Workspace Network Policy and Outbound Access Protection¶
This runbook documents how the platform sets the Fabric workspace network communication policy, the known limits of the Fabric API, and how the deployment scripts handle them. It is for the platform team.
Background¶
The fabric-workspace and fabric-connections Terraform modules call the Fabric networking/communicationPolicy API family
through PowerShell scripts (local-exec provisioners). The scripts use the Azure CLI session of the pipeline to get a token
for the Fabric API.
| Script | API endpoint (under /v1/workspaces/{id}) |
Purpose |
|---|---|---|
set_workspace_network_policy.ps1 |
PUT .../networking/communicationPolicy |
Sets the inbound and outbound publicAccessRules.defaultAction. Outbound Deny is outbound access protection (OAP). |
set_workspace_git_outbound_policy.ps1 |
PUT .../communicationPolicy/outbound/git |
Allows Git when OAP is on (Git is blocked by default under OAP) |
set_workspace_gateway_rules.ps1 |
PUT .../communicationPolicy/outbound/gateways |
Restricts which gateways the workspace may use: default Deny, only the environment gateway allowed |
set_workspace_cloud_connections.ps1 |
PUT .../communicationPolicy/outbound/connections |
Sets the allow-list of outbound cloud connections (LakeHouse, Warehouse, Power BI semantic models) |
The outbound_network_policy_enabled flag¶
A per-workspace setting in the configuration. The semantics are inverted:
| Value | Outbound default action | Result |
|---|---|---|
false (default) |
Deny |
OAP enabled. Deny by default, the allow-list is enforced. |
true |
Allow |
OAP disabled. Outbound public access is open. |
The solution documentation describes outbound as blocked by default. In the code the default of the flag is false, so a
workspace without the setting is protected. The solution's reference configuration sets true for engineering and
development workspaces and keeps false for reporting workspaces. Decide per workspace and write the reason on the ticket.
Inbound
The script is called with an inbound default action of Allow, and every workspace also gets a private endpoint. If your
security design requires that the public inbound path is closed, check the inbound setting in your deployment and in the
Fabric tenant settings. The service description describes inbound access as private-endpoint only.
Known limits and how the scripts handle them¶
Network policy needs a larger capacity SKU¶
Workspace-level network communication policies are not available on every capacity SKU. On small F SKUs the API returns
403 Forbidden (the script comments name F64 or higher). set_workspace_network_policy.ps1 treats the 403 as a graceful
skip: it logs a warning and exits with success. The workspace then still benefits from the private link and the gateway
configuration, but not from the workspace-level rules. Plan a larger SKU when the policy must be enforced.
Outbound connection rules return 403 when OAP is off¶
Fabric only enforces the outbound connection rules when the outbound default action is Deny. For a workspace with
outbound_network_policy_enabled = true the call to .../outbound/connections returns 403 Forbidden. The rules were never
enforceable on such a workspace, so the call is a no-op by design. set_workspace_cloud_connections.ps1 treats the 403 as a
graceful skip (warning, exit code 0). To enforce the rules, set the flag to false.
This was seen in the field: terraform apply failed with 403 on terraform_data.workspace_cloud_connections for all
workspaces with the flag true, while workspaces with false succeeded. Existing workspaces looked unaffected only because
their triggers had not changed, so the script did not run again.
Error signature:
Failed to update workspace outbound connection policy: Response status code does not indicate success: 403 (Forbidden).
If this appears as a hard failure, the module version predates the graceful 403 handling: upgrade to a release that contains it.
Tenant setting¶
The Fabric tenant setting Configure workspace-level outbound network rules (Fabric admin portal, Tenant settings) must be enabled by a Fabric administrator before OAP can be configured. See Prerequisites.
Git under OAP¶
With OAP on (flag false), Git is blocked. The workspace_git_outbound_policy resource allows it, only when a Git link is
configured. See Connectivity.
Related¶
- Architecture
- Connectivity
- Microsoft Learn: workspace outbound access protection (overview and setup), and the Fabric REST API Set Network Communication Policy and Set Outbound Cloud Connection Rules