CertifyDeckCargando contenido…
The official Microsoft Certified: Fabric Data Engineer Associate syllabus, organized by domain. Check off each point as you review it.
Inicia sesión para guardar tu progreso entre sesiones.
Configure Microsoft Fabric workspace settings
Workspace admins choose the default pool (starter or custom), a default environment with runtime and libraries, and job admission: optimistic by default or reserving maximum cores. They also set the session timeout, a maximum job lifetime that only cancels user-submitted jobs, and high concurrency, which shares sessions for the same user.
Data Engineering workspace administration settings in Microsoft Fabric ↗Configure high concurrency mode for Fabric notebooks ↗
A domain groups workspaces by business area; when a workspace is assigned, all its items inherit the domain, but access still depends on roles and permissions. Domain contributors must be workspace admins and assign the workspace from its settings. A default domain assigns the unassigned workspaces of specified users and those they create later, without changing existing assignments.
The OneLake tab of the workspace settings turns on shortcut caching, which stores files read from S3, GCS or gateway shortcuts to reduce egress, with a configurable retention and a reset option. It also enables OneLake diagnostics, which writes data access events as JSON to a lakehouse on the same capacity and can be made immutable.
Workspace settings define the default Apache Airflow runtime. The starter pool starts instantly and is deprovisioned when unused, suited to development; a custom pool is always on until paused, with Large or Small node size, autoscale and extra nodes for more concurrent DAGs. If compute customization for items is turned off, the starter pool is used.
Implement lifecycle management in Fabric
Git integration works per workspace, connected to one branch and folder in Azure DevOps or GitHub. Only the admin connects or disconnects; contributors commit and update, and the admin can let them switch branches. Update always brings the whole branch, and commits are blocked while incoming changes exist. Each developer should work in a branched workspace.
Basic concepts in Git integration ↗Get started with Git integration ↗
SDK-style database projects store the schema as .sql files, build into a .dacpac and publish with DacFx or SqlPackage; generate the script before publishing and use BlockOnPossibleDataLoss in production. For a Git-connected SQL database in Fabric, Fabric maintains the project file, each update builds and publishes, and post-deployment scripts manage static data.
Develop warehouse projects in Visual Studio Code ↗SQL database source control integration in Microsoft Fabric ↗
A deployment pipeline assigns one workspace per stage and copies metadata, not data, between stages. Paired items are overwritten keeping their ID and URL; unpaired items are duplicated. Rules (data source, parameter, or default lakehouse for notebooks) are defined in the target stage. Deploying requires pipeline admin plus Contributor in both workspaces.
Configure security and governance
Workspace roles (Admin, Member, Contributor and Viewer) are assigned to users or groups and apply to all items; with several groups the highest permission wins. Only Admin deletes the workspace or adds admins; Member adds lower roles; Contributor writes items and reads data through Spark; Viewer only reads through T-SQL unless a OneLake security role grants more.
Roles in workspaces in Microsoft Fabric ↗Data security in OneLake ↗
Besides workspace roles, you can share a single item: sharing always grants Read, which lets the recipient discover and open the item and connect to the SQL endpoint, and you can add ReadData (T-SQL queries), ReadAll (Spark and OneLake), Edit or Share. Item permissions and workspace roles are evaluated separately, so removing one doesn't remove the other.
In the warehouse and SQL endpoint, object-level security uses GRANT, REVOKE and DENY; column-level security uses a GRANT SELECT that lists columns; and row-level security uses CREATE SECURITY POLICY with an inline function as filter predicate. In OneLake, security roles grant access to folders and tables: permissions inherit downward and users can traverse parent folders without seeing siblings.
Secure your Fabric Data Warehouse ↗How OneLake security controls data access ↗
Dynamic data masking hides values in query results without changing stored data; it is defined with MASKED WITH and the default(), email(), random() and partial() functions. Users with UNMASK or CONTROL, including the Admin, Member and Contributor roles, see real data. It doesn't stop inference through filters, so combine it with column-level or row-level security.
Microsoft Purview sensitivity labels are applied to any Fabric item from its header or settings, with edit permissions on the item. They propagate through inheritance upon creation (for example, from a lakehouse to a notebook) and downstream inheritance, which never overwrites manual labels. Tied to protection policies, they block access for anyone not listed in the policy.
Information protection in Microsoft Fabric ↗Protection policies in Microsoft Fabric ↗
Endorsement helps people find trustworthy content through three badges: Promoted, which any user with write permissions can apply; Certified, reserved for reviewers authorized by the Fabric administrator; and Master data, also restricted and only for items that contain data, such as lakehouses or semantic models. Power BI dashboards can't be endorsed.
Fabric user activities, such as sharing items or changing security roles, are searched in the audit log of the Microsoft Purview portal, which requires the Audit Logs role in Exchange Online. OneLake data-plane access is covered by OneLake diagnostics, and warehouses have their own SQL audit logs, read with sys.fn_get_audit_file_v2.
Track user activities in Microsoft Fabric ↗How to configure SQL audit logs ↗
OneLake security defines grant roles (Read or ReadWrite) on tables, folders and schemas, with optional row-level and column-level security, enforced across Fabric engines. It only restricts Viewers and users with Read; Admins, Members and Contributors already access everything. Roles combine as a union, the DefaultReader role gives access to ReadAll holders, and there are no Deny roles.
Data security in OneLake ↗How OneLake security controls data access ↗
Orchestrate processes
Dataflow Gen2 is the low-code Power Query option for preparing and transforming data; a pipeline Copy activity moves large volumes without code; and a notebook runs Spark code with open-source libraries for complex transformations. Pipelines also orchestrate dataflows and notebooks with schedules, loops, conditions and failure paths.
Microsoft Fabric decision guide: copy activity, Copy job, dataflow, Eventstream, or Spark ↗Activity overview ↗
A pipeline starts on demand, from schedules (several per pipeline, each with a frequency and a required start and end) or from event triggers on file, job or workspace events, which rely on Eventstream and Activator. Job events such as ItemJobSucceeded chain items without a central orchestrator. A scheduled notebook runs under the identity of whoever created or last updated the schedule.
Run, schedule, or use events to trigger a pipeline ↗Tutorial: Orchestrate Fabric jobs with Job events ↗
The Notebook activity passes base parameters that override the values in the notebook's parameters cell. notebookutils.notebook.run runs a child notebook and returns its exit value, always as a string; runMultiple runs several in parallel with a DAG of dependencies. In expressions, @{ } interpolates inside text and always returns a string, and @item() gives the current ForEach element.
NotebookUtils notebook run and orchestration for Fabric ↗Parameters ↗