FabCon Europe 2024: the security and governance news worth your attention
From Stockholm: network security for every Fabric capacity, Purview controls, item tags and a clearer Copilot for Power BI reports. What changed and what to do next.
Today in Stockholm, at the first European Microsoft Fabric Community Conference, Microsoft published a long list of Fabric and Power BI announcements. The ones I would put in front of a Power BI team are not the flashiest. They are about security and governance, and one of them removes a capacity barrier that has kept smaller customers out of proper network protection.
Microsoft also says more than 14,000 customers have now invested in Fabric.
Network security is no longer an F64 feature
Until now, trusted workspace access and managed private endpoints were limited to F64 or higher capacities. According to the keynote blog, both are now available in all Fabric capacities, and managed private endpoints are also available in trial capacities.
This matters for the many organisations running on F2, F4 or F8. Trusted workspace access lets a workspace with a workspace identity reach a firewall-enabled Azure Data Lake Storage Gen2 account. Managed private endpoints let workspace admins connect Fabric workloads to data sources that are behind a firewall or blocked from public internet access. Both were often the reason a security review said no.
If you are on a small capacity and parked a project because of network requirements, this is the moment to take it off the shelf.
Purview moves closer to Fabric
The second group of announcements deepens the integration with Microsoft Purview:
- Sensitivity labels that control access (coming soon). Security admins will be able to use labels to control who can access Fabric items with a specific label, in the same way as in Microsoft 365.
- Data Loss Prevention for lakehouses (coming soon). DLP policies can detect sensitive data, such as social security numbers, uploaded to a lakehouse. Detection can trigger audit activity, alert admins and show policy tips to data owners.
- Microsoft Purview Data Governance became generally available on September 1, 2024, and you can connect your Fabric data to it to discover, secure and govern Fabric items from within Purview.
Note the pricing line in the announcement. These Purview capabilities are free during the near-term preview, and will later move to a pay-as-you-go Purview model, with pricing details still to come. Test them, but do not build a governance design that only works if they stay free.
Most Power BI tenants already use sensitivity labels to mark reports. The step from "labels describe the data" to "labels decide who gets in" is significant. Before it arrives, it is worth checking whether your labels are applied consistently, because an access rule based on a messy label taxonomy will give you messy access.
Tags and domains for finding things
Two governance features target a problem every mature tenant has: nobody can find the right semantic model.
Tags are now in public preview. Admins create a list of tags in the Admin portal, and users with write permission or higher apply them to items. An item can have up to 10 tags. You can then filter and search by tag in the workspace list and the OneLake data hub, and tags show up in item details and lineage view.
Domains and subdomains also get more admin controls in preview. Admins can set a default sensitivity label and domain-level export and sharing settings, and data owners can search and filter by domain.
My advice on tags: keep the list short and agree on it first. Ten tags per item is plenty. An open free-for-all with dozens of overlapping tags is worse than no tags at all.
A clearer Copilot for Power BI reports
For report creators, Copilot in the Power BI service gets a richer report creation experience in public preview. Two changes stand out:
- Copilot can now ask clarifying questions before it builds a page, so you can give it more context up front. It also recommends fields and measures to use.
- After it creates a page, you get an outline in the Copilot pane that shows which data fields it used.
The outline is the part I like. The biggest worry with generated reports has been that you cannot easily see what the AI picked. An outline makes review faster, and review is still your job. Microsoft says it plainly: responses are generated with AI, so check your work.
To try it, you need a workspace on F64 or Power BI Premium capacity, edit access, and you need to switch on the preview toggle in the Copilot pane while in edit mode.
The keynote also lists Copilot generating measure descriptions (generally available) and Copilot summaries in the Power BI mobile app (preview). The measure descriptions are a quick win for anyone who has inherited a model with hundreds of undocumented measures.
What to do next
A practical order of work for the coming weeks:
- If you are on a capacity below F64, revisit any project blocked by network security, and test trusted workspace access or managed private endpoints.
- Review your sensitivity label taxonomy and how consistently it is applied, before labels start to control access.
- Agree on a short tag list with your data owners, then enable tags in the Admin portal.
- Let one or two report creators on F64 or Premium try the new Copilot report creation, and compare the outline against what they would have built themselves.
- Use Copilot measure descriptions on one existing model and read every description before you keep it.
Takeaway
After two decades in data, I have learned that platforms are won or lost on governance, not on demos. The Stockholm announcements that matter most for Power BI teams are the quiet ones: network security on every capacity, Purview controls moving into Fabric, and better ways to label and find what you already have.
Which of these would unblock something in your tenant right now?
Sources
Enjoyed this? Get the next one by email
Occasional emails about Microsoft Fabric, SQL Server, Power BI and Synapse.