Locking down who can open a single Fabric item

Microsoft Fabric supports item-level access control, allowing permissions to be assigned directly on individual items (such as a lakehouse, warehouse, semantic model, or report) within a workspace, rather than only through broad workspace roles. This enables granular sharing scenarios where a user needs access to a specific item without being granted access to the entire workspace or all its contents.

Must-know

• Item-level permissions are separate from workspace roles (Admin, Member, Contributor, Viewer); a user can have item access without any workspace role.
• Sharing an item (e.g., a lakehouse or report) grants the recipient access only to that item, and you can specify additional granular permissions such as Read, ReadAll, or Build depending on the item type.
• The ReadAll permission on a lakehouse or warehouse grants read access to the underlying data via SQL analytics endpoint and Spark, while Read alone may only allow viewing item metadata without data access.
• Item permissions can be managed via the Manage permissions pane in the Fabric portal, and also programmatically through Fabric REST APIs.
• Granting Build permission on a semantic model allows the recipient to create new reports from it without exposing the report author's other workspace content.
• Item-level access controls work alongside workspace roles and OneLake data access controls, so effective access is the union of workspace role permissions, item-level shares, and any OneLake-level security rules applied to the underlying data.

Coverage checked against the published exam guide on Aug 11, 2026.

These are independent practice questions, written against this certification's published exam guide. They are not the certification vendor's own questions, and not the real exam.