Microsoft Fabric Security Review
Microsoft Fabric puts every workload behind OneLake, but a shortcut or a shared item can reach that data under a different identity. We test workspace roles, OneLake access and warehouse security together. CREST-certified testers, fixed price from £3,460 for a 3-day single-tenant scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
A shortcut to external storage does not inherit the identity of the person who opens it: whether it reads as a service principal, a workspace identity or an account key depends on how it was built, not on who clicks the link.
OneLake puts every workload on one lake, but roles and shortcuts decide who actually reaches it
Every Fabric workload, whether it’s a lakehouse, a warehouse, a KQL database or a Power BI semantic model, stores its data in OneLake, one logical data lake shared across the tenant. That single storage layer is convenient to build on, but it means access has to be checked in two separate places: the control plane, which is workspace roles and item permissions deciding who can manage an item, and the data plane, which is OneLake security deciding who can actually read or write what’s inside it.
The four workspace roles do not all reach data the same way. Admin, Member and Contributor already have read and write access to everything in a workspace, so a OneLake security role only changes what a Viewer, or someone given item-level Read permission through sharing, can actually see. Every lakehouse also ships with a DefaultReader role that, by default, hands data access to anyone who already holds ReadAll permission on the item, and it stays active until someone edits or deletes it. We test what the roles, the item shares and the DefaultReader role add up to, the same way we test Dataverse security roles on a Power Apps environment.
Shortcuts complicate the picture further. A shortcut inside your own OneLake defaults to passthrough authentication, reading with the identity of whoever opens it, so their own permissions on the target still apply. A shortcut to external storage such as Amazon S3, Google Cloud Storage or Azure Data Lake Storage always uses delegated authentication instead, reading through a fixed identity set when the shortcut was created rather than the identity of whoever is browsing it. We test what that fixed identity can actually reach, just as we test the storage credentials behind a Databricks workspace.
SCOPE
What we review in a Microsoft Fabric tenant
Workspace roles: Admin, Member, Contributor and Viewer
Every Fabric workspace runs on four roles, and they are not evenly spaced: Admin and Member can both add other people and let them reshare items, while only Admin can add another Admin, update or delete the workspace, or create a workspace identity. Contributor can create and edit most items but cannot add people to the workspace, and Viewer can read most item types and query data through the SQL analytics endpoint, but cannot read Lakehouse or Warehouse data through OneLake APIs and Spark unless a further OneLake security role grants it. We test who actually holds each role against who was meant to, and whether a Contributor or Viewer has picked up capability the role table does not grant by default.
Item permissions and sharing outside the workspace role
Sharing a single lakehouse, warehouse or other item through its Manage permissions page grants access to that one item without adding the recipient to the workspace at all, which is exactly how you would bring in a colleague who only needs one dataset. That path grants specific permissions on the item rather than the broader access a workspace role carries, but it is set and reviewed separately from the workspace role list, so the two are easy to lose track of against each other. We test what every item-level share actually grants against what the workspace role list shows.
OneLake data access roles
OneLake security roles are the data-plane layer underneath workspace roles: each one grants Read or ReadWrite on specific tables, folders or schemas to named Microsoft Entra users, groups or other identities. They only change what a Viewer, or someone with item-level Read permission, can see, because Admins, Members and Contributors already have read and write access to every item in the workspace regardless of any role defined on top. Every lakehouse also ships with a DefaultReader role that, by default, hands data access to anyone who already holds ReadAll permission on the item, and it stays active until it is edited or deleted. We test the OneLake security roles actually defined against the DefaultReader role nobody remembered was still there.
OneLake shortcuts: whose identity actually reads the data
A shortcut to another location inside your own OneLake defaults to passthrough authentication, meaning it reads using the identity of whoever opens it, so their own permissions on the target still apply. A shortcut to external storage such as Amazon S3, Google Cloud Storage or Azure Data Lake Storage always uses delegated authentication instead, reading through a fixed intermediate credential set when the shortcut was created, such as another user’s identity, a service principal, a workspace identity or an account key, rather than the identity of whoever is actually browsing it. We map every shortcut in scope, internal and external, and test what its actual reading identity can reach.
SQL analytics endpoint and Warehouse permissions
Every Warehouse and SQL analytics endpoint starts from the access its workspace role or item permission already grants, and from there you can layer standard GRANT, REVOKE and DENY statements in T-SQL, assigned to custom or built-in database roles, for finer control down to individual objects. You cannot run CREATE USER directly against a Fabric warehouse; issuing a GRANT or DENY creates the database user automatically, though that user still cannot connect until it also has sufficient workspace-level rights. We test the granular SQL permissions actually applied against the workspace role or item permission sitting underneath them, since either layer overriding the other in the wrong direction is the gap that matters.
Row-level and column-level security on the Warehouse
Row-level security on a Warehouse or SQL analytics endpoint is predicate-based: a security policy invokes an inline table-valued function that silently filters which rows a SELECT, DELETE or UPDATE can see, and a table with no policy defined of its own returns unfiltered data to anyone who can query it. Column-level security works differently, restricting named columns to named roles with a GRANT statement, and it only works with Microsoft Entra authentication, not SQL authentication. We test both together: which tables actually carry a predicate, which columns are actually restricted, and whether a join or a function call still gets around either one.
Connections and gateways: where credentials are stored
A cloud connection or an on-premises data gateway holds the credential a Fabric item authenticates with, and by default any user can share a connection with a colleague; a tenant admin can turn on Blocking shareable cloud connections to stop that, with an allowlist for anyone who still needs to share. Credentials entered for a gateway data source are encrypted with symmetric encryption by the cloud service so they cannot be decrypted in the cloud, then decrypted only on the machine running the gateway, and cached there for a few hours to speed up refreshes. We test who holds and can share each connection in scope, and how a credential change or a compromised gateway machine would actually propagate.
Tenant settings: export, external sharing and guest access
Tenant settings decide whether external data sharing is allowed at all, letting a user hand a read-only OneLake link to someone outside the organisation, whether the tenant accepts an equivalent link shared in from outside, and whether guest users already added to your Microsoft Entra directory can reach Fabric and the items they have permission to. Each setting can be enabled for the whole organisation, disabled entirely, or enabled for everyone except specific security groups. Microsoft’s own guidance is explicit that these are governance controls, not a security boundary: turning off the Export data setting does not stop a user with read access to a semantic model querying it and persisting the results another way. We test what each setting actually allows, and treat the underlying item and OneLake permissions, not the tenant setting, as the real control.
Capacity and workspace separation
Every Microsoft Entra tenant with Fabric gets one shared capacity that hosts every personal My workspace by default, alongside any workspace still using a Power BI Pro or Premium Per User licence, and a workspace only moves off it when someone explicitly assigns it to a dedicated capacity. Nothing stops a business-critical workspace being built and left on the shared capacity, or a workspace meant for one environment being assigned to the wrong capacity later. We test what has actually landed on the shared capacity against what your intended dev, test and production split assumes.
Sensitivity labels and where they actually still apply
A sensitivity label from Microsoft Purview Information Protection can be applied to a Fabric item to mark and, where configured, restrict it, but that label-based access control is only enforced inside the tenant where the label was applied, in Power BI Desktop files, and in Excel, PowerPoint or PDF files produced through supported export paths. It is not enforced in a cross-tenant scenario such as external data sharing, or in most other export formats such as CSV. We check what a labelled item’s protection actually still does once the data leaves the workspace or the tenant boundary the label assumed it would stay inside.
OUR PROCESS
Microsoft Fabric Security Review: From Scope to Attestation
Tenant, Workspace and Capacity Mapping
We agree which workspaces, capacities and OneLake items are in scope, plus the role accounts, connections and gateways we need visibility into for each one.
Role, Permission and OneLake Security Testing
We test workspace roles, item-level sharing and OneLake security roles under every tier in scope, including what the DefaultReader role and any Viewer access actually grant.
Shortcut, Warehouse and Connection Testing
A CREST-certified tester tests every OneLake shortcut’s authentication model, Warehouse and SQL analytics endpoint permissions including row and column-level security, and the connections and gateways credentials depend on.
Reporting and Retest
You get a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Fabric pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Microsoft Fabric Security Review Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
3 to 4 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote6 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Fabric For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Microsoft Fabric Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Fabric tenant?
At minimum, one login for each workspace role you want tested, Admin, Member, Contributor and Viewer, across the workspaces in scope. Where OneLake shortcuts, gateways or external connections are in scope, read access to the shortcut and connection configuration speeds up confirming what we find, though it is not required to start.
Will testing touch live data?
We test read-only against production by default. Where proving a write, update or delete needs real records, or testing a shortcut’s identity means writing to a target, we agree a sandbox workspace or specific test data with you first, and anything we create during testing is documented and removed afterwards.
Is this hosted on our infrastructure or Microsoft’s?
Microsoft Fabric, OneLake and the capacity behind them run entirely on Microsoft’s infrastructure, so there is nothing for you to host. The test is scoped to your workspace roles, item permissions, OneLake security roles, shortcuts, warehouse permissions, connections and tenant settings, not to Microsoft’s platform itself.
Does this cover Power BI reports and semantic models too?
Only lightly. Power BI’s own report, dataset and semantic model security, including workspace apps and row-level security defined inside a semantic model, is covered on our Power BI security review page. This page is scoped to the Fabric workspace, OneLake and the data items underneath it.
What is out of scope?
Microsoft’s own infrastructure and multi-tenant hosting, other tenants’ workspaces, denial-of-service testing, and Power BI report or semantic-model-level security, which sits on its own page, are all out of scope here.
Is penetration testing our own Fabric tenant allowed under Microsoft’s rules?
Yes. Microsoft’s penetration testing rules of engagement for its cloud services permit testing your own tenant and the assets you’re authorised for, provided you don’t access data or systems you don’t own, don’t use credentials that aren’t yours, and don’t disrupt the service for other tenants, and we test inside those rules.
How long does a Fabric tenant test take?
A single-tenant engagement covering a handful of workspaces, their roles and the OneLake, warehouse and shortcut configuration behind them typically runs to a 3-day scope. More workspaces, capacities, external shortcuts or connections extend it, and we confirm the exact day count once we’ve seen the tenant.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Fabric tenant
Microsoft Fabric puts every workload behind OneLake, but a shortcut or a shared item can reach that data under a different identity. We test workspace roles, OneLake access and warehouse security together. CREST-certified testers, fixed price from £3,460 for a 3-day single-tenant scope, quoted within 24 hours.
