Dr. Estera Kot

From Events to Answers · Part 6 of 7

Fabric for 50 people in one evening

What it took to give 50 people working Fabric access for one evening: accounts, MFA, capacity, the sign-in screens, and teardown.

By Dr. Estera Kot, Microsoft MVP, CTO at Clouds on Mars, and former Microsoft Principal Product Manager for the Apache Spark runtime in Fabric. Published . Product facts checked against Microsoft Learn on November 3, 2026.

A hands-on Microsoft Fabric session fails at sign-in, not at the demo. The demo runs on one tested laptop. The hands-on part is 50 people who sign in for the first time in the same five minutes. Identity, licenses, roles, and capacity decide whether those minutes work. They need a script, a capacity budget, and a teardown plan, built days before the room fills.

A Fabric workshop environment is the set of accounts, licenses, roles, and capacities for one hands-on session. It lets every participant sign in from their own device and build in Fabric. This part records the environment built for a community session at Microsoft Qatar on October 14, 2026. The session told the story of an invented oud fragrance house, and all demo data was synthetic. Part 1 covers the session and the demo.

The environment was built on the afternoon of the session. The last blocker cleared at 5:50 PM, ten minutes before the start. Every decision held, but no time was left for one more surprise. The checklist at the end moves each step to the days before.

In short

  1. Sign-in is where a hands-on Fabric session breaks. Test every participant screen in a real browser, because an API sign-in skips them all.
  2. Member accounts with Fabric Free, roles on a group and on each user, and two separate capacities kept the room working.
  3. Fifty people asking six data agent questions each is an estimated 33 CU hours, about 4 percent of an F32 day. Quota was the risk, not capacity size.
  4. Relaxing MFA prompts for one evening was a time-boxed trade-off with compensating controls. Start the next workshop with the narrower tools that Microsoft Learn documents.
  5. Tear down in order: disable accounts, export, delete workspaces and capacities, restore security settings, and remove elevated roles last.
Access map for 50 workshop accounts Fifty member accounts, falcon01 to falcon50, each with a Fabric Free license, no admin role, and no mailbox. They reach two workspaces by two paths: one security group, and a direct role for each account. The demo workspace sits on an F32 capacity in Sweden Central, and its role changed from Viewer to Contributor. The playground workspace sits on an F16 capacity in Poland Central with the Contributor role. Capacity bars are drawn to scale. Four numbered notes give the reason for each split. 50 member accounts 1 falcon01 to falcon50 Fabric Free license on each No admin role, no mailbox One password, on the screen only One security group 50 members 50 direct roles one per account 2 Demo workspace Look: lakehouse, eventhouse, dashboard, ontology, data agent Role: Viewer, then Contributor 3 F32, demo Sweden Central, 768 CU hours a day Playground workspace Build: everyone creates items, each name starts with falconNN_ Role: Contributor F16, playground 4 Poland Central, 384 CU hours a day 1 Members, not guests. A guest must redeem an invitation and pass MFA in a home tenant first. 2 Group plus direct roles. Fabric saw the brand-new group late, so each account also got its own role. 3 Contributor on the demo. A Viewer cannot open lakehouse Files, and one handout step opens a PDF there. 4 Two capacities. Spark bursts in the playground cannot slow the demo. Bar widths are to scale. Access map for 50 workshop accounts Fifty member accounts reach two workspaces through one security group and through a direct role for each account. The demo workspace sits on an F32 capacity, the playground on an F16 capacity, drawn to scale. Four notes give the reason for each split. 50 member accounts 1 falcon01 to falcon50 Fabric Free license on each account No admin role, no mailbox One password, on the screen only 2 One security group 50 members 50 direct roles one per account Demo workspace Look: lakehouse, eventhouse, dashboard, ontology, data agent Viewer, then Contributor 3 Playground workspace Everyone builds. Names start with falconNN_ Contributor F32, demo F16 4 Sweden Central 768 CU hours a day Poland Central 384 CU hours a day 1 Members, not guests: no invitation to redeem, no MFA in a home tenant. 2 Group plus direct roles: Fabric saw the brand-new group late. 3 Contributor on the demo: a Viewer cannot open lakehouse Files. 4 Two capacities: playground Spark cannot slow the demo. Bars to scale.
Figure 1. The access map. Fifty member accounts reach both workspaces twice: through one security group and through a direct role each. The demo and the playground sit on separate capacities, and the capacity bars are drawn to scale.

Fabric workshop accounts: eight decisions and why

Give each participant a member account in a dedicated tenant and assign Fabric Free yourself. Put workspace roles on a security group and on each user. Split the demo and the playground onto separate capacities. Keep the password off paper. Each choice removes one way to get stuck in the first five minutes.

IDDecisionWhy
D1Member accounts, not guestsA guest must redeem an invitation and pass MFA in a home tenant. Fifty of those at the door is a queue.
D2One shared passwordThe alternative is 50 slips of paper. The accounts had no mailbox and were disabled the same night.
D3Fabric Free assigned in advanceNobody meets a license prompt. The admin needed it too: without it, the Fabric API answered UserNotLicensed.
D4Two capacities: F32 for the demo, F16 for the playgroundA workspace sits on one capacity, so playground Spark bursts cannot slow the demo. An F64 did not fit the quota, and the data agent needs only a paid F2.
D5Viewer on the demo, Contributor on the playgroundA Viewer runs nine of the ten handout steps and cannot delete the agent during questions.
D6Roles on the group and on each userA brand-new group showed nothing to the first test account. Fabric picked it up with a lag. One hundred direct roles removed the wait.
D7MFA prompts relaxed for the eveningThe tenant had no Conditional Access, and security defaults cannot exclude a group.
D8Password on the screen, not in the handoutThe handout outlives the evening. The screen does not.

Microsoft Learn confirms the license logic. A Fabric Free license creates non-Power BI items on an F capacity. Viewing Power BI items with it needs F64 or larger. The Fabric data agent GA needs a paid F2 or larger, and trial capacities do not support it. Learn says Fabric assigns the Free license at the first portal sign-in. Assigning it early also covers accounts that first reach Fabric through the API.

Learn says a role change takes effect at the next sign-in, but it does not document a lag for new groups. Treat D6 as an observation. Learn caps a workspace at 1,000 users or groups in roles, so direct roles fit a workshop, not a company.

The demo role changed five minutes before the start

D5 did not last the afternoon. One handout step opens a PDF in the lakehouse Files folder. Learn states that a Viewer reads lakehouse data only through the SQL analytics endpoint. At 5:55 PM the group and all 50 accounts became Contributors on the demo workspace, and the step worked.

The trade-off was control. Contributors can create, change, and delete items, and two participant items sat in the demo workspace at teardown. The printed handout still called it read-only. The narrower fix is a lakehouse share with Read all with Apache Spark, done the day before. Learn says item permission changes can take up to two hours to arrive.

MFA for workshop accounts: a time-boxed trade-off

For one evening, in a dedicated workshop tenant separate from the company tenant, MFA prompts for new accounts were relaxed. It was a deliberate, time-boxed trade-off, not a default. The compensating controls were no admin roles, no mailbox, Fabric Free only, the password on the screen only, and accounts disabled the same night. Restoring every changed setting was a teardown step.

Three settings stood in the way. Security defaults require every user to register for MFA, with no grace period since July 29, 2024. Self-service password reset can add its own registration step. The Identity Protection MFA registration policy, set for all users, was the real gate. All three were relaxed between 4:59 and 5:50 PM, and only the last change let the browser test through. Learn describes security defaults as on or off, with no exclusions, so the change had to be tenant-wide.

What Microsoft Learn documents instead

The better default for the next workshop is narrow. Keep tenant protections on, scope any exception to the workshop group, end it with the accounts, and prove it in a browser the day before. The Conditional Access trap in Fabric does not live in your VNet shows the same risk from the other side: one tenant-wide policy reaches more than you planned.

Fabric capacity for a workshop: the CU budget

An F32 provides 32 capacity units, which is 768 CU hours a day. An F16 provides 384. Using the example on Microsoft Learn, one data agent question costs 0.11 CU hours. Fifty people asking six questions each comes to about 33 CU hours, about 4 percent of an F32 day. That is an estimate. Token counts on the night were not measured.

IDLoadNumberSource
L1Daily budgetF32: 32 CU for 24 hours, 768 CU hours. F16: 384 CU hours.Licenses
L2One data agent question, Learn's example of 2,000 input and 500 output tokens400 CU seconds, 0.11 CU hours, a background jobData agent consumption
L350 people, 6 questions eachAbout 33 CU hours, about 4 percent of an F32 day. Estimate.Arithmetic on L1 and L2
L4Dashboard refreshes and KQL queries over 40 event rowsInteractive, smoothed over 5 to 64 minutes. Not measured.Throttling policy
L5When throttling startsWhen the next 10 minutes are fully booked. Then 20-second delays, then rejections past 60 minutes and past 24 hours.Throttling policy
L6Playground Spark on the F1632 Spark VCores, 96 with burst. About 12 Medium-node sessions at once. Estimate.Spark concurrency

Smoothing keeps the number small. Fabric spreads a background job over 24 hours, so 33 CU hours add about 1.4 CU to every timepoint, about 4 percent of an F32. Throttling needs the next 10 minutes fully booked, and the agent load alone cannot do that. Learn warns that instructions, example queries, and chat history add tokens, and that generated queries are billed to their engine. Even ten times the estimate stays under half of an F32 day.

Interactive work makes the spikes, smoothed over 5 to 64 minutes. Real-Time Intelligence skips the 20-second delay stage, so a live dashboard does not slow down first. When 60 minutes of capacity are booked, its new requests are rejected.

The playground risk is 50 people pressing Load to Tables at once. An F16 gives 32 Spark VCores, 96 with burst, and starter pools use Medium nodes of 8 VCores. At one node per session, about 12 sessions fit at once, an estimate. Learn says interactive notebook jobs are not queued. They fail with HTTP 430 when cores run out. On its own capacity, that failure stays in the playground.

An F32 day of 768 CU hours against the estimated data agent load Top: one day of an F32 capacity drawn as 24 hour blocks of 32 CU hours, 768 CU hours in all. The estimated load of 300 data agent questions, about 33 CU hours, fills just over one block, about 4 percent. Below it, one day of the F16 playground capacity, 384 CU hours, with its Spark load not estimated. Bottom: the same 33 CU hours as Fabric books a background job, spread over the next 24 hours: about 1.4 CU in every hour, about 4 percent of the 32 CU an F32 provides. All loads are estimates. One F32 day: 768 CU hours each block is 1 hour of an F32, 32 CU hours 300 data agent questions: about 33 CU hours, about 4 percent of the day (estimate) One F16 day: 384 CU hours. Playground Spark: not estimated. The same load, as Fabric books it A background job is spread over the next 24 hours. Each column is one hour of an F32. 32 CU: all of an F32, in every 30-second timepoint 0 h 6 h 12 h 18 h 24 h About 1.4 CU in every hour, about 4 percent of an F32 (estimate). Throttling starts only when the next 10 minutes of capacity are fully booked. An F32 day of 768 CU hours against the estimated data agent load One F32 day as 24 hour blocks, 768 CU hours. The estimated 33 CU hours of 300 data agent questions fill just over one block, about 4 percent. One F16 day is 384 CU hours. Spread over 24 hours as a background job, the load is about 1.4 CU in every hour. All loads are estimates. One F32 day: 768 CU hours each block is 1 hour, 32 CU hours 300 agent questions: about 33 CU hours, about 4 percent of the day (estimate) One F16 day: 384 CU hours. Playground Spark: not estimated. The same load, as Fabric books it Spread over the next 24 hours as a background job. One column, one hour. 32 CU: all of an F32 0 h 12 h 24 h About 1.4 CU in every hour, about 4 percent (estimate). Throttling starts only when the next 10 minutes are fully booked.
Figure 2. The capacity budget, drawn to scale. Top: one F32 day against the estimated load of 300 data agent questions, and one F16 day. Bottom: the same load spread over 24 hours, the way Fabric books a background job. Rates from Microsoft Learn. All loads are estimates.

Quota, not size, was the risk

Fabric quota is set per subscription and per region. The region chosen for the demo had a quota of 44 CU. An F64 failed on quota at once. A paused F8 from another team and three F2 capacities left from an earlier workshop held 14 CU. The F32 fit only after the three leftovers were deleted. A self-service request to raise the quota to 80 CU was accepted and later showed Failed.

Two regions add one constraint. Learn states that a data agent cannot query a source on a capacity in a different region. Each agent here sat next to its own sources, so the split held. Keep it that way when you copy the design.

What participants see when they sign in to Fabric

In a private window at app.fabric.microsoft.com, a participant sees four screens: a Fabric page that asks for an email, the Microsoft password page, “Stay signed in?”, and a “Welcome to the Fabric view” tour. Put all four on the sign-in slide and in the handout. Every screen nobody mentioned becomes a question in the room. A fifth screen, “Let's keep your account secure,” means a tenant policy wants MFA registration.

  1. A green Fabric page asks for a work or school email. It is Fabric's own pre-check. Type the workshop address and press Submit.
  2. The Microsoft password page opens with the address filled in.
  3. “Stay signed in?” Choose No.
  4. The tour pops up. Press Cancel, then open Workspaces in the left menu.
IDScreenCauseWhat to do
V1“Let's keep your account secure,” with Next onlyA tenant policy requires MFA registration. Here it was the Identity Protection MFA registration policy.Fix it before the session. Nobody can fix it from the room.
V2“More information required”MFA or password reset registrationSame as V1
V3“Start trial” or “Upgrade”A license promptClose it. The capacity is already paid.
V4No New item buttonThe role in this workspace cannot create itemsBuild in the playground
V5Fabric home with no workspacesThe list is still loading after a first sign-inOpen Workspaces in the left menu and wait a minute

Learn names the sources of a registration screen: the Identity Protection registration policy, per-user MFA, Conditional Access, password reset registration, and security defaults. In Doha, two were switched off and the screen stayed. The Identity Protection policy was the cause.

Why an API sign-in test misses these screens

The setup tests signed in through the API with a password grant, which has no user interface. Learn says this flow is incompatible with MFA. It also says Identity Protection asks for registration at the next interactive sign-in. A password grant is never interactive, so the API test passed while the browser stopped. A headless browser that clicked through each screen and saved a screenshot found the problem.

Learn recommends the password grant only for testing, in a separate test tenant, with test users. Use it to check roles and items, never as proof of sign-in. There is one more reason to sign in through the portal early. In Doha the data agent answered an account only after its first portal sign-in.

Eleven setup lessons for Fabric trainers

Each lesson cost time on October 14. Where Learn covers a point, the lesson says so. The rest are observations from one tenant.

  1. N1. Capacity names take lowercase letters and digits, start with a letter, and run 3 to 63 characters, per the Learn template reference. A name with a hyphen failed with “Invalid chars in resource name.”
  2. N2. Quota is per subscription and per region. This subscription had 0 CU in West and North Europe, 44 in Sweden Central, and 16 in smaller EU regions. Read it before you pick a region.
  3. N3. A self-service quota request can be accepted and still fail. Learn says to open a support request then.
  4. N4. Paused capacities still counted against the quota. Learn does not say either way. Delete what you do not need.
  5. N5. Fabric did not see a brand-new security group at once. Assign roles to the group and to each user.
  6. N6. A guest admin from another tenant could change directory settings, but Fabric workspace and capacity calls answered 404. A native admin with a Fabric license worked. Learn does not cover this case.
  7. N7. Security defaults block device code sign-in, as Learn confirms. Use the browser sign-in for command-line tools.
  8. N8. An API password sign-in skips interactive screens, so only a browser test finds them. Check the Identity Protection registration policy first.
  9. N9. Fabric shows its own email page before the Microsoft password page. Tell the room.
  10. N10. The data agent and Copilot need a paid F2 or larger. F64 matters only for Free users who view Power BI items.
  11. N11. Old workshops leave things behind. This tenant held 23 old workspaces and five old capacities, and they took the quota. Clean up every time.

What was measured on the night

The sign-in log at teardown showed 50 distinct workshop accounts, with the peak between 6:00 and 7:00 PM. The playground held 139 items when it was deleted. Those are the measured results. CU use, token counts, and the time each person needed to sign in were not measured.

Read the 50 with care. The afternoon checks signed in to every account, so the log count does not prove that 50 people signed in. The number of people in the room who signed in was not recorded. The peak hour and the 139 items are better evidence of use.

One lesson is worth a warning. If the handout names an end time for access, schedule the disable step for that time.

The evening as a run sheet, October 14, 2026, Doha time A time strip from 3:00 PM to 9:00 PM, drawn to scale, with four phases. Build ran from 3:20 to 4:50 PM. Dry checks ran from 4:59 to 5:55 PM, and the last blocker cleared at 5:50 PM. The session ran from 6:00 to 8:00 PM on the planned clock, with sign-in at the 6:40 PM break and hands-on from 7:25 PM. The handout end time was 9:00 PM. The shutdown then closed access and deleted the build the same night. Filled dots are measured, hollow dots are planned. 3 PM 4 PM 5 PM 6 PM 7 PM 8 PM 9 PM Build 3:20 to 4:50 PM 3:20 Accounts and group 3:35 Demo capacity, F16 3:52 Old capacities deleted 3:56 Playground capacity 3:57 Demo scaled to F32 4:00 Ontology setting on 4:50 Demo data loaded Dry checks 4:59 to 5:55 PM 4:59 Security defaults off 5:18 Password reset off 5:20 Still blocked 5:50 MFA registration off 5:52 Browser test passes 5:55 Demo role: Contributor Session 6:00 to 8:00 PM 6:00 Start 6:40 Break and sign-in 6:45 Live demo 7:25 Hands-on, 17 minutes 8:00 End 6 to 7 Peak sign-ins, log Shutdown After the session, same night 9:00 Handout end time Accounts disabled Definitions exported Workspaces deleted Capacities deleted Root elevation removed Measured: setup record or sign-in log Planned: presenter clock or handout Break and hands-on All times Doha time, Wednesday, October 14, 2026. The evening as a run sheet, October 14, 2026, Doha time A to-scale strip from 3:00 PM to 9:00 PM, then four phases with their cues: build from 3:20 to 4:50 PM, dry checks from 4:59 to 5:55 PM, the session from 6:00 to 8:00 PM on the planned clock, and the shutdown the same night. Filled dots are measured, hollow dots are planned. 3 PM 6 PM 9 PM Build 3:20 to 4:50 PM 3:20 Accounts and group 3:35 Demo capacity, F16 3:52 Old capacities deleted 3:56 Playground capacity 3:57 Demo scaled to F32 4:00 Ontology setting on 4:50 Demo data loaded Dry checks 4:59 to 5:55 PM 4:59 Security defaults off 5:18 Password reset off 5:20 Still blocked 5:50 MFA registration off 5:52 Browser test passes 5:55 Demo role: Contributor Session 6:00 to 8:00 PM 6:00 Start 6:40 Break and sign-in 6:45 Live demo 7:25 Hands-on, 17 minutes 8:00 End 6 to 7 Peak sign-ins, log Shutdown After the session, same night 9:00 Handout end time Accounts disabled Definitions exported Workspaces deleted Capacities deleted Root elevation removed Measured: setup record or sign-in log Planned: presenter clock or handout Doha time, October 14, 2026.
Figure 3. The evening as a run sheet. The strip at the top is to scale. Build and dry checks filled the afternoon before the start, and the last blocker cleared at 5:50 PM. Session times follow the presenter clock. The rest comes from the setup record and the sign-in log.

Fabric workshop teardown, in order

Tear down in an order that closes access first and deletes compute last. Restore security settings before you give up the roles that let you change them. In Doha the teardown ran the same night: 50 accounts disabled, item definitions exported, both workspaces deleted, both capacities and their resource group deleted, and the root elevation removed.

  1. T1. Disable every workshop account and revoke its sessions, two steps that Learn pairs. Keep the accounts a few days if someone may ask for their work.
  2. T2. Export the item definitions you want to keep. In Doha, eight hand-built items were exported first, and the lakehouse data rebuilds from a script.
  3. T3. Delete the workspaces. Participant items go with them.
  4. T4. Delete the capacities and their resource group. Deleting frees the quota. Pausing did not.
  5. T5. Restore every security setting you changed, and check each one in the portal.
  6. T6. Remove elevated roles last: the root User Access Administrator assignment and any subscription role you gave yourself. Learn says to remove elevated access once the changes are done.

One detail for scripts: a workspace delete once returned 404 with a token that could list the workspace, then succeeded a minute later. Retry a delete before you report a failure.

Checklist for your next Fabric workshop

Copy this list into your run sheet. It moves every step of the Doha afternoon to the days before.

Seven days before

  1. C1. Use a dedicated workshop tenant, separate from the company tenant.
  2. C2. Read the quota for each candidate region and delete leftover capacities. Request any raise now, through support if self-service fails.
  3. C3. Create two paid capacities, F2 or larger: demo and playground. Keep each agent in the region of its sources. Name capacities in lowercase letters and digits.
  4. C4. Create member accounts, assign Fabric Free, and create the security group.
  5. C5. Choose the MFA approach: a group-scoped exception with an end time, or a Temporary Access Pass. Write the restore steps now.
  6. C6. Turn on the tenant settings the hands-on needs, such as ontology Preview items.
  7. C7. Write the capacity budget and label it an estimate.

One day before

  1. C8. Assign roles to the group and to each user. Share items that need more than the role gives, such as lakehouse Files.
  2. C9. Publish the data agent. Learn says consumers can query only the published version.
  3. C10. Run a headless browser sign-in for every account and keep the screenshots. It also gives each account its first portal sign-in.
  4. C11. Print the handout without the password. Check that it names the roles as set.

Thirty minutes before

  1. C12. Sign in on a phone as one participant, open the dashboard, and ask the agent one question.
  2. C13. Check that both capacities are active and that no role changed since the last test.
  3. C14. Put the sign-in card on the screen: address pattern, password, workspaces, end time.

After the session

  1. C15. Disable the accounts and revoke sessions at the stated end time, on a schedule.
  2. C16. Export definitions, then delete workspaces, capacities, and the resource group.
  3. C17. Restore every security setting and check each one.
  4. C18. Remove elevated roles. Record what changed and when.

Access is half of a hands-on session. The other half is teaching, and Part 7 covers how to teach Fabric from zero in two hours. Part 5 covers the step from demo to production. The session kit is public on GitHub, and daily Fabric lessons are in the Fabric Falcons community. To plan a workshop environment with Dr. Kot, book a slot. For longer projects, see the Microsoft Fabric implementation guide.

Key facts at a glance

Numbers and rules from Microsoft Learn, checked on November 3, 2026.

IDFactSource
K1An F32 provides 32 capacity units, which is 768 CU hours a day. An F16 provides 16 capacity units, which is 384 CU hours.Microsoft Fabric concepts and licenses
K2One data agent request with 2,000 input and 500 output tokens costs 400 CU seconds, or 0.11 CU hours.Data agent in Fabric consumption
K3Data agent work is a background job, and Fabric smooths background jobs over 24 hours.Understand the Fabric capacity throttling policy
K4Throttling starts when a capacity has used all its CU for the next 10 minutes. Real-Time Intelligence skips the 20-second delay stage.Understand the Fabric capacity throttling policy
K5The data agent needs a paid F2 or larger capacity, and trial capacities do not support it.Fabric data agent concepts
K6A Fabric Free license creates non-Power BI items on an F capacity. Viewing Power BI items with it needs F64 or larger.Microsoft Fabric concepts and licenses
K7A Fabric capacity name starts with a lowercase letter, uses only lowercase letters and digits, and has 3 to 63 characters.Microsoft.Fabric capacities template reference
K8An F16 has 32 Spark VCores, 96 with burst, and interactive notebook jobs are not queued.Concurrency limits and queueing in Apache Spark for Fabric
K9A workspace holds at most 1,000 users or groups in roles, and a role change takes effect at the next sign-in.Give users access to workspaces
K10Security defaults block device code flow and cannot be customized.Security defaults in Microsoft Entra ID
K11A Temporary Access Pass lasts 10 minutes to 30 days and satisfies Conditional Access MFA requirements.Configure Temporary Access Pass

Frequently asked questions

How do you give 50 people access to Microsoft Fabric for a workshop?

Create member accounts in a dedicated tenant, assign each one the Fabric Free license, and add them to a security group. Give the group and each account a role on the workspaces, and put the workspaces on a paid F capacity. Then test every sign-in in a real browser, because an API sign-in skips the screens people see.

Can a Fabric trial capacity run a hands-on workshop?

Not if the workshop uses the data agent or Copilot. Microsoft Learn states that trial capacities do not support Copilot, data agents, AI functions, or AI services. The data agent needs a paid F2 or larger capacity, or a Power BI Premium P1 or larger capacity with Fabric enabled.

What Fabric capacity size does a workshop with a data agent need?

The data agent needs a paid F2 or larger, not an F64. By the example on Microsoft Learn, one data agent question costs 0.11 CU hours. Fifty people asking six questions each comes to about 33 CU hours, an estimate of 4 percent of an F32 day. Check the regional quota first, and put the playground on its own capacity.

Why do workshop accounts see “Let's keep your account secure” in Fabric?

A tenant policy requires MFA registration at sign-in. Microsoft Learn names the Identity Protection MFA registration policy, per-user MFA, Conditional Access, and security defaults as sources. In a tenant with no Conditional Access policy, check the Identity Protection registration policy first.

Why does a test script sign in as a participant while the browser gets stuck?

A script that signs in with a password grant has no user interface, so Microsoft Entra ID cannot show a registration screen. Microsoft Learn says users who need MFA are blocked in that flow, and Identity Protection asks for registration only at an interactive sign-in. Test with a real or headless browser.

Why can a Fabric capacity name not contain a hyphen?

The Azure template reference on Microsoft Learn sets the pattern for a Fabric capacity name: a lowercase letter first, then lowercase letters and digits only, 3 to 63 characters in all. A hyphen, an underscore, or a capital letter is rejected.

Should workshop accounts skip MFA?

Only in a dedicated workshop tenant, for a fixed time, with compensating controls such as no admin roles, no mailbox, and accounts disabled when the session ends. Microsoft Learn documents narrower tools: Conditional Access policies with excluded groups, and the Temporary Access Pass, a time-limited passcode that satisfies MFA requirements.

About the author

Dr. Estera Kot is CTO at Clouds on Mars, a Microsoft and Databricks partner for data and AI in Europe and the Middle East. At Microsoft she was Principal Product Manager for the Apache Spark runtime in Azure Synapse Analytics and Microsoft Fabric, and she created the Native Execution Engine. She is a Microsoft MVP and holds a Ph.D. in Computer Science from the Warsaw University of Technology. She presented this series as the community session "From Events to Answers" at Microsoft Qatar HQ in Lusail, Doha, on October 14, 2026.

Sources

Microsoft Learn, checked on November 3, 2026. Session facts come from the session's own setup record, handout, and presenter clock.