Fabric Security, Governance, Lifecycle & FinOps Capacity Management

Instructor: Alaa Hady · Language: English or Arabic · Suggested duration: 2 days · Level: Advanced (Level 300)

Objectives

• Design a multi-domain, multi-workspace enterprise Fabric architecture with defence-in-depth security.
• Master Fabric FinOps: understand Capacity Units (CUs), bursting, smoothing, throttling, and pausing/scaling F-SKUs to prevent runaway cloud bills or tenant outages.
• Use the Microsoft Fabric Capacity Metrics App and Workspace Monitoring to identify noisy neighbors and optimize costly workloads.
• Implement enterprise network security (Private Links, VNet Gateways, Managed Private Endpoints) and automated CI/CD.

Outline and contents

1. Enterprise Fabric Topology: Tenant → Capacities (F-SKUs) → Domains & Subdomains → Workspaces (Bronze/Silver/Gold separation)
2. Defence-in-Depth Security Matrix: Workspace Roles vs. Item Permissions vs. OneLake Data Access Roles vs. SQL Engine Permissions vs. Semantic Model RLS/OLS
3. Network & Identity Security: Service Principals, Managed Identities, Workspace Identity, Inbound Private Links, and Managed Private Endpoints
4. Fabric FinOps & Capacity Economics Deep Dive:
   • How Fabric F-SKU billing works: Capacity Units (CUs), Interactive vs. Background operations
   • Understanding Bursting and Smoothing (5-minute vs. 24-hour smoothing windows)
   • How Throttling cascades (Interactive delay → Interactive rejection → Background rejection) and how to recover from capacity overloads
   • Right-sizing F-SKUs, separating Engineering vs. Production BI capacities, and automating F-SKU pause/resume schedules
5. Mastering the Fabric Capacity Metrics App: diagnosing runaway Spark jobs, unoptimized Dataflows Gen2, and expensive DAX queries
6. Surge Protection, Workspace Outbound Access Protection, and Spark compute governance
7. Auditing, Purview Hub integration, REST Admin APIs, and disaster recovery (BCDR) configuration
8. FinOps Simulation Lab: Analyzing a throttled capacity in the Metrics App, isolating the culprit workload, and designing a multi-capacity allocation plan

Target audience

Fabric administrators, platform architects, FinOps engineers, IT directors, CoE leads, and security officers.

Expected outcomes

Participants can secure a complex enterprise Fabric tenant and manage F-SKU capacity consumption proactively—preventing surprise throttling blackouts and optimizing cloud spend.