Outbound access protection: stop data leaving through shortcuts and agents

What outbound access protection is and how it works

An outbound request is any request from inside a workspace to another workspace or an external location. Direction is all that counts. Reading from an external store and writing to it both leave the workspace, so both are blocked.

It takes two switches and one prerequisite. A Fabric administrator enables the tenant setting Configure workspace-level outbound network rules, which is off by default. A workspace admin then turns on Block outbound public access in the workspace settings. The workspace must run on an F SKU capacity. Trials and other capacity types are not supported.

From then on, every outbound connection is denied until you allow it. The workload decides how:

Learn also lists Real-Time Intelligence, mirrored databases, Data Science, and Data Warehouse items. A data connection rule names an endpoint, such as an ADLS Gen2 account, or a Fabric workspace.

For the Fabric data agent, an outbound request happens when it adds or queries a data source outside its workspace. Calls inside the same workspace stay unrestricted. The agent's Microsoft-managed Azure OpenAI connection is outside the model, and Azure AI Search is not supported yet.

What the outbound access protection demo shows

• 0:00 The demo workspace fabcon-gdynia-demo holds four items: the notebook 01_load_demo, the lakehouse lh_oud_rd with its SQL analytics endpoint, and the semantic model Oud RnD.
• 0:02 Workspace settings open on General. The menu also lists Workspace identity, Outbound networking, Inbound networking, and Encryption.
• 0:04 The cursor selects Outbound networking. Learn's setup page calls this page Network Security, so expect either label.
• 0:08 The page shows "No endpoints to show", so no managed private endpoint exists. Below it sits Outbound access protection, with Block outbound public access set to Off.
• 0:10 The help text reads: "Creation of other items will be disabled once this feature is turned on. Please wait for 15 mins for the setting change to take effect." Allow Git Integration sits below, also Off.

The toggle stays Off until 0:18 on purpose. The runbook says to look, not switch, because the same workspace runs Spark notebooks and Project Osmos.

Outbound access protection limits and side effects

The catch: outbound protection only watches requests that start inside the workspace. When an external tool copies files out with AzCopy, the workspace is the source and only receives inbound reads, so nothing blocks the copy. Learn points to inbound protection with Private Link for that path.

Project Osmos is the side effect teams notice first. Learn states the data engineering agent is not available for workspaces with outbound access protection, so keep Osmos in a separate development workspace.

• Outbound protection needs a region where Fabric Data Engineering runs. Data connection rules are not available in Qatar Central yet.
• With workspace or tenant Private Link on, the portal cannot configure data connection rules. Use the REST API instead.
• Notebooks cannot query warehouse file paths through the dbo schema. Use T-SQL instead.

Outbound protection controls where data can go. OneLake security roles control who reads it in the first place. For the inbound side and workspace identity in a regulated network, see Fabric does not live in your VNet.

Run the outbound access protection demo yourself

You need the WorkspaceBlockOutboundAccess tenant setting, part of settings on in the recap demos folder, and the workspace Admin role. Steps from runbook D11:

1. Open Workspace settings > Outbound networking.
2. Find Outbound access protection and Block outbound public access.
3. Look, do not switch it on in the demo workspace. It disables starter pools, blocks pip install from PyPI, and Osmos (D06) stops working there.

Expected result: the setting and its allow list options, managed private endpoints and data connection rules. Time and cost: about 2 minutes, on the F8 capacity from up.

In a test workspace you can switch it on from code. Learn documents one call. Send the inbound value too, or the call resets it to the default, Allow.

PUT https://api.fabric.microsoft.com/v1/workspaces/{workspaceId}/networking/communicationPolicy

{
  "inbound":  { "publicAccessRules": { "defaultAction": "Allow" } },
  "outbound": { "publicAccessRules": { "defaultAction": "Deny" } }
}

To audit the tenant, the List Networking Communication Policies admin API returns every workspace with inbound or outbound protection and its rules.

What to do on Monday

On Monday: Turn on outbound access protection on workspaces that hold sensitive data.

List each workspace's shortcuts, pipeline connections, and data agent sources first. Every external target needs a rule before the toggle goes on.

Key facts at a glance

Checked on Microsoft Learn on November 3, 2026.

Frequently asked questions

What does Fabric workspace outbound access protection block?

It blocks every request that starts inside the workspace and goes to another workspace or an external location. That includes OneLake shortcuts, OneLake copy operations, Spark traffic to the public internet, and data agent calls to outside data sources. Admins then allow approved destinations through managed private endpoints or data connection rules.

Is outbound access protection generally available in Microsoft Fabric?

Microsoft Learn lists OneLake outbound access protection, which covers shortcuts and copy operations, as GA since September 2026. Outbound access protection for Fabric data agents is in preview as of November 3, 2026. Some other workloads, such as Real-Time Events, are also still in preview.

Does outbound access protection stop all data exfiltration?

No. It only limits requests that originate in the workspace. An external tool that copies data out of the workspace makes inbound requests, so outbound protection does not block it. Microsoft Learn points to inbound protection with Private Link for that path.

Why does my Spark session take minutes to start after enabling outbound access protection?

A protected workspace runs Spark in a managed virtual network, so starter pools are disabled. Microsoft Learn says to expect Spark sessions to take 3 to 5 minutes to start. Spark also loses public internet access, including pip install from PyPI.

Does Project Osmos work in a workspace with outbound access protection?

No. Microsoft Learn states that the data engineering agent, Project Osmos, is not currently available for workspaces that have outbound access protection enabled. Run Osmos in a separate development workspace without the setting.

Does outbound access protection cover the Azure OpenAI calls of a Fabric data agent?

No. The data agent relies on a Microsoft-managed Azure OpenAI service, and Microsoft Learn says outbound access protection does not apply to that connection. It does apply when the agent adds or queries a data source outside its workspace.

Sources

Microsoft Learn and the recap repository, checked on November 3, 2026.

• Workspace outbound access protection overview
• Enable workspace outbound access protection
• Manage admin access to workspace outbound access protection settings
• Workspace outbound access protection for Data Agent (preview)
• Workspace outbound access protection for OneLake
• Limit outbound requests from OneLake
• Workspace outbound access protection for data engineering workloads
• Get started with the data engineering agent (Project Osmos)
• What's new in Microsoft Fabric
• Workspaces: List Networking Communication Policies
• Runbook D11: Outbound access protection (recap repository)
• FabCon Europe 2026 recap: status table and admin checklist (recap repository, status as of October 21, 2026)