Governance (Microsoft Purview)
The optional governance tier adds a Microsoft Purview account to the shared subscription, next to the Fabric capacities. It
gives data discovery, classification and lineage across the Fabric workspaces. This page is for the platform team and for data
teams that use the catalog.
What it deploys
| Resource |
Notes |
| Resource group |
rg-<workload>-<env>-<region>-governance, with the environment shared |
| Purview account |
pview-<workload>-<env>-<region>, system-assigned managed identity |
| Diagnostic setting |
Logs ScanStatusLogEvent and DataSensitivityLogEvent, and all metrics, to the spoke Log Analytics workspace |
| Role assignments |
See below |
| Private endpoints (optional) |
Two: account and portal sub-resources, in the private endpoint subnet |
Fabric discovery, classification and lineage
- Discovery. Fabric workspaces are registered automatically through the built-in Microsoft 365 tenant integration. After the
Purview account is deployed and the tenant-level connection is activated, all workspaces appear in the Purview Data Catalog
under Data Map, Data Catalog, Microsoft Fabric. No manual source registration is needed for Fabric-native items.
- Classification. Purview scans Lakehouses and Warehouses and classifies the assets with built-in and custom rules.
- Lineage. Lineage is captured across Fabric pipelines, from source to consumption.
Access
| Principal |
Access |
| Purview managed identity |
Storage Blob Data Reader on the storage account of the spoke, so that it can scan |
| Deploying principal |
Contributor on the Purview account (defaults to the current caller) |
Data team group (optional, data_team_group_id) |
Reader on the Purview account, to browse the catalog |
Network access
public_network_enabled |
Behaviour |
true (default) |
The portal and API are reachable from the internet. The data team can use the portal from a laptop without VPN. |
false |
Private endpoints for the account and the portal are created. vnet_name and snet_pe_name must be set in the spoke configuration. VPN or ExpressRoute access is needed. |
Deploy
The governance tier is its own Terraform root (infra/deploy/governance). Deploy it after the shared tier, and before or
alongside the workload tier. Its only hard dependencies are the Log Analytics workspace and the storage account of the spoke.
cd infra/deploy/governance
terraform init
terraform plan -var-file="<governance>.tfvars"
terraform apply -var-file="<governance>.tfvars"
In a pipeline setup the same root is run by the pipeline of your configuration repository.
Variables
| Variable |
Purpose |
location, environment, workload_name |
As for the other tiers. The environment shared is expected. |
spoke_config |
Subscription, resource group, Log Analytics name, storage account name, and for private mode the VNet and subnet names |
deployer_principal_id |
Principal that gets Contributor. Defaults to the caller. |
data_team_group_id |
Optional Reader group |
public_network_enabled |
See above |