Microsoft Fabric Architecture Podcast30 Okt

A Label Is Not a Lock

A Label Is Not a Lock

Episode 43 • 2026-10-30 Duration: 9:02

A sensitivity label says Highly Confidential in the header, but inside Fabric it never decides who opens the item. This episode traces where labels actually control access and where the appearance of a lock is just a sign.

What we discuss

The pattern we keep seeing in the field
How it actually works underneath the abstraction
Where the obvious answer breaks
A real Reddit/Microsoft Q&A question unpacked
F-SKU realism — what this actually costs
When the rejected approach is actually right
The concrete recommended architecture
Risks of the recommended path
The architectural principle to take home

Key takeaways

Right now, somewhere, there's a lakehouse with Highly Confidential in the header.
Show me the query pattern. If the pattern is "restrict who opens this," design the workspace. If the pattern is "protect what leaves," design the label. Conflating them is where every thread on that forum starts.
And the protection policy sits in between.

From the video

Demo 1: The Label Changed Nothing
Architecture film: Two questions two mechanisms
Architecture film: Eight routes onto an item
Architecture film: Where protection starts
Architecture film: Where label and permission meet

Resources

About the show

AI-generated voices. Matthias — cloned voice. Fabia — designed AI co-host. See Matthias live on YouTube (Fabric Friday), at his meetups, and at conferences like FabCon.

Hosted by Matthias Falland — Microsoft Data Platform MVP and community architect behind the Fabric Periodic Table. New episodes every Friday.

Submit your case

Have an architecture decision you are wrestling with? DM Matthias on LinkedIn — find him as Matthias Falland. Three to five sentences about the decision, your team size, and your current stack. We anonymize before airing.

This podcast was generated by AI. Both voices are synthetic: Matthias is a cloned voice, Fabia is a designed AI co-host.

Brand design based on fabricperiodictable.com.

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(43)

Five Thousand Files From a Blank Report

Five Thousand Files From a Blank Report Episode 42 • 2026-10-23 Duration: 10:17 Medallion is the recommended design approach for Fabric. It's also one building block out of five, and the one that send...

23 Okt 10min

Five Doors and One Credential

Five Doors and One Credential Episode 41 • 2026-09-18 Duration: 8:45 Databricks and Fabric have five integration paths, not one. Each moves data. None moves permissions. We pull apart the one-credenti...

22 Okt 8min

Throttled by Yesterday's Refresh

Throttled by Yesterday's Refresh Episode 37 • 2026-10-16 Duration: 9:21 Fabric doesn't charge you when work happens — it spreads the cost forward into 2,880 thirty-second timepoints. That one sentence...

16 Okt 9min

Your Domain Isn't a Wall

Your Domain Isn't a Wall Episode 38 • 2026-10-09 Duration: 8:43 Fabric domains look like governance boundaries but the documentation says otherwise. We unpack what a domain actually gives you, the def...

9 Okt 8min

Where Do the Columns Come From?

Where Do the Columns Come From? Episode 40 • 2026-09-25 Duration: 9:19 Cosmos DB has no schema. Delta tables need one. When mirroring bridges the two, the replicator guesses — and the guess only ever ...

6 Okt 9min

The Permission Split Inside Read-Only

The Permission Split Inside Read-Only Episode 36 • 2026-10-02 Duration: 8:03 A workspace carries four boundaries — security, cost, region, lifecycle — and you configured one of them. This episode pull...

4 Sep 8min

The Snapshot Locked in a Room

The Snapshot Locked in a Room Episode 35 • 2026-08-28 Duration: 8:42 Graph in Fabric materializes a second copy of your data for traversal. That copy explains the staleness, the rebuild cycle, and the...

28 Aug 8min