Chapter 1 of 6
Module scope#
What we will do#
Objective. Give one AI consumer group controlled access to one gold Fabric lakehouse used for grounding.
This module records the Fabric Copilot and AI tenant settings baseline, configures one OneLake security role for the selected lakehouse, applies the selected sensitivity label, and records a Purview Fabric DLP policy in simulation mode. The observable result is simple: the permitted consumer can read the approved gold path, and the restricted consumer cannot.
Why it matters#
Problem. AI teams often point agents and retrieval pipelines at Fabric data before tenant settings, labels, DLP scope, and lakehouse roles agree.
Solution. This module puts the data boundary in one path: tenant-setting drift is checked, lakehouse access is narrowed, sensitive data is labelled, and Purview DLP starts in simulation before the data becomes a grounding source.
EU AI Act. For high-risk AI systems, this module supports Article 10 (data and data governance) when the lakehouse holds training or testing data, and Article 26(4) (deployer control of input data) when it supplies grounding data. This is an engineering mapping, not legal advice.
Boundaries#
This module sits outside the numbered session sequence.
It changes one Fabric lakehouse access path and one Purview policy decision for AI data. Microsoft Fabric remains authoritative for tenant settings and OneLake roles. Microsoft Purview remains authoritative for sensitivity labels, label policies, DLP simulation, alerts, and policy history. This repository keeps the decisions and read-only checks that those live services do not keep in one place.
Agent 365 rollout DLP stays with the Agent 365 secure rollout guide. Data quality, retention, domains, endorsements, and tenant-wide networking are out of scope here. Move those to the data platform backlog after this module if they are missing.
Module preparation
Who should join
- Fabric administrators and data platform engineers
- Microsoft Purview compliance and information protection operators
- Data product owners for AI grounding data
- AI application owners who consume governed Fabric data
What you need
- One approved nonproduction Microsoft Fabric workspace contains the gold lakehouse used for AI grounding, and the workspace is hosted on a Fabric or Premium capacity that supports the planned DLP scope.
- The Fabric administrator can read tenant settings and operate OneLake security roles for the selected lakehouse.
- The Microsoft Entra AI consumer group and restricted consumer group are created and approved for this module.
- The Purview operator can apply the selected sensitivity label and create a Fabric DLP policy in simulation mode through the approved Purview change path.
- The delivery owner can observe one permitted consumer identity and one restricted consumer identity during the access checks.