Chapter 2 of 6
Architecture at a glance#
The flow starts with live Fabric tenant settings. The Fabric administrator exports the settings through the Admin REST API and compares the Copilot and AI group with the module baseline.
The data platform owner then applies one OneLake security role to the approved gold lakehouse. The role grants Read to the Microsoft Entra AI consumer group, adds the approved row and column restrictions, and records the restricted group removal from DefaultReader.
The Purview operator applies the selected sensitivity label to the Fabric item and creates the DLP policy for the Fabric location in simulation mode. The delivery owner then observes the intended and blocked consumer checks.
| Layer | Authoritative service | Repository record | Check |
|---|---|---|---|
| Tenant settings | Microsoft Fabric Admin REST API | tenant-settings-baseline.json | Copilot and AI drift |
| Lakehouse access | OneLake security roles | onelake-ai-consumer-role.json | Live role membership |
| Label and DLP | Microsoft Purview | fabric-label-dlp-decision.json | Portal summary and simulation |
| Delivery result | Fabric consumer path | access-check-plan.json | Permitted and restricted identities |
Design choices and tradeoffs#
| Decision | Chosen approach | Benefits | Costs and limitations |
|---|---|---|---|
| Tenant settings | Compare the Copilot and AI group to a recorded baseline | Finds drift before the lakehouse is used for grounding | The check is read-only; an administrator still changes settings through the approved Fabric path |
| Access model | OneLake Read role for one AI consumer group | Keeps one access rule across supported Fabric paths | Workspace Admin, Member, and Contributor roles can bypass the role and must stay out of the consumer path |
| Restricted users | Remove restricted principals from DefaultReader and test a restricted identity | Confirms the role is not hidden by broad default access | The live user check needs a real restricted identity |
| Purview control | Apply the label and run Fabric DLP in simulation mode first | Shows matches and policy tips without enforcing actions | Full enforcement needs a later Purview change after match review |
| Automation | REST checks for Fabric, portal-led Purview change | Uses documented read paths and avoids unsupported Purview policy APIs | The DLP policy preview is the Purview portal summary and simulation, not a what-if API |
Architecture guidance#
Use Tenants - List Tenant Settings for the Fabric Admin REST endpoint, paging, and caller requirements.
Use OneLake security roles: create and manage for role behavior, RLS/CLS, member assignment, and DefaultReader review.
Use Get started with DLP for Fabric and Power BI for Fabric DLP supported locations, actions, custom-policy limits, and capacity requirements.