Marthe Moengen

Gal in a Cube

Arcthitecture best practices in Fabric that enables your data governance journey — 24. Jun 2025

Arcthitecture best practices in Fabric that enables your data governance journey

With its low-code approach, Microsoft Fabric enables anyone to take on tasks that once required a data engineering background. It accelerates development, supercharges workflows, and integrates seamlessly with AI, both enabling AI and using AI to make you even more productive. Definitely super cool. 😎

But with this new speed and power comes a new level of responsibility. As AI becomes deeply embedded in our tools and decisions, the old adage still holds true: garbage in, garbage out. That’s why the architecture of your Microsoft Fabric environment matters more than ever.

Why? Because with the ease and speed of things in Fabric today, it is SO SIMPLE to create things, so how fast can you create a mess for yourself? Anyone using Power BI for a couple of years and going with the self-serve approach? Then you know what I am talking about.

So, a strong foundation ensures compliance, security, and data integrity to ensure you never lose control, end up with duplicates and ultimately low-quality data, because when AI acts on bad data or a flawed setup, the consequences can scale just as fast as the benefits.

Let’s take a look at the what initial steps you should consider for your Fabric architecture and why!

Jump to:

  1. How should you structure your items (Lakehouses/Warehouses) in Microsoft Fabric?
    1. ✅ Pros of Item Separation in Microsoft Fabric
    2. ⚠️ Considerations of Item Separation in Microsoft Fabric
  2. How should you structure your workspaces in Microsoft Fabric?
    1. ✅ Pros of Workspace Separation in Microsoft Fabric
    2. ⚠️ Cons of Workspace Separation in Microsoft Fabric
  3. How should you structure your Domains in Microsoft Fabric?
    1. ✅ Pros of Domain Separation in Microsoft Fabric
    2. ⚠️ Cons of Domain Separation in Microsoft Fabric
  4. How should you structure your Capacities in Microsoft Fabric?
    1. ✅ ️ Pros of Capacity Separation in Microsoft Fabric
    2. ⚠️ Cons of Capacity Separation in Microsoft Fabric

How should you structure your items (Lakehouses/Warehouses) in Microsoft Fabric?

I like to think of Fabric in this order when making the first decisions on the HOW we are going to set things up. Items define your options on workspaces, and workspaces define your options on domains and capacities. So, the first thing you need to think about is item separation.

Let’s use the medallion architecture as an example throughout this blog post to have something many are familiar with.

Would you like to separate the bronze, silver and gold layer into separate items – or do you want to group them into one lakehouse or warehouse? Or a mix?

✅ Pros of Item Separation in Microsoft Fabric

Clear Layer BoundariesEnforces architectural clarity between Bronze, Silver, and Gold layers.
Minimizes accidental data leakage between stages.
Enhanced Security & GovernanceEnables more granular control over access (e.g., only data engineers consume Bronze; analysts consume Gold).
Improved DiscoverabilityEasier for consumers to find the right data at the right stage.
Promotes documentation and ownership via dedicated spaces. E.g. if you want to separate ownership on bronze/silver layer for source-aligned data products, while the gold layer provides consumer-aligned data products.
Improves discoverability (and lineage) in Purview as Items are best supported today.
Better Modularity & ScalabilityEach layer can evolve independently (e.g., switching ingestion logic in Bronze without touching Gold).
Encourages a microservice-style approach where each layer is self-contained.
Supports InteroperabilityEnables integration with various tools and personas by decoupling processing stages.

⚠️ Considerations of Item Separation in Microsoft Fabric

Increased ComplexityMore items to manage.
Requires well-defined conventions and documentation.
Operational OverheadMay lead to duplication of effort (e.g., repeated metadata or pipeline setup across layers).
Monitoring and orchestration across items become more complex.
Risk of Over-EngineeringNot all projects need full item separation; using it universally can slow down small teams.
Risks “compliance theater” without real added value if not paired with strong practices.
Dependency ManagementInter-layer dependencies may become fragile if naming, versioning, or schema tracking isn’t standardized.

Use it when: You need strong governance, multiple teams, or enterprise-scale structure.
Skip it when: You’re working fast, solo, or on smaller, agile projects.

How should you structure your workspaces in Microsoft Fabric?

When you have made your choices on item separation, you are ready to consider your workspace separation, as the item separation also (naturally) enables workspace separation.

Let’s use the medallion architecture as an example again.

Do you want to have all your layers in one workspace, or separate them across workspaces, or a mix?

Pros of Workspace Separation in Microsoft Fabric

1. Self-Contained EnvironmentsEncapsulation of logic and data for each team.
Reduced risk of accidental interference across unrelated areas.
Easier testing and deployment of updates in isolation.
2. Improved DiscoverabilityEasier to navigate than a massive, centralized workspace.
Reduces cognitive load for analysts and consumers.
Improves discoverability in Purview.
3. Stronger Governance & Access ControlDefine permissions on a need-to-know basis using the workspace for different development teams. Then have a more granular option for access control on the item level as well if needed.
Ensure compliance by segmenting sensitive data (e.g. some bronze data might be sensitive compared to gold layer)
4. Domain-Oriented OwnershipTeams can own, maintain, and evolve their domain-specific workspaces independently
Reduces bottlenecks by avoiding centralized gatekeeping
Encourages accountability and autonomy
5. Better ObservabilityErrors, performance, and usage can be scoped per workspace
Easier to trace lineage and operational issues within contained environments

⚠️ Cons of Workspace Separation in Microsoft Fabric

1. Cross-Workspace Dependencies Can Be PainfulSharing datasets between workspaces can involve more manual effort or pipeline complexity.
Lack of strong cross-workspace lineage tracking increases risk of versioning issues.
2. Coordination OverheadSchema changes or upstream updates must be communicated across teams. (Should you consider data product contracts?)
Governance, naming conventions, and SLAs must be actively enforced.
3. Risk of FragmentationWorkspaces can become inconsistent in structure, naming, and metadata practices
Onboarding new users becomes harder if standards vary widely
4. Initial Barrier to EntrySetting up multiple workspaces might feel like overkill
Single-workspace setups may be better for rapid prototyping or agile development

Use when: You have multiple domains or teams, need tight access control, or want to scale governance.
Avoid when: You’re prototyping, working with a small team, or need fast iteration across datasets.

*a consideration not discussed in this article for workspace separation is CI/CD

How should you structure your Domains in Microsoft Fabric?

When you have your workspace plan ready, you can take a look at domains.

Do you want to separate you domains on business use case alone, on technical teams, on data source, or a mix?

If you use a data mesh approach, you might want each domain to own the entire data flow from bronze to silver.

Suppose you want to enable your business domains, but still want to take advantage of some centralization in making the different data layers available. In that case, you might want to look at a domain separation as shown above.

Pros of Domain Separation in Microsoft Fabric

1. Reflects Business StructureOrganizing data by domain mirrors your org chart.
This reduces confusion and aligns data strategy with business operations.
2. Clear Ownership and AccountabilityEach domain owns its data products. This fosters a culture of accountability and ensures data is maintained by those who understand it best.
3. Decentralized Policy EnforcementDomains can enforce their own data quality, security, and compliance rules within their boundary.
This enables scalability without relying solely on a central team.
4. Improved Governance and ObservabilitySmaller, domain-focused scopes are easier to govern.
Monitoring usage, managing permissions, and auditing access becomes simpler and more meaningful.
5. Autonomy and SpeedTeams can build and release data products at their own pace.
They don’t need to wait on a centralized team to deploy pipelines or models.

⚠️ Cons of Domain Separation in Microsoft Fabric

1. Risk of SilosIf domains don’t collaborate or share standards, data silos can (re-)emerge inside of Fabric.
Interoperability must be intentionally designed.
2. Duplication of EffortMultiple teams might build similar models or transformations independently. Without coordination, this wastes time and creates inconsistency.
3. Tooling and Training OverheadEach domain team needs enough skill and support to manage its own pipelines, models, and compliance needs. This requires investment.

Use it when: Your org has distinct teams/domains and you want scalable ownership.
Avoid it when: You’re early in your journey or lack governance maturity.

How should you structure your Capacities in Microsoft Fabric?

Then finally, let’s take a look at your choices when it comes to Fabric capacities.

Do you want to use capacity separation to mirror your business domains, technical teams, environments or a mix?

If your organization requires separate cost management across business domains, you probably want to mirror the capacities and the domains.

Another separation you might consider instead of or in combination with the domain separation is to separate the capacities for the different environments. This can ensure performance. If you are taking advantage of federated development teams, you run a higher risk of someone creating a crazy dataflow that kills the entire capacity. Separating development and production can therefore be wise. This is also a way to maximise cost savings, as the development capacity does not need to be on 24/7 and can be scaled up and down as needed.

If your organisation exists across regions, you might also want to consider separating your environments based on different capacity regions. Be aware that it is currently not possible to move Fabric items across regions without a support ticket to Microsoft. Take some time to consider your needs and use cases before splitting.

Pros of Capacity Separation in Microsoft Fabric

1. Performance IsolationHigh-demand domains won’t be bottlenecked by low-priority processes elsewhere.
Development efforts won’t throttle production environments.
2. Cost Transparency & AccountabilityClearer tracking of compute and storage consumption per business domain/unit or team.
Easier chargeback/showback models for budgeting or internal billing
Data-driven capacity planning (who needs more/less and why)
3. Optimized ScalingCritical business domains can be scaled up.
Lightweight domains can be throttled or moved to shared capacity.

⚠️ Cons of Capacity Separation in Microsoft Fabric

1. Potential Resource WasteSmall or inactive domains may not fully utilize their assigned capacity. Wasted potential if workloads don’t justify a dedicated capacity.
Teams may leave unused resources running (e.g., long-lived Spark jobs) that are not discovered by the separate domains.
3. More Complex GovernanceDomain-level cost and performance management requires clear policies for scaling, shutting down idle jobs, prioritisation and governance around assigning capacity (shared vs dedicated).
Increased administrative overhead to right-size environments.

Use it when: you need performance isolation between teams or layers, want cost tracking per domain or department, domains have high or variable workloads, or you have governance in place for managing capacity.

Avoid it when: workloads are small or early-stage, teams lack cost or performance monitoring maturity, shared capacity meets your needs, or you want to minimize setup and management overhead.


Hope you found this article useful!

Stay updated on new blog posts and videos by subscribing to @GuyInACube on YouTube, follow me on LinkedIn or subscribe to the newsletter for this blog below to get the newest updates!

Start Your Data Governance Journey with Microsoft Purview: The complete guide [videos & descriptions] — 11. Jun 2025

Start Your Data Governance Journey with Microsoft Purview: The complete guide [videos & descriptions]

Feeling unsure about how to begin with Microsoft Purview? You’re in the right place! 💙 🩵

This blog post will be regularly updated as I record new videos and as new features are released. Here, you’ll find a step-by-step guide along with a feature overview. I will include videos and text for each feature. They will be in a logical sequence. This will hopefully make it easier for you to discover exactly what you need! 🤩

I previously created a mini-series on my YouTube Channel, @DataAscend, but I have since joined Adam and Patrick on @GuyInACube! So, this article will contain a mix of videos from both channels.

Stay updated on new videos by subscribing to @GuyInACube on YouTube, follow me on LinkedIn or subscribe to the newsletter for this blog below to get the newest updates!

Jump to:

  1. Purview Course: Get started with Purview Step-by-Step
  2. What is Microsoft Purview? An introduction!
  3. Create your first Purview instance!
  4. Upgrade to New Microsoft Purview
  5. How to Connect and Scan Your Fabric Data in Purview?
  6. How do you structure your Data Map?
  7. What is the difference between the Data Map and the Unified Catalog?
  8. How to Create a Business Domain/Governance Domain in Microsoft Purview
  9. What is the concept of a Data Product, and why should you care?
  10. How to Create a Data Product in Microsoft Purview?
  11. Set up Data Quality on Your Fabric Data Products in Purview

Purview Course: Get started with Purview Step-by-Step

Check out the new Purview Course on Guy in a Cube!

What is Microsoft Purview? An introduction!

Microsoft Purview is a data governance and compliance tool that helps organizations discover, classify, manage, and protect data across cloud, on-premises, and SaaS environments.

It is divided into three main areas: Governance 🏛️, Compliance ✅, and Security 🔒.

From the data perspective, we have previously been most into the governance solutions: Data Map and Unified Catalog – but now Purview Security and Compliance also supports data (and not only the more traditional information management). So, you will probably want to take advantage of all solutions to truly ensure quality, trust and compliance for your data!

Create your first Purview instance!

🥇 The very first step if you do not already have a Purview instance in your tenant. Let’s set it up together!

Upgrade to New Microsoft Purview

Already have an existing Purview account? The “old” one? This video shows how to upgrade to the latest Microsoft Purview solution and access its new features.

How to Connect and Scan Your Fabric Data in Purview?

Learn how to register your Fabric data in Microsoft Purview by creating collections, connections, and scans.

For more details on what to think about when choosing the structure of your Data Map, check out the video below

How do you structure your Data Map?

Creating a well-organised Data Map in Microsoft Purview isn’t just about setting it up – it’s about making the right decisions on Domains and Collections structure. But how do you get it right?

Here’s what you need to consider when planning your structure:

✅ Access Levels & Control – Ensure the right people have the right permissions.
🔒 Separation – Maintain clear boundaries for better management.
🛠️ Development, Test & Production Environments – Keep your workflows organised and efficient.
💡 And more!

What is the difference between the Data Map and the Unified Catalog?

Both are essential for data governance (!), organising your data, and ensuring compliance within your organisation. But how do they differ, and how should you approach structuring them effectively?

I like to divide the data catalog part of Purview into two:

  1. Physical data estate with your Data Map and Data Assets
  2. Your logical data estate with Governance Domains and Data Products

But how should you structure them? Take a look at the video below:

How to Create a Business Domain/Governance Domain in Microsoft Purview

Overview: This video explains how to set up a governance domain for better data organization and governance. You can then group your data products into business domains later.

Topics Covered:

  • Step-by-step guide to creating a business domain.

In this video I call it a “Business Domain”, but Purview has later renamed it to Governance Domain, which I think is more fitting. You can then decide yourself if you want to separate your domains into Business Domains, Governance Domains, Data Domains, Technical Domains, etc. This will depend on your organizational setup.

What is the concept of a Data Product, and why should you care?

Before we dive into the Data Product concept in Purview – what is a Data Product?

How to Create a Data Product in Microsoft Purview?

Overview: Discover how to create data products within Microsoft Purview to manage and catalog data more effectively.

Topics Covered:

  • 🧩 Defining a Data Product and linking it to a 📁 Business Domain.
  • 🔗 Connecting your physical Data Assets to your 🛍️ Data Product.
  • 📃 Setting up terms of use for your Data Product and Data Assets.
  • 🔐 Setting up Request Access Policies for your Data Product.

The Data Assets that we link to the Data Product are the physical data assets that we scanned in the previous step.

Set up Data Quality on Your Fabric Data Products in Purview

This video covers how to monitor data quality on your Fabric data products within Microsoft Purview.

Obs: This video shows you how to scan using the Managed Identity as the authenticator for the scan done before this video. This will not work if you want to do DQ runs on your Fabric sub-level items, like the tables in a lakehouse. To do this, you must use a service principal as authentication when you run the ordinary scan. The SP needs contributor access to the workspace for this to work. See the Microsoft documentation on how to set up a SP authentication.

Topics Covered:

  • 🔗 Setting up data quality connection for your data governance domain.
  • 🛠️ Setting up data quality rules and profiling for your data assets.
  • ▶️ Running the data quality and profiling rules, and 📊 monitoring the outcome.
  • 📌 Looking into actions of your resulting Data Quality and Profiling runs, ✅ assigning tasks and actions to Data Stewards or other roles in your organization to improve the 🧹 Data Quality

A new and updated video is on the way. Subscribe to @GuyInACube on YouTube, follow me on LinkedIn or subscribe the newsletter for this blog below to get the newest updates!

Hope you found this article helpful!

How to set up FUAM – Fabric Unified Admin Monitoring — 22. Apr 2025

How to set up FUAM – Fabric Unified Admin Monitoring

FabCon Vegas showcased fantastic new features! One noteworthy solution, although not an official Microsoft product, is the Fabric Unified Admin Monitoring (FUAM) solution accelerator. This accelerator has been available for a couple of months, but has flown under the radar I feel. So let’s give it some attention!

  1. A Special Thanks
  2. What is FUAM?
  3. Why use FUAM?
  4. Watch the Video
  5. Where to start?
  6. Now what?

A Special Thanks

I want to extend a big shoutout to Gellert Gintli and Kevin Thomas for their work in bringing this tool to the Fabric community as part of the Fabric toolbox. This means that anyone can take advantage of it and even provide input and feedback on how to evolve it. Love. It. 😎

What is FUAM?

Super-duper-short: FUAM is a solution to enable a holistic monitoring on top of Microsoft Fabric built completely with Fabric capabilities, extracting data on (and giving you insights on):

  • Tenant Settings
  • Delegated Tenant Settings
  • Activities
  • Workspaces
  • Capacities
  • Capacity Metrics
  • Tenant metadata (Scanner API)
  • Capacity Refreshables
  • Git Connections

You can get an overview or a deep dive into specific artefacts. It comes with prebuilt reports, but you can also customise these and combine them with other data to better serve your needs – obviously, since you get access to all the Fabric items used to build the solution.

Why use FUAM?

Built-in solutions like Metrics Apps in Fabric definitely give you some great insights into how your capacities are performing.

  • Capacity optimisation – identify outliers and improve them
  • Admin settings management – what settings are enabled in your Fabric Admin Portal, and when did they change?
  • Identify unused workspaces and items – clean up unused workspaces and items!
  • Report activities – what reports are most used and on what capacities?
  • Best practice analyser – are your developers following the best practices?
  • Monitor users and their activities
  • And more!

Watch the Video

As always, I couldn’t resist creating a video to showcase this feature. It’s just that cool! Below the video, I added some more input/details that can be of use when you implement FUAM for your tenant.

Head over to YouTube and follow @GuyInACube for more insights!

Where to start?

It is SO EASY, as a great how-to has been created where you can read up on the underlying architecture and the step-by-step implementation process:

In the video below, I started out prepping the prerequisites with the following:

  • Created a new workspace (FUAM)
  • Created a new service principal
  • Create a Service Principal by setting up an Enterprise App Registration
  • Created a new client secret for that service principal
  • Saved the secret in my KeyVault. You don’t have to save it using a KeyVault, but you must save it somewhere safe. – Learn more about KeyVault and Fabric here from Patrick’s video:
  • Added the service principal to a security group
  • Added that security group to these two tenant settings inside the Fabric Admin Portal:
    • Service Principals can use Fabric APIs
    • Service Principals can access read-only admin APIs
  • Create a Microsoft Fabric Capacity App. Apps –> Get apps –> Microsoft Fabric Capacity Metrics
  • Rename Workspace connected to the Metrics App to “FUAM Capacity Metrics”
  • Connect workspace to a Fabric or Premium capacity

Now what?

DIVE into all the awesome insights and consider expanding, customising, and optimising the FUAM framework to better fit your needs! Since everything is inside Fabric, you have control. 😎