Implement and manage an analytics solution

1.1 Configure Microsoft Fabric workspace settings

Workspace settings are reached from the workspace → Workspace settings. The four groups the exam names explicitly are Spark, domain, OneLake and Apache Airflow.

Spark workspace settings

Domain workspace settings

Domains group workspaces by business area to enable federated governance — the central Fabric admin delegates authority to domain admins who know their own data.

• Created and managed by the Fabric admin in the admin portal → Domains; workspaces are then assigned to a domain (individually, in bulk, or by workspace admin).
• Subdomains allow a second level of grouping under a domain.
• Domain admins manage the domain's settings, image and default label; domain contributors can assign their own workspaces into it.
• Domains drive discovery — data in the OneLake catalog / data hub can be browsed and filtered by domain.
• Certain governance defaults (such as a default sensitivity label or certification policy) can be scoped per domain.

OneLake workspace settings

Apache Airflow workspace settings New in the July 2026 outline

Apache Airflow job is Fabric's managed Airflow offering — you author DAGs in Python and Fabric runs them, giving you Airflow's dependency graph, retries, sensors and operator ecosystem alongside native Fabric items.

Configure the runtime at Workspace settings → Data Factory → Apache Airflow Runtime Settings:

1.2 Implement lifecycle management

Version control with Git integration

• Supported providers: Azure DevOps Repos and GitHub (including GitHub Enterprise). Other Git hosts are not natively supported.
• A workspace connects to one repository, one branch and one folder at a time. Switching branches is a workspace-level action.
• Core actions: Commit (workspace → Git), Update (Git → workspace), and Undo uncommitted changes. The source-control pane shows per-item status.
• Items serialize to a folder per item containing its definition files (for example .platform plus notebook / pipeline / model definition files).
• Branch out to a new workspace creates an isolated workspace on a feature branch — the standard pattern for parallel development.

Database projects

A SQL database project is the schema-as-code approach for Fabric Warehouses: the object definitions live as .sql files in source control rather than existing only in the deployed database.

Deployment pipelines

1.3 Configure security and governance

Fabric security is layered. Work top-down: a user must clear every layer to see a row.

Workspace-level access controls

Item-level access controls

Sharing an individual item grants a specific permission set. For Lakehouses and Warehouses the three read permissions are the ones to distinguish:

Row-, column-, object- and folder/file-level controls

-- 1. Predicate function: returns a row when access is allowed
CREATE FUNCTION dbo.fn_SecurityPredicate(@Region AS nvarchar(50))
    RETURNS TABLE
    WITH SCHEMABINDING
AS
    RETURN SELECT 1 AS accessResult
    WHERE @Region = USER_NAME()
       OR USER_NAME() = 'analytics-admin@contoso.com';
GO

-- 2. Bind it to the table with a security policy
CREATE SECURITY POLICY dbo.SalesRegionFilter
    ADD FILTER PREDICATE dbo.fn_SecurityPredicate(Region) ON dbo.Sales
    WITH (STATE = ON);

-- Grant only the non-sensitive columns; Salary is never selectable
GRANT SELECT ON dbo.Employees(EmployeeName, Department, JobTitle)
    TO [analyst@contoso.com];

-- DENY always wins over GRANT, even via role membership
DENY SELECT ON dbo.Employees(Salary) TO [analyst@contoso.com];

OneLake security

OneLake data access roles secure data at the OneLake layer, so the rule is enforced regardless of which engine reads it — Spark, T-SQL endpoint, shortcut consumer or external tool.

• Defined on a Lakehouse under Manage OneLake data access: create a role, select the folders/tables it covers, assign users or groups.
• Permissions are additive across roles a user belongs to, and inherit down into subfolders.
• A DefaultReader-style role typically maps existing workspace access; you then add narrower roles for restricted folders.
• Newer OneLake security capabilities extend this to row- and column-level rules defined once at the OneLake layer and enforced across engines.

Dynamic data masking

DDM masks values at query time in the result set. The stored data is unchanged.

ALTER TABLE dbo.Customers
    ALTER COLUMN Email nvarchar(200) MASKED WITH (FUNCTION = 'email()');

ALTER TABLE dbo.Customers
    ALTER COLUMN CreditCard varchar(19) MASKED WITH (FUNCTION = 'partial(0,"XXXX-XXXX-XXXX-",4)');

-- Let a specific principal see real values
GRANT UNMASK TO [fraud-team@contoso.com];

Sensitivity labels and endorsement

Fabric audit logs

• Fabric activity flows into the Microsoft 365 unified audit log, searchable in Microsoft Purview → Audit.
• Fabric admins can also use the admin portal audit/activity view and the Get Activity Events admin API or Office 365 Management Activity API for programmatic export.
• Captured events include item create/read/update/delete, sharing and permission changes, exports and downloads, and data access.
• Retention follows the Microsoft 365 licence — 180 days under Audit (Standard) with longer retention available under Audit (Premium)/E5 add-ons. Verify current retention against Purview docs.

1.4 Orchestrate processes

Dataflow Gen2 vs pipeline vs notebook

Schedules and event-based triggers

Orchestration patterns, parameters and dynamic expressions

Control-flow activities worth knowing

Dynamic expressions

Pipeline expressions start with @. Know how to read these:

// Pipeline parameter and variable
@pipeline().parameters.InputFolder
@variables('RowCount')

// System variables
@pipeline().RunId
@pipeline().TriggerTime

// Output of a previous activity
@activity('LookupWatermark').output.firstRow.LastLoadedDate
@activity('CopyToBronze').output.rowsCopied

// String building and dates
@concat(pipeline().parameters.Prefix, '_',
        formatDateTime(utcnow(), 'yyyyMMdd'), '.parquet')
@formatDateTime(addDays(utcnow(), -1), 'yyyy-MM-dd')

// Condition for an If activity
@greater(int(activity('CopyToBronze').output.rowsCopied), 0)

// Current item inside a ForEach
@item().TableName

Notebook orchestration

# Run another notebook and capture its exit value (timeout in seconds)
result = notebookutils.notebook.run("transform_silver", 300,
                                    {"load_date": "2026-07-21"})

# Run many notebooks with a dependency graph, in parallel where possible
notebookutils.notebook.runMultiple(dag)

# Return a value to the caller (pipeline or parent notebook)
notebookutils.notebook.exit("rows_loaded=18432")

Scenario quick reference