-add-semantic-enrichment). The problem My Microsoft Fabric Data Agent is connected to my Microsoft Fabric Ontology, which is described above, but the agent can't answer the simple questions about entities and the questions examples are provided below (the Microsoft Fabric Ontology Graph model was refreshed successfully before questions were asked): ETLEntity successful question without synonym usage: ETLEntityRun successful question without synonym usage: ETLEntity failed question with synonym usage: ETLEntityRun failed question with synonym usage: Looks like Microsoft Fabric Data Agent can't figure out, which entities are unicorn/wizard, even if they have appropriate synonyms. It's not my first iteration - I tried a lot, but result still the same every time. I feel like I missed something obvious in my configuration, but what... What are your thoughts? P.S.: the provided configuration is simple; objects and their metadata has no business context - It's just a sample, which I built to test some scenario; I think It's enough to check such use-case.391Views0likes8CommentsRed Flag in SQL Analytics EndPoint - User Identity Access Mode
We are seeing some red flags when switching the default access mode "Delegated" to ""User's Identity" in a SQL Analytics EndPoint of lakehouse, but seeing red flags with message not relevant to the user who were given access to downstream lakehouse, below is the details. Current Configuration: LH1 is in the hub workspace/WS1 with Onelake security role where users were added. In the user workspace/WS2, a shortcut to LH2 the source data is created, user can access through LH2’s SQL Analytics Endpoint, data access mode is switched to User’s Identity, so that source lakehouse's security role control access fully. In SQL End, there are some red flags as below, but user can access data without issue, which is confusing: error details: User principal is not supported. Issue: Error details is specifically for an AD group which is a workspace contributor role in the source workspace role (default reader of all tables in the source lakehouse), and it doesn't have access to the user's lakehouse. Question: Does anyone see the same? or it's a known issue?115Views0likes7Comments