My session at Fabric Week by ESPC - Q&A

On Tuesday, May 27th, I had the honor of presenting a session for the Fabric Week at ESPC:

A Day In The Life Of A(n Accidental) Fabric Administrator.

The session was recorded and is already available on YouTube, but unfortunately we ran out of time before I could answer all the questions during the session.

Thanks to ESPC and Seán Colleran I got hold of all the questions asked during the session, and I will provide answers in this blog post where I can.

Q&A

Without further ado, let's go to the questions:

1. How do you enable Fabric mirroring from the tenant settings?
   You don't have to enable mirroring specifically, but you do need to enable the creation of Fabric items in general: Enable Microsoft Fabric for your organization. You also need a workspace with an active Fabric capacity (trial or any F-SKU).

2. Can we mirror PostgreSQL with that option?
   Yes, you can mirror PostgreSQL, but only Azure Database for PostgreSQL flexible server. Keep in mind that currently mirroring doesn't support Azure Database for PostgreSQL flexible server behind an Azure Virtual Network or private networking.

3. As a Fabric admin, can I scale Fabric Capacity from F64 to F128, for example?
   For scaling only, being a Capacity admin should be enough, as explained in scale capacity.
   

4. What’s the best way to implement stop/start on Fabric Capacity?
   You might be able to, depending on the rights you have in the Azure Portal.
   To be specific, you need to have at least contributor rights on the Azure subscription. Specific permissions (to create a capacity) for an RBAC role are explained here.
   You can use the Fabric Capacities REST API's to Pause/Resume the capacity. You can call these API's with PowerShell, but also with Azure Data Factory, a Logic App, or from within a Fabric notebook. For the latter, you need a different capacity then the one you want to pause/resume though.

5. I want to manage capacity units. How can we manage the autoscaling function?
   If you mean Autoscale Billing for Spark, that is currently in preview and only controls the spark compute. There is no other option for autoscaling the SKU-size in Fabric. 

6. We have multiple customers on one tenant. Each wants to monitor their own Fabric capacity. What’s the best practice for setting up the Capacity Metrics App?
   In the Capacity Metrics workspace, you can create multiple copies of the report and put a report filter on a specific capacity. Then give a user specific permissions to only view that report.

7. Is there a way to reset tenant settings to “default” or Microsoft-recommended settings?
   Unfortunately not. You can check the documentation for the Tenant settings index, some settings mention a default value.
   If you are able to set up a totally new (test) tenant in Azure you could check the default values for the Tenant settings in that tenant.

8. On the permissions level, how do you differentiate between non-production and production environments?
   Usually this is done by using workspaces for dev-test-prod. On a workspace level you can easily manage permissions. Within Fabric you can use Deployment Pipelines to transfer items between the dev-test-prod stages.

9. I’m a user. Our new admin has set up Fabric Capacity (F2 pay-as-you-go). I have permission to create workspaces, but the Fabric Capacity option is greyed out.
   To be able to assign workspaces to a capacity you need at least Contributor permissions. The admin of a capacity can assign users on the Capacity settings page in the Admin portal:
   

   

10. Who can we scale up Spark clusters? How can we ensure only admins can do this?
    So go from a small Spark pool to a medium Spark pool.
    A workspace Admin can change the settings for Spark workloads in the workspace settings:
    

    
    
    They can adjust the current pools and create new ones. You can't limit it further, so every workspace Admin can do this.
    If you uncheck the last option, Members or lower can't change the settings on a session-level.

11. What’s the best way to implement a stop/start schedule for Fabric — e.g., only running during the day?
    Please see question 4.

12. For notification activities in a pipeline: I want to use Teams notifications. Do I need an Office license or a specific Teams license?
    To actually set up a working Teams activity, you need a Teams license, and a channel or chat to post it to. I was able to add the activity without a Teams license, but I can't select a channel to post to in that way.

13. Can a workspace admin restrict a tenant admin from accessing a specific workspace?
    No. A tenant (Fabric) admin can always go to the Admin portal and gain access to any workspace in the tenant.

14. What is the best alert mechanism? As a Fabric Admin, I want to know about overloads as soon as possible.
    There are a few options, I'll let you decide on the best one to use.
    On the Capacity settings page you can set up a notification for X% capacity usage.
    

    

    Somewhat similar, but more customizable, you can also set up an alert on the Capacity Metrics app with Activator (Real-Time Intelligence) and send a Teams or Outlook message.
    

    
    
    Not an alert mechanism per se, but on the capacity settings page, you can also set up Surge Protection, which lets you limit the compute consumed by background jobs. This way you can make sure the capacity doesn't overrun from background jobs.
    
    
    

15. Is there a way to kill a process in interactive operations?
    For most interactive operations you can't, like DAX or XMLA queries. Lakehouse or Warehouse queries can be stopped with the KILL command used in T-SQL.

16. If I pause a capacity with over-usage, will I see in advance how much I'll have to pay?
    No, not out-of-the-box. You could calculate the amount of overage, CU's and thus price, mainly from the Capacity Metrics app. But that's a manual calculation you'd have to do upfront.

17. Is there a way to connect that monitoring to a running Grafana?
    Apparently you can connect a Managed Grafana instance to a KQL database (eventhouse) in Fabric. It's explained in this post.

18. Do you need to be paying for Purview to use the Fabric Purview Hub reports?
    The Purview Hub reports are included as part of the Admin Monitoring workspace, so you don't need to pay extra or for a Purview license.

19. Is there a way to monitor the count of accesses per user on a report (like in PBI Report Server ExecutionLog3)?
    You can get this data from the default Usage Metrics Report, generated when clicking the below option on a report.
    

    
    
    You can also get all activity data (from all reports) out of the Activity Log, for example with the REST API - Get Activity Events. Keep in mind though, this has a data retention period of 30 days.
    
    

20. I understood the admin monitoring semantic models were locked — how did you create a custom version?
    You can indeed not edit the model itself, but as a Fabric Admin you do have Member access to the Admin Monitoring workspace, and thus Build permissions. So if you connect to the semantic model from Power BI Desktop, you can extend it (create a local model) with your own data. You would also be able to do this with Viewer access and build permissions.

21. Pro vs. Premium per-user license: What are the three most important reasons to choose Premium per-user over Pro on a Fabric capacity?
    It depends? 😉 In most cases, I would say if you already have Fabric, PPU is not necessary anymore. But of course, there are edge cases where it might benefit to have a PPU, I can think of one: Model size limits in low F-SKUs are pretty low (3 GB), in PPU it's 100 GB
    

22. Have you seen examples where the 30-day limit for admin monitoring has been extended by updating a custom Lakehouse and running reporting off that?
    Yes, you can export the Admin monitoring data to a Lakehouse. The solution I called out in my presentation is FUAM, which doesn't specifically extract the data from the Admin monitoring workspace, but it gets similar data from the rest of the tenant.

23. If I am not a Fabric admin, how can I get access to admin monitoring?
    By default, only users with the Fabric admin role (or higher) will have access. But the Fabric admin can also give other people (Viewer) access to the workspace.

24. Is there an API to extract user views on each Power BI report page?
    Yes, the Activity Events API, see question 19.

25. The 30 days... is that the same as the Dashboard Usage Metrics?
    Yes, right now, the retention is similar in all the Power metrics reports, except for the Capacity Metrics, which holds 14 days of data.

There's No Free Lunch - (Billing of) Preview Features in Fabric

Another post on my favorite topic: Governance and Administration!

With all the Fabric announcements in the last months, some of the Admin announcements might have slipped through. As you might know, the Admin part of Fabric is dear to my heart. I've posted about it earlier here, here, here, and here, to name a few 😀.

So in the next weeks I am going to highlight a few things with short, informative posts.

I decided to leave "Governance & Administration" out of the titles of my blog posts from now on.
The titles were getting a bit lengthy, just because I wanted to include the focus on Governance & Administration. I am already using labels which you can use for that: Governance, Administration, etc..

Today, let's talk about preview features in Fabric!

Preview features

First of all, when using Preview features in Fabric, you should be aware of the small print.

Next, we all know, there's no such thing as a free lunch, right?

Because: preview does not mean free! Let me explain.

Two of those preview features - SQL Database and Workspace Monitoring - have recently moved to a charging model as Fabric develops further. It's essential to understand these adjustments if you want to maximize your resources, govern your capacity and efficiently control expenses.

Fabric SQL Database

I wrote about it earlier when they were about to change the tenant setting for SQL Database: you should be aware that billing for SQL Database already started.

Compute and data storage for SQL databases are now charged according to your Fabric capacity beginning of February 1, 2025. The start date of backup billing is April 1, 2025. You can only pay for the resources you use because compute charges only apply when you are actively using the service. Automatic backups and storage are priced individually each month. Check Microsoft Learn for more details on billing and utilization reporting.

If you check the doc's on the usage of SQL Database you can see that:

1 Fabric capacity unit corresponds to 0.383 Database vCores, or, 1 Database vCore corresponds to 2.611 Fabric capacity unit.

For example, a Fabric capacity SKU F64 has 64 capacity units, which is equivalent to 24.512 SQL database vCores.

Compute is billed by the minute, but the database is also kept alive for 15 minutes afterwards. So if you use it for 4 minutes, you are actually billed for 19 minutes!
Storage will be billed per hour, regardless of usage.

Workspace Monitoring

Workspace Monitoring gathers and arranges logs and metrics from different Fabric components by building an Eventhouse database inside your workspace, providing insightful data about workspace performance and usage.
You can use this tool to optimize queries, minimize data downtime, investigate mistakes, and fix performance concerns.

As of February 2025, Workspace Monitoring billing has begun. Make sure you have a Power BI Premium or Fabric capacity and that the required tenant settings are set up in order to enable monitoring in your workspace. Check Microsoft Learn for a detailed tutorial on how to enable and use Workspace Monitoring.

Check your usage after this changeover

It is crucial to examine your present and anticipated consumption in order to foresee any expenses now that invoicing for these functions has been activated. To keep an eye on capacity utilization across all workloads and make sure it fits your organization's demands and budget, use the Fabric Capacity Metrics app. 

See Fabric capacity billing guidelines for a more thorough explanation of how these modifications affect your Azure bill.

Are you using these preview features in your tenant?

And did you know they are already billed?

Let me know in the comments!

Microsoft Fabric Documentation (for Admins)

Maybe this topic is not the most sexiest of them all, but it certainly has the same (or maybe even more) amount of value for YOU!
And.. another post on my favorite topic: Governance and Administration!

With all the Fabric announcements in the last months, some of the Admin announcements might have slipped through. As you might know, the Admin part of Fabric is dear to my heart. I've posted about it earlier here, here, here, and here, to name a few 😀.

Earlier I wrote about the default domain settings, changes to the default tenant setting value for SQL database and I also covered the (rights of the) Fabric Adminsitrator role. Today I want to talk about a more meta-topic: existing documentation on Microsoft Learn, and of course specifically for Admins.

Microsoft Fabric documentation

By this point, I assume you've read this far (and perhaps a few other posts as well), I guess you've heard of Microsoft Learn. 😁 

If not, go there now: Microsoft Fabric documentation!

It is full of so much good content, to name a few:

• Overview 
• What is Fabric: The B.A.S.I.C.S.
• Security in Fabric: You might not be aware, but there's so many things you can do to tweak and adjust security for your organization!
• Concepts 
• Choose a Fabric data store: Choose between a Lakehouse, Warehouse, Eventhouse, or SQL Database
• Copilot in Fabric: In what workloads can you use Copilot and what are the prereqs?
• Capacity and license types: This explains concepts like a tenant, capacity, workspace, SKU's, Power BI licenses, etc.
• Tutorials
• Use taskflows to build solutions: I'm curious, who really uses these in their environment?
• End-to-end tutorials: Those tutorials where the corner-stone of getting started with Fabric after it was announced. They still provide enourmous value, although sometimes the steps can be very basic.

And there's so much more:

Ok, I know... Sometimes the documentation is, let's say, a bit behind the latest features in Fabric, right?

It may be outdated, there might be typo's, it might even be wrong in some points.

Instead of (only) complaining, you should do something about it! 😏

Did you know you can edit those pages (make sure you're logged in to your MS Learn account):

After clicking that pencil on a doc page, you end up at GitHub where you can make changes to the document. You do need a GitHub account, know how to fork the repo and create a Pull Request when you're done (if you don't know how to, read this tutorial on GitHub 101).

Microsoft Fabric documentation for admins

Now on to my favorite part: the Admin stuff! 😁

Go to Microsoft Fabric documentation for admins to learn all about admin settings, tools, the admin portal, admin roles, and monitoring and management to name a few.

What is the admin monitoring workspace

The admin monitoring workspace is a specialized environment designed for Fabric administrators to monitor and manage workloads, usage, and governance within their tenant. Using the resources available within the workspace, admins can perform tasks such as security audits, performance monitoring, capacity management, and more.

It recently got a revamp on the design side and now looks way better.

The information contained in the report is on a fairly basic level, but you can still get some good insights out of it.

Next to that, you can also connect to the semantic model and extend it.

Closing

As you see there is a lot of information available on Microsoft Learn.`

Do you think the documentation on Microsoft Learn is valuable? Have you used it?

Does it need improvement? If yes, on what points?

Let me know in the comments!

Changes to the Default Tenant Setting value for SQL Database

Another post on my favorite topic: Governance and Administration!

With all the Fabric announcements in the last months, some of the Admin announcements might have slipped through. As you might know, the Admin part of Fabric is dear to my heart. I've posted about it earlier here, here, here, and here, to name a few 😀.

So in the next weeks I am going to highlight a few things with short, informative posts.

I decided to leave "Governance & Administration" out of the titles of my blog posts from now on.
The titles were getting a bit lengthy, just because I wanted to include the focus on Governance & Administration. I am already using labels which you can use for that: Governance, Administration, etc..

UPDATE 2025-03-12:

Microsoft released an update on the rollout of the changes to this setting. The actual enablement is postponed for 20 days to March 28. The timelines mentioned in the blog below are now:

• February 28, 2025 - Checkbox notification rolled out globally.
• March 8, 2025 -  Infobox will display this as the enablement date.
• March 28, 2025 - Actual enablement date for tenants that take no action.

Extending flexibility: default checkbox changes on tenant settings for SQL database in Fabric

Microsoft 365 Message Center

In case you have access to the M365 Admin Center, or more specific the M365 Message Center, you might have seen this message. I reckon not many people did.. That's why I'm blogging about it here 😁

I'm specifically talking about this message in the Message Center, being a major update and with admin impact: 

Communications on default checkbox changes on tenant settings and billing start for SQL database in Fabric.

Changes to SQL Database Tenant Setting

Recently, there's been a change to the tenant setting for SQL Database, but only in case you haven't changed the setting before.. 😉

Below is the setting in my own tenant, where the setting is still disabled, which was and still is the default option (hint: this is about to change!).

So if I do nothing, then after March 8, the default value will change to ON, or Enabled for the entire organization.

If I decide to opt out before March 8, so if I uncheck the checkbox Accept Microsoft's default selection (Off for the entire organization), this tenant setting will stay disabled, also after March 8.

To be clear, as I mentioned, you only see this message if you haven't changed the default setting (off).

In the Powerdobs tenant we already enabled SQL Database, so I only see the below:

M365 Message Center for Non-Admins

In case you don't have access to the Message Center, I found another site, called the Microsoft 365 Message Center Archive, where all those messages are replicated, set up by Merill Fernando, Principal Product Manager for Microsoft Entra.

Direct link to the message: https://mc.merill.net/message/MC996579.

I have been searching for a (regular) blog post on this topic, but I haven't seen anything:
Multiple other blog posts were written on the Fabric blog, but none of them explicitly mentioned any of this:

• Feb 12: Govern your data in SQL database in Microsoft Fabric with protection policies in Microsoft Purview
  
• Feb 19: Enhancing SQL database in Fabric: share your feedback and shape the future
  
• Feb 26: Why SQL database in Fabric is the best choice for low-code/no-code Developers
• There's a little link to Billing and utilization reporting for SQL database hidden in this blog post, which explains billing started at February 1st, but no mention of the tenant setting

Billing for SQL Database (preview)

Last thing I want to explicitly call out in accordance with the changed tenant setting:

While SQL Database in Fabric is still in preview, billing already started at February 1. Furthermore, billing for backup starts after April 1.

So when the setting is changed to ON, and you don't run a trial, you can start seeing SQLDbNative on your Capacity Metrics App as explained here. 😉

Governance & Administration - Default Domain settings

I'm picking up my favorite topic again: Governance and Administration!

With all the Fabric announcements in the last months, some of the Admin announcements might have slipped through. As you might know, the Admin part of Fabric is dear to my heart. I've posted about it earlier here, here, here, and here, to name a few 😀.

So in the next weeks I am going to highlight a few things with short, informative posts.

Last week I wrote about the rights of the Fabric Administrator.

Today I want to make you aware of a default value of the domain settings inside Fabric.

This default value might not be the best value for you.. 😉

Domains in Fabric

A short introduction to Domains: they are essentially a way of managing and structuring your data across the organization. You can logically group together data in workspaces. A logical grouping can be business units, areas, fields, solutions or actually whatever works for you. It shouldn't be something a Fabric Admin decides on his own. Ideally business and / or enterprise architects with the data owners (if any 😐) should implement the design of domains, subdomains and owners. People from you Center of Excellence (again: if available..) would be a good fit to include in this discussion.

In case you need some help or guidance on how to set up your domains, there's a nice article that can help you get started: Best practices for planning and creating domains.

Default Domain Settings

Check your defaults! I've said it multiple times, always check default settings in your tenant, be it in the tenant settings or the domain settings.

When you create a domain (either with or without adding a domain admin explicitly), you end up with the default settings applied to that domain. Let's check what that involves.

After creating your domain and navigating to the settings you can SHOULD set the Contributors of the domain.

By default, it is set to The entire organization. I would limit it to either of the other options. Preferably tenant and domain admins, but if you have a group of people from Finance that you want to allow to add workspaces to the Finance domain, I'm happy with that too. Just don't use the default setting 😀

Luckily there's one more caveat to this that restricts it to hopefully a sligthly smaller group: the documentation points out you also have to be a workspace admin to be able to use this feature, so that limits it to people that have an admin role in the workspace.

One more reason to not give everyone the admin role in your workspace by default!

Next to that, you can also audit for these changes by checking the audit log for Fabric, specifically the UpdateDataDomainFoldersRelationsAsAdmin operation, which gives you the activities when someone assigns (or unassigns) a workspace to/from a domain.

Conclusion

Domains give you a good option to manage and group the content in your organization.

Just be aware of the default settings when you create one. Set the contributors to the tenant and domain admins, or a security group, just don't use the default!

Let me know what you think, have you seen this default setting and more importantly, did you change it in any of your domains?

Governance & Administration - Fabric Administrator Role

It's been a while since I've written on a regular cadance, so I'm picking up my favorite topic again: Governance and Administration!

With all the Fabric announcements in the last months, some of the Admin announcements might have slipped through. As you might know, the Admin part of Fabric is dear to my heart. I've posted about it earlier here, here, here, and here, to name a few 😀.

So in the next weeks I am going to highlight a few things with short, informative posts.

Today I want to talk to you about the Fabric Administrator (role).

• What rights does an Admin have?
• Are there more people that also have these rights? (Hint: YES! 😉)

Toady, I'm not talking about the governance aspects of the Admin, the Tenant settings or the Admin portal in general. I'll leave that for a next time. Or read other posts, for example by Marc on other roles and controls in Fabric or the delicate balance of governance and collaboration.

Manage Fabric Administrators

Users with this role can manage everything in Fabric, so from the Admin portal, to workspace access, and have also read access to various other parts in the Office and Azure ecosystem.

I encourage you to check who are assigned this role, because it should only be a handful of people in my opinion. You can check this in the Azure portal, under Entra ID > Roles and administrators.

Alternatively you can also search for it in the top search bar and go there directly.

Looking at the description of the role, we can see a few interesting things:

(As an Admin,) You can go to Azure and O365 Service Health to check for potential status issues with those services. You can also check and file (Premium) support tickets, depending on the license/capacity you have.

I especially want to call out the last row in the permissions:

The link there reads: microsoft.powerApps.powerBi/....

Power Platform Administrator

Now let's take a look at the Power Platform Admnistrator role description:

You might have noticed the same path there: microsoft.powerApps.

So this means, everything "below" PowerApps is also accessible, so the Power Platform Admin can also access and manage the same things the Fabric Admin can!

I also encourage you to check the people assigned to this role 😀

Just In Time Access Roles

Depending on your organizational settings, Privileged Identity Management might be enabled.
This means that people might need to activate the Fabric Admin role (for a period of time) before it becomes active. In the below screenshot you can see that Ernst and me have the role permanently assigned for Powerdobs.

But if I'm working as a consultant it usually is on a need-to-have bases, so I can e.g. activate it for 1, 2 or 8 hours. 

Looking at the picture above, you can see that there's Active and Eligible assignments. Depending on the settings and activity, people might have the PIM-role, but not activated at the moment.

Wrap up

To complete the list of access to Fabric, the Global (tenant) Admin role also has access to everything in Fabric:

• Global Admin
• Power Platform Administrator
• Fabric Administrator

People with the above roles have the same rights as the Fabric Admin.

Did you know the Power Platform Administrator has those rights?

Do you think I missed any information in this blog?

Please let me know in the comments below.

Governance & Administration - Ownership Takeover for Fabric Items

It's been a while since I've written on a regular cadance, so I'm picking up my favorite topic again: Governance and Administration!

With all the Fabric announcements in the last months, some of the Admin announcements might have slipped through. As you might know, the Admin part of Fabric is dear to my heart. I've posted about it earlier here, here, here, and here, to name a few 😀.

So in the next weeks I am going to highlight a few things with short, informative posts.

Today I want to quickly show a new feature that was just introduced, but long awaited for!

Ownership takeover for Fabric items!

Yes, you read it right, you can now TAKE OVER OWNERSHIP in Fabric! 😁

In a workspace, go to the ellipsis of the item (the 3 dots), and go to settings.

In the settings of the item you can see the Take over button:

Clicking that will show a pop-up and will start the transfer of ownership.

After a few seconds (that was my experience for the handful items I tried) you will get the notification it succeeded.

After that the (Take over) button has disappeared and will show up for the original (and other) users.

A few things to be aware of:

• You need read and write permissions to the item you want to take over
• That means a Contributor or higher role in the workspace
• Depending on the item you transfer, you might need to set up/refresh credentials for connections, as explained here
• The old way of taking ownership of Power BI items will still remain the same
• Mirrored databases are not supported (yet)
• If you're taking over a pipeline that execute's other items (like a notebook), you have to take over ownership of that item separately

For more info check the MS Learn docs: Take ownership of Fabric items.

Wrap up

This is of course especially helpful when the creator of an item left the company or that account is locked for whatever reason.

What's next you ask? The API for takeover is not yet available, and you also can't switch to a Service Principal yet. It only switches ownership to the current user at this moment.

Have you tried this feature yet?

Let me know what you think!