IT Admin Data Architect Platform Owner Data Steward — This page explains the Fabric-native catalog workflow: discovering items, improving governance posture, reviewing access, organizing by domain, and automating metadata discovery.
OneLake Catalog Operating Model
Using Fabric's built-in catalog to find, govern, and secure discoverable Fabric items.
OneLake Catalog is the centralized Fabric experience for discovering and using Fabric items, understanding the governance posture of the data you own, and administering workspace and OneLake security roles. It covers discoverable Fabric items such as lakehouses, warehouses, semantic models, reports, pipelines, and notebooks; an item does not need to represent data physically stored in OneLake to participate in the catalog experience.
Find and evaluate Fabric items without losing the context of the results list.
- Browse and filter accessible items
- Inspect item details, ownership, endorsement, labels, and lineage
- Use domains and item types to narrow discovery
Understand governance posture and take guided actions to improve the data you administer or own.
- Review inventory and governance insights
- Scope insights by ownership or domain
- Follow recommended actions and create custom reports
Review and administer Fabric access from a centralized experience.
- Audit workspace-role assignments
- Review user, group, and application access
- Create and manage OneLake security roles
Catalog metadata helps users evaluate an item and helps administrators manage governance and access. It does not grant access to the underlying item or data. Workspace, item, OneLake, SQL, semantic-model, and engine policies remain the enforcement mechanisms.
OneLake Catalog
Fabric's built-in experience for discovery, governance insights, and centralized security administration.
Open OneLake Catalog from the Fabric navigation pane. The catalog is built into Fabric; implementation work should focus on ownership, domains, metadata, endorsement, delegated administration, and access-review processes rather than treating the catalog as a separate service to deploy.
Explore Tab
The Explore tab provides an items list with an in-context item-details view so users can inspect items without losing their search and filter context. Selectors and filters narrow the list by supported catalog metadata, while domains and the object explorer help users work across organizational and workspace boundaries.
Require meaningful item names, descriptions, owners, endorsement evidence, and sensitivity labels for published content. A catalog can index incomplete metadata, but it cannot make undocumented data trustworthy.
Govern Tab
The Govern tab provides governance insights, recommended actions, learning resources, and reporting for Fabric data. Fabric administrators can review tenant-level metadata across items, workspaces, capacities, and domains. Data owners receive a view scoped to items they own. Domain filtering helps identify where governance debt is concentrated.
Use Govern as an improvement queue: review an insight, identify the responsible owner or domain, complete the supported corrective action in the appropriate Fabric experience, and verify the result after the governance data refreshes. Do not describe every recommendation as an automatic or bulk remediation.
Secure Tab
The Secure tab provides a centralized view of workspace access and OneLake security roles across the workspaces you can administer. The View users experience shows users, groups, applications, and their workspace-role assignments. The View security roles experience lists the OneLake roles defined inside Fabric items.
Admins and Members can add, update, or remove workspace-role assignments in bulk and can create, edit, duplicate, or delete OneLake security roles from the catalog. The Secure tab is the management experience; the underlying object-, row-, and column-level policies are enforced by OneLake Security.
Catalog API
The Catalog Search REST API supports programmatic discovery of catalog metadata across workspaces. Results are filtered to catalog entries the calling principal is authorized to discover. Catalog entries contain metadata and stable identifiers for use with complementary Fabric APIs; they do not grant access to the underlying content.
The Catalog Search API is currently in Preview. Expect the contract to change and avoid taking hard production dependencies on it yet.
POST https://api.fabric.microsoft.com/v1/catalog/search
Authorization: Bearer <token>
Content-Type: application/json
{
"search": "Sales",
"pageSize": 25,
"filter": "Type eq 'Lakehouse'"
}
OneLake Catalog is also embedded in Microsoft Teams, Microsoft Excel, and Microsoft Copilot Studio so users can discover and act on Fabric items from supported application contexts.
Structure discovery around durable business domains such as Finance, Sales, Operations, and HR rather than temporary projects. Assign domain administrators and data stewards who are accountable for workspace organization, metadata, endorsement, and follow-up on Govern recommendations.
Microsoft Purview Integration Boundary
Where enterprise information protection, compliance, audit, and cross-estate context complement Fabric.
Keep OneLake Catalog as the primary operating experience for Fabric. Use Microsoft Purview where the organization needs controls or visibility that extend beyond Fabric, including information protection, DLP, audit, compliance investigation, and cross-system lineage.
🏷️ Information Protection
Define and publish sensitivity labels, configure supported inheritance and export behavior, and use protection policies where label-based item access is required.
📋 DLP, Audit & Compliance
Evaluate supported Fabric activity and items through DLP, audit, compliance, and investigation workflows according to licensing and product scope.
🔗 Cross-System Context
Use Purview when lineage or governance investigation must extend from Fabric into other supported platforms and data sources.
Do not duplicate the OneLake Catalog operating process in Purview. Fabric owners should start with Explore, Govern, and Secure; involve compliance and Purview teams when the requirement crosses platform boundaries or needs enterprise protection and investigation controls.
Choose the Correct Governance Surface
Route each governance task to the Fabric, security, or enterprise-compliance experience that owns it.
Discover Fabric items, inspect metadata and lineage, review governance posture, follow recommended actions, and administer workspace and OneLake roles.
Set tenant guardrails, capacities, domains, delegated settings, workspace assignments, certification reviewers, and organizational boundaries.
Enforce item and data access, configure labels and protection policies, operate DLP and audit controls, and perform cross-estate investigations.
Persona Guide
👨💻 Data Engineer
OneLake Catalog
Find reusable items, inspect owners and lineage, evaluate endorsements and labels, and avoid creating unnecessary duplicate pipelines or datasets.
📊 Data Analyst / BI Developer
OneLake Catalog
Discover promoted, certified, or Master data items and inspect descriptions, lineage, labels, and ownership before building reports.
🛡️ Data Steward
Explore + Govern
Review owned items and domain-scoped insights, coordinate corrective actions, improve descriptions and ownership, and maintain endorsement evidence.
🏗️ Domain Admin / Architect
Domains + Govern
Design domain and workspace boundaries, configure delegated settings, review posture by domain, and ensure ownership remains aligned with the organization.
⚙️ Platform Owner / IT Admin
Govern + Secure
Review tenant-wide governance insights, capacity and domain inventory, workspace assignments, feature usage, and centralized access information.
How the Boundaries Work Together
Connecting Fabric-local catalog operations with delegated administration and enterprise protection.
Fabric administrators establish the baseline. Domain administrators override only delegated settings and organize the workspaces for which they are accountable.
Owners and stewards maintain metadata and endorsement, then use Govern insights to prioritize gaps and Secure to review Fabric access.
Catalog decisions are implemented through workspace and item permissions, OneLake and engine policies, sensitivity labels, DLP, and audit controls.
Sensitivity Labels and Protection
Sensitivity labels are defined through Microsoft Purview Information Protection and used by Fabric. Inheritance is conditional: tenant settings, supported item relationships, user consent, label permissions, and manually applied labels affect the result. Supported exports can retain labels, while DLP and protection policies provide additional controls for supported scenarios.
Lineage Scope
Use Fabric lineage and OneLake Catalog context for impact analysis inside Fabric. Use the organization's Purview integration when lineage investigation must continue into supported systems outside Fabric. Treat these as connected views with different scope, not as a generic two-way metadata synchronization contract.
Governance is a review loop, not automatic policy synchronization: discover the issue, assign an owner, apply the change in the system that controls it, and verify the result through Catalog, security, and audit evidence.
Best Practices
Proven strategies for effective data cataloging and governance in Fabric
🏢 Organize by Business Domain
Structure your catalog around business domains (Finance, Sales, HR, Operations) rather than technology silos. Assign domain owners who are accountable for metadata quality, endorsement decisions, and access governance within their domain. This aligns with data mesh principles and makes discovery intuitive for business users who think in terms of business processes, not infrastructure.
📋 Enforce Metadata Standards
Require meaningful names, descriptions, owners, sensitivity labels, and endorsement evidence for published Fabric items. Review the standard by item type so pipelines, notebooks, semantic models, and reports carry the context their consumers need.
⚖️ Implement Federated Governance
Maintain a tenant-wide baseline of compliance requirements (sensitivity labeling, ownership, minimum metadata). Delegate stricter, domain-specific rules to domain owners who understand their data best. Balance central control (consistency, compliance) with domain autonomy (agility, context). The center defines guardrails; domains operate within them.
📊 Monitor Catalog Health
Review Govern insights and recommended actions on a defined cadence. Scope results by tenant, owner, or domain, assign each issue to an accountable team, and use custom reports when the built-in views do not answer an operational question.
⭐ Use Endorsement Strategically
Promote artifacts that are ready for broader use within a domain. Certify only those meeting rigorous quality criteria — accuracy, freshness, documentation completeness, and owner responsiveness. Define explicit certification criteria and a review process. Endorsement loses value if applied indiscriminately; it should signal genuine trustworthiness.
🔗 Leverage Shortcuts
Use OneLake shortcuts when data can remain at its source and the access, lineage, residency, and operational tradeoffs are understood. Avoid unmanaged copies that create competing ownership, freshness, and access-control responsibilities.
🔄 Automate Lifecycle Operations
Treat Fabric artifacts as code using Git integration and CI/CD deployment pipelines. Version pipelines, notebooks, semantic models, and reports. Maintain a full audit trail for all changes — who changed what, when, and why. Automation reduces human error and ensures governance processes are repeatable and auditable.
🚀 Plan Phased Adoption
Start with high-value pilot workloads — datasets that are widely used, business-critical, or subject to regulatory requirements. Demonstrate value with a single domain before scaling. Roll out domain by domain, incorporating lessons learned. Continuously refine governance processes based on feedback from data producers and consumers.
Implementation Checklist
A phased approach to implementing catalog and governance in your Fabric tenant
Implementing data cataloging and governance is a journey, not a one-time project. The following phased checklist provides a structured path from initial setup to mature, organization-wide governance. Each phase builds on the previous one — complete the foundation before advancing to classification and policy enforcement.
Phase 1: Foundation
- Confirm administrators, domain teams, owners, and consumers can access the appropriate OneLake Catalog experiences
- Define and configure business domains (align with organizational structure)
- Assign domain administrators, domain contributors, data stewards, and item owners with explicit responsibilities
- Set baseline metadata requirements for published items: owner, description, domain, sensitivity label, and support contact where applicable
- Establish naming conventions for workspaces, lakehouses, and data items
- Document how users request access and how owners respond
Phase 2: Classification & Labeling
- Configure sensitivity labels aligned with your organization's data classification policy
- Configure downstream inheritance, default labeling, and exception handling for supported Fabric items
- Evaluate protection policies and DLP for the supported high-risk scenarios that require them
- Define ownership and approval rules for changing or removing labels
- Train data producers on labeling responsibilities and classification criteria
Phase 3: Trust & Access Review
- Define eligibility, evidence, reviewers, and recertification rules for Promoted, Certified, and Master data endorsements
- Review OneLake Catalog Govern insights and assign recommended actions to accountable teams
- Use Secure to review workspace assignments and OneLake security roles across administered workspaces
- Validate effective access through each user query path, not only workspace membership
- Create a governance council or review forum with representatives from the major business domains
Phase 4: Scale & Optimize
- Roll out governance domain by domain, starting with highest-value areas
- Use the Catalog Search API for metadata discovery automation while it remains Preview
- Create custom Govern reports where operational questions require more detail
- Measure discovery success, ownership coverage, action closure, endorsement freshness, and access-review completion
- Implement Git-based version control for all Fabric artifacts
- Establish continuous improvement cycles — review governance effectiveness quarterly
- Automate metadata checks and deployment quality gates for critical production workspaces
Don't try to govern everything at once. Start with your highest-value, most-used datasets and expand incrementally. Overly ambitious governance programs create friction without delivering value. Begin with a narrow scope, demonstrate ROI, build organizational buy-in, and then expand. The goal is sustainable governance, not comprehensive documentation that nobody maintains.