Fabric does not live in your VNet
Microsoft Fabric workspace identity and the enterprise Landing Zone: four crossings and one trap.
Security teams with a strict Azure Landing Zone ask one question first: how do we put Fabric inside our VNet? The answer is that you do not. Fabric is a software-as-a-service platform that Microsoft operates. It never joins your network. Only the VNet data gateway places anything there, and only in a subnet you delegate to it. The useful question is where Fabric crosses into your Landing Zone, and what each crossing needs from your side.
Fabric workspace identity is an automatically managed service principal that Fabric creates for one workspace, so items in that workspace authenticate to Azure resources without stored secrets. Microsoft's Well-Architected guidance for Fabric says to use it for external resources “whenever possible.” In a Landing Zone, possible ends at the gateway.
In short
- Fabric meets your Landing Zone at four crossings: identity, secrets, outbound traffic, and inbound traffic. Design each one with the team that owns it on your side.
- Workspace identity removes stored secrets for Azure sources that Fabric reaches directly. It is not supported for gateway connections. SAP and on-premises databases stay on service principals or technical accounts.
- One Conditional Access policy that targets all service principals switches off every workspace identity in the tenant. Exclude each identity explicitly, in code, when the workspace is created.
What Fabric workspace identity is
A workspace identity is an automatically managed service principal tied to one Fabric workspace. Fabric creates the Microsoft Entra ID app registration and the service principal, and it manages the credentials. Nobody stores a secret. That is the whole appeal, and it is real.
Eight facts about Fabric workspace identity shape the design:
- A workspace admin creates it. My workspace cannot have one.
- It carries the workspace name and follows a rename. The app registration behind it stays the same.
- It starts with no workspace role.
- It works on any capacity, trial included. Trusted workspace access, covered below, needs an F SKU.
- According to Microsoft Learn, a tenant allows 10,000 workspace identities by default. Fabric admins can change that maximum in the tenant settings.
- Learn advises against editing or deleting its app registration in Entra ID. Items that use the identity stop working, and Fabric may revert the change.
- A deleted workspace identity does not come back when you restore the workspace.
- Purview Audit records when the identity is created, retrieved, or deleted, and when Fabric retrieves its token. Sign-ins appear in Entra ID under Enterprise applications.
Workspace identity authenticates the items on the left of Figure 2 today. Support differs by connector, so read the connector page before you design around it. Notebooks through a Fabric connection and Apache Airflow jobs support it in preview.
Workspace identity authenticates
- OneLake shortcuts to ADLS Gen2 and Blob Storage
- Pipelines: Copy, Lookup, Get Metadata, and more per connector
- Copy job
- Semantic models in import mode
- Dataflow Gen2 with CI/CD
- T-SQL COPY INTO in a warehouse
Through a gateway, it does not
- SAP and on-premises databases behind the on-premises data gateway
- Sources reachable only inside your VNet, behind the VNet data gateway
Use a service principal, a SQL account, or a technical account stored in the gateway.
Learn states it in one line: workspace identity is not supported for gateway connections. The page does not separate the on-premises data gateway from the VNet data gateway, so plan for both. In regulated estates the sources that matter most, SAP and on-premises databases, sit behind a gateway. They keep a service principal, a SQL account, or a technical account. Workspace identity shrinks the secret inventory. It does not empty it.
Crossing 1: identity and Conditional Access
Identity is where most Fabric rollouts in a locked-down tenant fail. Three rules cause it.
The Conditional Access trap for workspace identity
Conditional Access for workload identities lets a tenant block service principals by location or risk. It requires Workload Identities Premium licenses. Security teams that own a Landing Zone often scope one such policy to all service principals. Learn is explicit: exclude each workspace identity from that policy, or workspace identities will not work. Trusted workspace access to firewalled storage fails the same way. Nothing warns you when the workspace is created. The failure shows up when an item runs.
- Token requestFabric requests an Entra ID token for the workspace identity.
- Policy checkEntra ID evaluates Conditional Access for workload identities.
- BlockedA policy that targets all service principals denies the token.
- Failure at run timeShortcuts, pipelines, and trusted access to storage fail.
Fix. Exclude each workspace identity from the policy explicitly, in code, in the same change that creates the workspace.
The run-time role rule for pipelines
The identity that runs a pipeline, user or service principal, needs the Admin, Member, or Contributor role in the workspace. Fabric checks this at run time. Access for the workspace identity on the data source is not enough on its own. The pattern to expect: an engineer runs the pipeline by hand and it passes. The schedule runs under an identity without a workspace role, and it fails.
One workspace identity per workspace
Each workspace has its own identity. A common Landing Zone pattern splits workspaces by layer and by environment. Three layers in three environments give nine workspaces and nine identities. Each one needs its own role assignments, its own Conditional Access exclusion, and its own resource instance rule on every firewalled storage account. Each one also needs its own connection, because Learn warns that a workspace identity connection reused in another workspace might not work.
9 identities × 4 setup items = at least 36 items to keep in code.
Configure this in code, never by hand in a portal. Resource instance rules for Fabric workspaces cannot be created in the Azure portal anyway. Learn allows ARM templates or PowerShell only.
Crossing 2: secrets and customer-managed keys
Two Fabric features reach into Azure Key Vault.
Customer-managed keys encrypt workspace data with your key. Fabric reads the key through a first-party app, Fabric Platform CMK, app ID 61d6811f-7544-4e75-a1e6-1c59c0383311. Grant it the Key Vault Crypto Service Encryption User role. The vault needs soft delete and purge protection, and Fabric takes a versionless key URI. A vault with its firewall on, or with public access disabled, works when Allow trusted Microsoft services is on. Learn does not document a vault reachable only through a private endpoint without that bypass. Customer-managed keys are not available on trial capacities.
Key Vault references let connections read secrets from your vault. The vault must be public, or private with an on-premises data gateway that has network line of sight to its private endpoint.
A Landing Zone that allows Key Vault only behind private endpoints needs a decision before the project starts: allow the trusted services bypass on the key vault, or accept a setup Learn does not cover.
Crossing 3: outbound traffic, gateways, and private endpoints
Outbound traffic takes one of four paths, chosen by workload and target. Pick the path per row, not per platform. A fifth option closes all of them by default.
| ID | Workload | Target | Path | Limits |
|---|---|---|---|---|
| O1 | OneLake shortcuts, pipelines, semantic models in import mode, T-SQL COPY, AzCopy | ADLS Gen2 or Blob Storage behind a firewall | Trusted workspace access: a resource instance rule per workspace, a Storage Blob Data role at storage account scope | F SKU only, no trial. At most 200 resource instance rules per storage account. |
| O2 | Notebooks, Spark job definitions, lakehouses. Eventstream for Event Hubs and IoT Hub only. | Azure resources behind private endpoints | Managed private endpoints, approved by the resource owner. ADLS Gen2 needs one for blob and one for dfs. | Data Engineering must run in the tenant home region and the capacity region. Starter pools switch off. |
| O3 | Pipelines, Copy job, Dataflow Gen2, mirroring, semantic models | Sources reachable only inside your VNet | VNet data gateway in a subnet delegated to Microsoft.PowerPlatform/vnetaccesslinks | No workspace identity. Gateway metadata sits in the tenant home region. |
| O4 | Pipelines, Copy job, Dataflow Gen2, semantic models | SAP and databases on premises | On-premises data gateway cluster, outbound only: TCP 80, 443, 1433, 5671, 5672, and 9350 to 9354 | No workspace identity. Tenant Private Link blocks gateway registration. |
| O5 | Every item in a workspace | Any destination | Workspace outbound access protection: blocks all outbound traffic, then allows destinations through managed private endpoints or data connection rules | F SKU only. Unsupported items block enabling it. PyPI is blocked. |
Avoid one setting. The storage firewall exception for trusted Azure services opens the account to every workspace on your tenant's Fabric capacities that has a workspace identity. Learn does not recommend it and says support might end. Use resource instance rules. Each rule admits one workspace.
Spark needs its own note. Notebooks do not use trusted workspace access directly. They read firewalled storage through a OneLake shortcut that does, or they connect through a managed private endpoint. Managed private endpoints switch off starter pools, so Spark sessions start in minutes instead of seconds. According to Microsoft Learn, a session takes 3 to 5 minutes to start.
Crossing 4: inbound traffic and Private Link
Private Link closes the public endpoint. Fabric offers it at two scopes, and each breaks something.
| ID | Scope | What it locks | What it breaks | Private DNS |
|---|---|---|---|---|
| P1 | Workspace Private Link | Inbound access to one workspace | F SKU only. Not supported: semantic models, deployment pipelines, workspace monitoring, item sharing. Dataflow Gen2 must use a VNet data gateway in the same VNet as the endpoint. | privatelink.fabric.microsoft.com |
| P2 | Tenant Private Link | Inbound access to the whole tenant | On-premises data gateways fail to register. Copilot, export to PDF and PowerPoint, the Capacity Metrics app, and trial capacities are not supported. | privatelink.analysis.windows.net, privatelink.pbidedicated.windows.net, privatelink.prod.powerquery.microsoft.com |
Tenant Private Link cuts the path to SAP and on-premises databases, because those run through the on-premises data gateway. If such sources feed the platform, tenant Private Link is off the table. Workspace Private Link is the narrower tool. Check each item type against the supported list before you lock a workspace. Workspaces that serve semantic models stay outside it.
Nine rules for Fabric in an Azure Landing Zone
- R1. Draw the four crossings before the first workspace exists. Name an owner on the Landing Zone side for each one.
- R2. Create workspace identities in code. Put the role assignments, the Conditional Access exclusion, the resource instance rule, and the connection in the same change.
- R3. Exclude every workspace identity from Conditional Access for workload identities. Test with a scheduled run, not a manual one.
- R4. Give the identity that runs each pipeline a workspace role: Admin, Member, or Contributor.
- R5. Use resource instance rules. Do not use the trusted services exception.
- R6. Keep SAP and on-premises databases on service principals or technical accounts. Treat both gateway types as closed to workspace identity.
- R7. Keep identity cleanup automation away from workspace identity app registrations. A deleted identity does not come back with the workspace.
- R8. Get the Azure Policy assignments of the Landing Zone before you promise customer-managed keys, managed private endpoints, or Private Link. A deny policy beats any design.
- R9. Check regions first. Managed private endpoints need Data Engineering in both the tenant home region and the capacity region. Managed virtual networks are not available in Switzerland West or West Central US.
Fabric security in a Landing Zone is four agreements with the team that owns it. Write them down before the first workspace exists.
To review a Fabric Landing Zone design with Dr. Kot, book a slot.
Key facts at a glance
Numbers and identifiers from Microsoft Learn, checked on November 3, 2026.
| ID | Fact | Value | Source |
|---|---|---|---|
| K1 | Workspace identities per workspace | One, created by a workspace admin. My workspace cannot have one. | Workspace identity |
| K2 | Default maximum per tenant | 10,000 workspace identities. Fabric admins can change the maximum. | Developer tenant settings |
| K3 | Capacity for workspace identity | Any capacity, trial included | Workspace identity |
| K4 | Capacity for trusted workspace access, workspace Private Link, and outbound access protection | F SKU only. No trial capacity. | Trusted workspace access |
| K5 | Resource instance rules per storage account | 200 | Azure subscription and service limits |
| K6 | On-premises data gateway ports | Outbound TCP 80, 443, 1433, 5671, 5672, and 9350 to 9354. No inbound ports. | Gateway communication settings |
| K7 | Spark session start with managed private endpoints | 3 to 5 minutes, because starter pools switch off | Managed virtual networks |
| K8 | Fabric Platform CMK app ID | 61d6811f-7544-4e75-a1e6-1c59c0383311 | Customer-managed keys |
| K9 | Private DNS zones | Workspace Private Link: privatelink.fabric.microsoft.com. Tenant Private Link: privatelink.analysis.windows.net, privatelink.pbidedicated.windows.net, privatelink.prod.powerquery.microsoft.com. | Private links for Fabric tenants |
| K10 | Regions without managed virtual networks | Switzerland West and West Central US | Managed virtual networks |
Frequently asked questions
Can Microsoft Fabric run inside an Azure VNet?
No. Microsoft Fabric is a software-as-a-service platform that Microsoft operates, and it never joins your virtual network. Only the VNet data gateway places a component in your network, in a subnet you delegate to it. Fabric meets an Azure Landing Zone at four crossings instead: identity, secrets, outbound traffic, and inbound traffic.
Does Fabric workspace identity work with the on-premises data gateway?
No. Microsoft Learn states that workspace identity authentication is not supported for gateway connections, and it does not separate the on-premises data gateway from the VNet data gateway. Sources behind a gateway, such as SAP and on-premises databases, need a service principal, a SQL account, or a technical account stored in the gateway.
Why is workspace identity missing from the authentication options of my Fabric connection?
Microsoft Learn states that workspace identity is not supported for gateway connections. Users on the Fabric Community forum report that the option appears only when the connection uses no gateway. Support also differs by connector, so check the connector page on Microsoft Learn before you design around it.
Why does Fabric workspace identity fail when Conditional Access is enabled?
A Conditional Access policy for workload identities that targets all service principals also targets every Fabric workspace identity. Microsoft Learn says each workspace identity must be excluded from that policy, otherwise workspace identities and trusted workspace access stop working. Creating or editing such policies requires Workload Identities Premium licenses.
Why does a Fabric pipeline succeed when run manually but fail on schedule?
The identity that runs a Fabric pipeline, user or service principal, needs the Admin, Member, or Contributor role in the workspace, and Fabric checks this at run time. Access for the workspace identity on the data source is not enough on its own. If the schedule runs under an identity without a workspace role, the scheduled run fails while manual runs pass.
What is trusted workspace access in Microsoft Fabric?
Trusted workspace access lets a Fabric workspace reach ADLS Gen2 or Blob Storage behind a firewall. It requires an F SKU capacity, a workspace identity on the workspace, and a resource instance rule for that workspace, created with an ARM template or PowerShell. It works for OneLake shortcuts, pipelines, semantic models, T-SQL COPY, and AzCopy.
Should I use workspace Private Link or tenant Private Link for Fabric?
Use tenant Private Link only if no source runs through the on-premises data gateway, because on-premises data gateways fail to register when tenant Private Link is enabled. Workspace Private Link locks one workspace at a time and needs an F SKU. It does not support semantic models, deployment pipelines, or workspace monitoring.
How do Spark notebooks in Fabric reach storage behind a private endpoint?
Create a managed private endpoint from the Fabric workspace and have the owner of the Azure resource approve it. ADLS Gen2 needs one endpoint for the blob sub-resource and one for dfs. Managed private endpoints switch off starter pools, so Spark sessions start in minutes instead of seconds. Microsoft Learn cites 3 to 5 minutes.
Can a deleted Fabric workspace identity be restored?
No. Restoring a deleted workspace does not restore its workspace identity. A new identity means new role assignments, a new Conditional Access exclusion, new resource instance rules, and new connections. Keep identity cleanup automation away from the app registrations behind Fabric workspace identities.
Sources
Microsoft Learn, checked on November 3, 2026.
- Workspace identity
- Authenticate with workspace identity
- Workspace identity in Data Factory
- Trusted workspace access
- Conditional Access for workload identities
- Azure subscription and service limits: Storage
- Managed private endpoints overview
- Create managed private endpoints
- Managed virtual networks
- Workspace outbound access protection
- VNet data gateway overview
- VNet data gateway FAQ
- On-premises data gateway communication settings
- Private links for Fabric tenants
- Workspace-level private links: supported scenarios
- Customer-managed keys for Fabric workspaces
- Configure Azure Key Vault references
- Developer tenant settings: maximum number of Fabric identities
- Azure Well-Architected Framework: security for Microsoft Fabric workloads
- Fabric Community forum: workspace identity and gateways (user reports, not documentation)