Workspace roles, XMLA endpoint and monitoring in Fabric
Fabric exam questions often ask who may do what and how to see why something is slow. Learn the role model, the XMLA setting and the two monitoring tools.
Workspace roles
| Role | Can do |
|---|---|
| Admin | Everything, including managing access and deleting the workspace |
| Member | Edit, publish and share items, add people (except Admins) |
| Contributor | Create and edit items, write data; cannot manage access |
| Viewer | View and read items; data access in a warehouse still follows item permissions |
Use security groups for roles, and keep one Admin if the scenario says so. A workspace identity is a service principal for the workspace, used to authenticate to resources such as firewall-protected storage. It is not a user role.
Item-level and data security
Roles apply to the whole workspace. For narrower access, share the item and then secure the data:
- Warehouse: T-SQL
GRANT,DENY, column-level security, row-level security, and dynamic data masking. - Semantic model: row-level security roles and object-level security, plus the Build permission for reuse.
- Lakehouse: OneLake data access roles for folder-level control; the SQL analytics endpoint is read only.
GRANT SELECT ON OBJECT::dbo.Sales TO [user1@contoso.com];XMLA endpoint
Tools like Tabular Editor, SSMS and ALM Toolkit connect to a semantic model through its XMLA endpoint. In the capacity settings, set XMLA Endpoint to Read Write to allow publishing. Read only allows queries.
For unattended access, use a service principal that is allowed in the tenant settings and added to the workspace. Large models deploy and refresh better with the Large semantic model storage format.
Monitoring
| Tool | Use it for |
|---|---|
| Monitoring hub | Status of pipeline, notebook, dataflow and refresh runs |
| Capacity Metrics app | Capacity units used, smoothing, throttling and overload |
DMVs (sys.dm_exec_requests) | Live query detail in a warehouse |
| Query insights views | Long-running and frequent queries in a warehouse |
Throttling happens when consumption exceeds the capacity after smoothing. Only the Capacity Metrics app answers “is the capacity throttling”.
Exam traps
- A workspace role is broad. Fine-grained control on warehouse tables is done with T-SQL permissions.
- Contributor cannot manage access. Member can add users, Contributor cannot.
- Read only XMLA is the default. Publishing needs Read Write.
- Monitoring hub shows runs, not capacity throttling.
- A workspace identity is for outbound authentication, not for giving users access.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A user must read one table in a warehouse and nothing else in the workspace. What is the best first step?
Show answer
Answer: B.Sharing the item gives the connection, then T-SQL GRANT on the table limits access. Workspace roles are too broad.
2. Tabular Editor must publish changes directly to a semantic model in a Fabric workspace. What must be enabled?
Show answer
Answer: C.Writing through the XMLA endpoint needs the capacity setting XMLA Endpoint = Read Write. The default is read only.
3. Warehouse queries slow down several times a day and you suspect capacity throttling. What do you use to confirm it?
Show answer
Answer: B.The Capacity Metrics app shows utilization, smoothing and throttling per capacity. The Monitoring hub shows individual activity runs.
4. Developers must create and edit items but must not manage access, and you want minimal administrative effort. What do you do?
Show answer
Answer: B.Assign roles to a group, not to individuals. Contributor can create and edit items but cannot manage access.