Introduction

Microsoft Fabric is a comprehensive platform designed to meet all the analytical needs of an enterprise. As a SaaS platform, it is fully managed over the internet. In contrast, the security aspects of IaaS and PaaS services can be customized and enhanced in a conventional manner, similar to other major cloud providers.

Diving into Microsoft Fabric’s Network Security:

Network security in Microsoft Fabric can be categorized into two main aspects:

1. Inbound Security: This involves restrictions on incoming traffic from external sources attempting to access a specific network. These rules are checked and, if validated, allow interaction with resources within the network.
2. Outbound Security: This pertains to traffic or data packets leaving the network. Before exiting, the traffic is validated through outbound rules, ensuring that data packets or requests from resources within the network are evaluated before they are allowed to leave.

Why is this Important?

We focus on network security for two main reasons:

1. Ensuring that users can connect to Fabric using a dedicated network rather than the public internet (inbound traffic security).
2. Securely connecting to any Azure or external resource to read data, ensuring that data exchange occurs via a managed private route (outbound traffic security).

 

How Fabric Security Works-

When a user accesses the Fabric portal, they are authenticated through Microsoft Entra ID, which manages credentials and verifies the user’s identity. Entra ID provides a session token that is sent to the Web Front-end. The Web Front-end uses this token to forward the user’s query, along with the session token, to the Metadata Platform.

The Metadata Platform, located in the tenant’s region, contains user permissions at both the fabric item and workspace levels. It operates within a secure network with protected endpoints for data transfer.

The Backend Platform, where storage (One Lake) and computation occur, is situated in the region configured for the capacity.

Once authenticated via Entra ID, the user’s request is handled by the Web Front-end, which then queries the Metadata Platform to verify permissions for the requested operation. If the user is authorized, the Metadata Platform sends the data request through the Microsoft backbone network to the Backend Platform. The Backend Platform performs the required computations, stores the data in the data lake, and sends the results back to the Web Front-end, allowing the user to see the final results.

 

The below section talks about the different network security aspects of Fabric:-

 

INBOUND Techniques Used For Network Security In Fabric:

Lets start with methods available to make sure traffic coming inside the Fabric is secure :-

The process to create private link is –https://learn.microsoft.com/en-us/fabric/security/security-private-links-use

The above two options can help restrict the overall public access and only allow secured private network to access Microsoft Fabric.

 

OUTBOUND Techniques Used For Network Security In Fabric:

Now lets look at the methods available to make sure the data source protected via firewall is access by Fabric in a secure way:-

Private Managed Endpoints:

This method is specific to the Synapse Data Engineering component of Microsoft Fabric and is available for F-64 (or higher) capacity workspaces. It creates a secure connection to Azure resources such as Azure SQL Databases, ADLS Gen2, and KQL Database. This process places the Spark engines in a separate virtual network, which connects to the Azure resources via a private managed endpoint. Note that using this method, the Spark notebook won’t be able to use the starter spooler and will require 5-6 minutes to start the Spark clusters.

Steps to Enable:

1. Create an Azure SQL Database: Ensure that public access is disabled for the connection.
2. Retrieve Resource ID:
   • Go to “Properties” in the Settings Pane on the left side inside the Azure resource.
   • Copy the Resource ID from the right pane.
3. Configure in Workspace Settings:
   • Click on the Settings icon in the workspace.
   • Navigate to “Network Security” and click on the “Create” option.
   • Follow the configuration as shown in the image below.

 

Trusted Workspace Access:

 

 

 

 

 

 

 

 

 

 

This feature enables connectivity to external sources, like ADLS Gen2, that are protected by a firewall with no public internet access. By creating a workspace identity and configuring it in the Azure portal, you can use an ARM template to grant this identity access to ADLS Gen2.

 

In the “Resource Instances” section, you can see the configuration details where the instance name includes “Workspace Identity,” indicating which specific workspace has access to the ADLS Gen2 account.

 

 

Conclusion-

 

Thanks for reading the blog!

 

-Manan Choudhary

 

 

Manan Choudhary