Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Microsoft is giving away 50,000 FREE Microsoft Certification exam vouchers. Get Fabric certified for FREE! Learn more

Reply
KentKMishra
Frequent Visitor

Security Governance and Monitoring

We've had PBI Premium for several years and are moving to Fabric, while also consolidating some of our non-Fabric platforms into Fabric. I've noticed that as we are trying to build out SOPs for adding security in Fabric/PBI, security is getting to be a bit hard to monitor. I need to know what groups\users have access to where, so we can quickly identify where they need to be removed or updated without breaking things or providing access that they shouldn't have. 

What are other companies doing for this? Looks like I can get a workspaces metadata from using the API: Admin - WorkspaceInfo GetScanResult and adding the getArtifactUsers parameter, but then I have to also know all the workspace ids in advance. (Not to mention I've only done very basic API call stuff.) I'm the Fabric Admin, so permissions should not be an issue, but I need to be able to have some monitoring capabilities over Fabric artifacts and the permissions that are attahced to them, without needing to click through 50-200 workspaces each day. 

I'd like to have something where I can select the artifact type (workspaces, notebooks, warehosues, etc..) and see a list of all groups and users (and their permissions) for that artifact type. As well as be able to select a user/group individually and see what their permissions are for every artifact they have permission to. 
I can not find anything that already has this capability built into Fabric (or elsewhere from an admin perspective), so if I need to build something I'm not opposed. Any guidance would be appreciated. 

Thanks. 

 

6 REPLIES 6
v-tsaipranay
Community Support
Community Support

Hi @KentKMishra ,

Thank you for reaching out to the Microsoft Fabric Community. Also thank you @andrewsommer and @nilendraFabric  for your inputs.

 

Currently, Fabric does not offer a centralized, built-in solution for tracking permissions across all artifacts and Entra ID groups. However, a practical approach is to leverage the Power BI Admin APIs (e.g., GetWorkspacesAsAdmin and GetScanResult) to retrieve workspace access data, and Microsoft Graph API (e.g., List Group Members) to resolve Entra ID group memberships. This can be automated using Power Automate or Azure Functions, with results stored in SharePoint or SQL for easy monitoring.

 

To streamline this process, you can build a Power App for real-time access management, where you can filter by user/group or artifact type and track permissions. For detailed guidance, here’s a starting point for integrating APIs into Power Apps: Use a custom connector from a Power Apps app | Microsoft Learn

This approach gives you the visibility and control you need over user access across your Fabric environment.

 

I hope this will reslove your issue, if you need any further assistance, feel free to reach out.

 

If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.

 

Thankyou.

Hi @KentKMishra 

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.


Thank you.

 

andrewsommer
Impactful Individual
Impactful Individual

We tackle this problem by using a combination of a PowerApp and the API.  It is easy to pull who is in what Entra group through the native PowerApp connectors.  It is also straight forward to build in the functionality to add and remove people from these groups using power apps.  

 

We only publish Power BI content through Power BI apps.   Content within the app is broken up by audience with typically one Entra security group per audience. Those groups are then managed by the respective data steward for that Power BI app through the PowerApp built to manage access. 

 

Please mark this post as solution if it helps you. Appreciate Kudos.

Thanks. Any link references on where I can look into doing the Power App with API solultion for this in the context of security? I haven't used Power Apps yet, but have a book and would do it as a weekend project if need be. Anything to get this security thing under control. 


The PBI app thing won't work for us because of all our developement work (particularly in Fabric) does not translate always to a PBI app. That only works for us for report consumers. 

KentKMishra
Frequent Visitor

Unfortunately neither of those options work (as far as I can tell). 

Admin monitoring doesn't capture who/where has access, and doesn't capture Entra Group permissions (which is odd, since that's recommended best practice.) Also, it gives A LOT of false positives for audit in the Feature Usage and adoption report drill down (as does Monitor). If I schedule a pipeline that kicks off other pipelines and notebooks, then the last person that touch thing (ie: maybe changed 1 thing in a pipeline) becomes the "user" that appears as running all the other things. There's so much noise in there is also difficult to find what you need. 

With the Workspace monitoring solution, it's specific to a singular worksspace, and that doesn't help (and I suspect may run into the same issues as the admin monitoring). I need to be able to know if I remove the security group: sg-fabric-lotsofshannigans from Entra, where they may lose access in Fabric. 
I also need to be able to see at a tenant level, where domain admins have given joesmoe@company.net contributor access to make sure it is appropriate. Or even that sallyque@othercompany.net that is consulting with us, has created a worksspace and added joesmoe viewing rights that we don't want him to have. 



nilendraFabric
Community Champion
Community Champion

 

These might be possible options 

 

 

Admin Monitoring Workspace:
• Fabric provides an admin monitoring workspace for administrators to perform security audits and usage checks. This workspace allows you to monitor workloads, governance, and capacity metrics in a centralized environment.
• Reports within this workspace can be shared with non-admin users through viewer roles for broader visibility

 

 

 

Workspace Monitoring Database:
• Workspace monitoring creates a secure Eventhouse database that aggregates logs and metrics from Fabric items. It supports querying via KQL or SQL for analyzing usage and performance data.
• This tool is useful for real-time monitoring but may require technical expertise to set up custom queries and dashboards

 

https://learn.microsoft.com/en-us/fabric/admin/monitoring-workspace


https://learn.microsoft.com/en-us/fabric/fundamentals/workspace-monitoring-overview

 

 

Helpful resources

Announcements
MarchFBCvideo - carousel

Fabric Monthly Update - March 2025

Check out the March 2025 Fabric update to learn about new features.

March2025 Carousel

Fabric Community Update - March 2025

Find out what's new and trending in the Fabric community.

"); $(".slidesjs-pagination" ).prependTo(".pagination_sec"); $(".slidesjs-pagination" ).append("
"); $(".slidesjs-play.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-stop.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-pagination" ).append(""); $(".slidesjs-pagination" ).append(""); } catch(e){ } /* End: This code is added by iTalent as part of iTrack COMPL-455 */ $(".slidesjs-previous.slidesjs-navigation").attr('tabindex', '0'); $(".slidesjs-next.slidesjs-navigation").attr('tabindex', '0'); /* start: This code is added by iTalent as part of iTrack 1859082 */ $('.slidesjs-play.slidesjs-navigation').attr('id','playtitle'); $('.slidesjs-stop.slidesjs-navigation').attr('id','stoptitle'); $('.slidesjs-play.slidesjs-navigation').attr('role','tab'); $('.slidesjs-stop.slidesjs-navigation').attr('role','tab'); $('.slidesjs-play.slidesjs-navigation').attr('aria-describedby','tip1'); $('.slidesjs-stop.slidesjs-navigation').attr('aria-describedby','tip2'); /* End: This code is added by iTalent as part of iTrack 1859082 */ }); $(document).ready(function() { if($("#slides .item").length < 2 ) { /* Fixing Single Slide click issue (commented following code)*/ // $(".item").css("left","0px"); $(".item.slidesjs-slide").attr('style', 'left:0px !important'); $(".slidesjs-stop.slidesjs-navigation").trigger('click'); $(".slidesjs-previous").css("display", "none"); $(".slidesjs-next").css("display", "none"); } var items_length = $(".item.slidesjs-slide").length; $(".slidesjs-pagination-item > button").attr("aria-setsize",items_length); $(".slidesjs-next, .slidesjs-pagination-item button").attr("tabindex","-1"); $(".slidesjs-pagination-item button").attr("role", "tab"); $(".slidesjs-previous").attr("tabindex","-1"); $(".slidesjs-next").attr("aria-hidden","true"); $(".slidesjs-previous").attr("aria-hidden","true"); $(".slidesjs-next").attr("aria-label","Next"); $(".slidesjs-previous").attr("aria-label","Previous"); //$(".slidesjs-stop.slidesjs-navigation").attr("role","button"); //$(".slidesjs-play.slidesjs-navigation").attr("role","button"); $(".slidesjs-pagination").attr("role","tablist").attr("aria-busy","true"); $("li.slidesjs-pagination-item").attr("role","list"); $(".item.slidesjs-slide").attr("tabindex","-1"); $(".item.slidesjs-slide").attr("aria-label","item"); /*$(".slidesjs-stop.slidesjs-navigation").on('click', function() { var itemNumber = parseInt($('.slidesjs-pagination-item > a.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); });*/ $(".slidesjs-stop.slidesjs-navigation, .slidesjs-pagination-item > button").on('click keydown', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); var itemNumber = parseInt($('.slidesjs-pagination-item > button.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); }); $(".slidesjs-play.slidesjs-navigation").on('click', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); }); $(".slidesjs-pagination-item button").keyup(function(e){ var keyCode = e.keyCode || e.which; if (keyCode == 9) { e.preventDefault(); $(".slidesjs-stop.slidesjs-navigation").trigger('click').blur(); $("button.active").focus(); } }); $(".slidesjs-play").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-stop").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-play")) { $(".slidesjs-stop").focus(); } } }); $(".slidesjs-stop").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-play").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-stop")) { $(".slidesjs-play").focus(); } } }); $(".slidesjs-pagination-item").keydown(function(e){ switch (e.which){ case 37: //left arrow key $(".slidesjs-previous.slidesjs-navigation").trigger('click'); e.preventDefault(); break; case 39: //right arrow key $(".slidesjs-next.slidesjs-navigation").trigger('click'); e.preventDefault(); break; default: return; } $(".slidesjs-pagination-item button.active").focus(); }); }); // Start This code is added by iTalent as part of iTrack 1859082 $(document).ready(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); $("#tip2").attr("aria-hidden","true").addClass("hidden"); $(".slidesjs-stop.slidesjs-navigation, .slidesjs-play.slidesjs-navigation").attr('title', ''); $("a#playtitle").focus(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").mouseover(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").blur(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#playtitle").mouseleave(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#play").keydown(function(ev){ if (ev.which ==27) { $("#tip1").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); $("a#stoptitle").focus(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").mouseover(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").blur(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").mouseleave(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").keydown(function(ev){ if (ev.which ==27) { $("#tip2").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); }); // End This code is added by iTalent as part of iTrack 1859082