DP-600 · Question #153
Your company has a finance department. You have a Fabric tenant, an Azure Storage account named storage1, and a Microsoft Entra group named Group1. Group1 contains the users in the finance…
The correct answer is A. Assign the Contributor role to Group1. B. Create a workspace identity. To ensure finance users can create/edit items and minimize effort, assign the Contributor role to their group; to enable secure workspace access to Azure Storage, create a workspace identity.
Question
Your company has a finance department. You have a Fabric tenant, an Azure Storage account named storage1, and a Microsoft Entra group named Group1. Group1 contains the users in the finance department. You need to create a new workspace named Workspace1 in the tenant. The solution must meet the following requirements:
- Ensure that the finance department users can create and edit items in
Workspace1.
- Ensure that Workspace1 can securely access storage1 to read and write
data.
- Ensure that you are the only admin of Workspace1.
- Minimize administrative effort.
You create Workspace1. Which two actions should you perform next? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Options
- AAssign the Contributor role to Group1.
- BCreate a workspace identity.
- CAssign the Admin role to yourself.
- DAssign the Contributor role to each finance department user.
How the community answered
(56 responses)- A75% (42)
- C18% (10)
- D7% (4)
Why each option
To ensure finance users can create/edit items and minimize effort, assign the Contributor role to their group; to enable secure workspace access to Azure Storage, create a workspace identity.
Assigning the Contributor role to Group1 allows all finance department users within that Microsoft Entra group to create and edit items in Workspace1, satisfying the access requirement while minimizing administrative effort compared to assigning roles individually.
Creating a workspace identity (a managed identity) enables the Fabric workspace to securely authenticate and access the Azure Storage account (storage1) for reading and writing data without requiring credentials in code, which is a best practice for secure access.
When you create a workspace, you are automatically assigned the Admin role, so explicitly assigning it to yourself again is redundant for the requirement to 'ensure' you are the only admin.
Assigning the Contributor role to each finance department user individually would not minimize administrative effort compared to assigning it to their Microsoft Entra group, contradicting a key requirement.
Concept tested: Fabric workspace roles and managed identities
Source: https://learn.microsoft.com/en-us/fabric/governance/workspaces-overview#workspace-roles
Topics
Community Discussion
No community discussion yet for this question.