Microsoft Fabric Integration: management, security and governance

Microsoft Fabric is an all-in-one data analytics solution. It covers everything from data movement to data science, real-time analytics and business intelligence. One of its strengths? Integration, along with a data lake and data engineering, all in one place.

No need to bundle different services from multiple providers. On the contrary, integration in Microsoft Fabric, which is offered as a software-as-a-service (SaaS) platform, is end-to-end.

This takes data analytics simplicity to a new level and eases data management, security and governance.

How does Microsoft Fabric protect your data?

The protection of information in Microsoft Fabric is based on the robust security already included in the Power BI service, complemented by the integration of Microsoft Purview.

Focusing on the confidentiality labeling proposed by Purview opens the door to the protection of sensitive content against data loss and unauthorized access. This application is carried out from both Power BI Desktop and Microsoft Fabric in the cloud. Thus, it ensures protection from the start of development to its consumption in Excel or some other type of dynamic connection.

Among the information protection functionalities that ensure comprehensive coverage of confidential data, we highlight:

• Manual tagging: allows users to configure tags at different points in the data lifecycle.
• Default tagging: each time an item is created or edited, it automatically receives a default confidentiality tag, unless a different one is applied by other means.
• Mandatory tagging: users cannot save items without a confidentiality tag applied, nor can they remove a tag once it has been assigned.

Microsoft also introduces an interesting functionality of tag down inheritance. This ensures that confidential data remains protected along its path within Microsoft Fabric, from its origin to the point of consumption. Furthermore, it involves automatic propagation to all dependent elements.

Additionally, a protection metrics report is made available in the Power BI management portal. It provides a complete view of sensitive data at the tenant and its application.

Its extensive application and configuration encompasses semantic models, reports, dashboards and data flows, as well as exports in xls, PPT and PDF formats. In this way, Microsoft Fabric demonstrates its commitment to providing robust data security and governance for its users.

Data security for your business

Microsoft maintains an ongoing commitment to the security of your users’ information, prioritizing accessibility and ensuring comprehensive protection for both data at rest and data in transit. In particular, Microsoft Fabric stands out for its contribution based on the use of open data formats that cover all workloads and levels. 

In this context, Parquet files are treated as a native data format that ensures that each user must load data once, allowing all workloads to work with the same data source without the need for separate inputs.

OneLake’s flexibility is manifested in the fact that it supports both structured and unstructured data, regardless of its format. This demonstrates total versatility in its management capabilities. In this sense, Microsoft Fabric establishes a universal security model, centralizing all operations from OneLake. An approach that significantly simplifies the complexity inherent in the various data engines and elevates the levels of table, column and row management to an enhanced version. Queries and tasks are processed from this unified model, improving system consistency and efficiency.

Key security features

In addition to OneLake’s built-in security in Microsoft Fabric, the following key features are highlighted:

• Conditional Access: provides additional protection for applications using Microsoft Enter ID authentication.
• Regional resiliency: leverages availability zones in Microsoft Azure to strengthen system resiliency at the geographic level.
• Microsoft Azure Lockbox: addresses issues related to support requests in the Microsoft Fabric service. Facilitates problem identification and event generation for further investigation.
• Service tags: enables inbound connections from Microsoft Fabric with Azure SQL Managed Instance (MI) enablement, facilitating integration and secure data flow.

Cyberattack detection, prevention and mitigation.

Threat protection can be broken down into three components to implement effective cyberattack mitigation: prevention, identification and remediation. 

Prevention refers to establishing policies and procedures aimed at eliminating the possibility of threats originating from external actors, both individuals and organizations.  Identification focuses on detecting and analyzing threats that penetrate the organization’s defenses.

A thorough knowledge of the activities in our work environment is crucial. A fundamental tool for that is the use of Azure service tags, which enable connections to and from Microsoft Fabric. They are configured as defined groups of automatically managed IP addresses. As such, they simplify management and minimize the complexity associated with updates or changes to network security rules.

Service tags are essential, as they define network access controls on network security groups, Azure Firewall and user-defined routes. Their strategic application helps to strengthen the security and resiliency of the infrastructure and facilitate a quick and efficient response to potential cyber threats.

The following service tags are supported:

Identity and Access Management (IAM)

The conditional access feature of Microsoft Entra ID offers several options for enterprise customers to protect applications on their tenants. These include:

– Multi-factor authentication

Authorization for only Intune-enrolled devices to access specific services. Restricting user locations and IP ranges.

– Configuring conditional access for Microsoft Fabric

To ensure that conditional access for Microsoft Fabric works as intended, it is recommended to configure a single common conditional access policy for the Power BI service, Azure Data Explorer, Azure SQL Database, and Azure Storage.

This will significantly reduce unexpected requests that may arise from applying different policies to downstream services. The consistent security posture will provide a better user experience in Microsoft Fabric and its related products.

A restrictive policy for example, may block access for all applications except for Microsoft Power BI which may render certain features, such as data streams, non-functional.

Conclusion

Confidentiality labeling functionalities offer users versatile tools to ensure protection. It is important to consider the specific constraints for each functionality and type of item. Integrating confidentiality labels into manual and automated processes provides an additional layer of control, which is critical when dealing with sensitive data.

In summary, integration into Microsoft Fabric not only simplifies data access and analysis. It is also the basis for increased levels of security, management and governance.

Interested in taking full advantage of the power of Microsoft Fabric integration? Our specialists are waiting for your contact: Schedule your meeting!