Chapter 3 of 6
Confirm these requirements:
- One approved nonproduction Fabric workspace contains the gold lakehouse used for grounding.
- The Fabric workspace runs on a Fabric or Premium capacity that supports the planned Fabric DLP scope.
- The Fabric administrator can read tenant settings and operate OneLake security roles for the selected lakehouse.
- The Microsoft Entra AI consumer group and restricted consumer group are known and approved.
- The Purview operator can apply the selected sensitivity label and create a Fabric DLP policy in simulation mode.
- The delivery owner can observe a permitted consumer identity and a restricted consumer identity.
- PowerShell operators use PowerShell 7 or later for the module scripts.
Use group aliases in the artifacts. Keep tenant IDs, object IDs, live query output, prompts, responses, access tokens, and customer data in the approved customer system.
Implementation files#
| Type | File | Consumer |
|---|---|---|
| Record | artifacts/fabric/tenant-settings-baseline.json | The Fabric administrator and tenant-settings drift check scripts |
| Deployment | artifacts/fabric/onelake-ai-consumer-role.json | The Fabric administrator and OneLake access verification scripts |
| Record | artifacts/purview/fabric-label-dlp-decision.json | The Purview operator and data product owner |
| Record | artifacts/verification/access-check-plan.json | The delivery owner and AI application owner |
Resolve every __REQUIRED_*__ value before a service change. The preflight scripts reject each unresolved value and stop before any Fabric or Purview call.