Microsoft Fabric Architecture Podcast14 Aug

When Save Grants Permissions You Can't Revoke

When Save Grants Permissions You Can't Revoke

Episode 33 • 2026-08-14 Duration: 8:26

An org app is a Fabric item that manages permissions on other items. We pull apart what it actually propagates, where the abstraction stops, and why some grants outlive the authority that created them.

What we discuss

How it actually works underneath the abstraction
The pattern we keep seeing in the field
Where the obvious answer breaks
A real Reddit/Microsoft Q&A question unpacked
Risks of the recommended path
F-SKU realism — what this actually costs
When the rejected approach is actually right
The concrete recommended architecture
The architectural principle to take home

Key takeaways

Somewhere right now there's a semantic model in workspace B with a permission entry that nobody in workspace A can remove.
The sentence to say before you build one: the org app handles THESE permissions.
An org app is an item that manages permissions on other items.

From the video

Architecture film: An item not a publication
Architecture film: Propagation tree
Demo 2: Grant, Inspect, Revoke
Architecture film: The hidden content switch

Resources

About the show

AI-generated voices. Matthias — cloned voice. Fabia — designed AI co-host. See Matthias live on YouTube (Fabric Friday), at his meetups, and at conferences like FabCon.

Hosted by Matthias Falland — Microsoft Data Platform MVP and community architect behind the Fabric Periodic Table. New episodes every Friday.

Submit your case

Have an architecture decision you are wrestling with? DM Matthias on LinkedIn — find him as Matthias Falland. Three to five sentences about the decision, your team size, and your current stack. We anonymize before airing.

This podcast was generated by AI. Both voices are synthetic: Matthias is a cloned voice, Fabia is a designed AI co-host.

Brand design based on fabricperiodictable.com.

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(43)

A Label Is Not a Lock

A Label Is Not a Lock Episode 43 • 2026-10-30 Duration: 9:02 A sensitivity label says Highly Confidential in the header, but inside Fabric it never decides who opens the item. This episode traces wher...

30 Okt 9min

Five Thousand Files From a Blank Report

Five Thousand Files From a Blank Report Episode 42 • 2026-10-23 Duration: 10:17 Medallion is the recommended design approach for Fabric. It's also one building block out of five, and the one that send...

23 Okt 10min

Five Doors and One Credential

Five Doors and One Credential Episode 41 • 2026-09-18 Duration: 8:45 Databricks and Fabric have five integration paths, not one. Each moves data. None moves permissions. We pull apart the one-credenti...

22 Okt 8min

Throttled by Yesterday's Refresh

Throttled by Yesterday's Refresh Episode 37 • 2026-10-16 Duration: 9:21 Fabric doesn't charge you when work happens — it spreads the cost forward into 2,880 thirty-second timepoints. That one sentence...

16 Okt 9min

Your Domain Isn't a Wall

Your Domain Isn't a Wall Episode 38 • 2026-10-09 Duration: 8:43 Fabric domains look like governance boundaries but the documentation says otherwise. We unpack what a domain actually gives you, the def...

9 Okt 8min

Where Do the Columns Come From?

Where Do the Columns Come From? Episode 40 • 2026-09-25 Duration: 9:19 Cosmos DB has no schema. Delta tables need one. When mirroring bridges the two, the replicator guesses — and the guess only ever ...

6 Okt 9min

The Permission Split Inside Read-Only

The Permission Split Inside Read-Only Episode 36 • 2026-10-02 Duration: 8:03 A workspace carries four boundaries — security, cost, region, lifecycle — and you configured one of them. This episode pull...

4 Sep 8min

The Snapshot Locked in a Room

The Snapshot Locked in a Room Episode 35 • 2026-08-28 Duration: 8:42 Graph in Fabric materializes a second copy of your data for traversal. That copy explains the staleness, the rebuild cycle, and the...

28 Aug 8min