Microsoft Fabric · Governance Domains
Domain Admin
Full administration of a Fabric governance domain. Assign workspaces to the domain, configure domain settings, manage domain contributors, and govern the data products published into the domain.
Scope: Single Fabric governance domain (a logical grouping of workspaces, typically by business function)
Permissions
- Domain settings - Configure domain name, description, image, contributors
- Workspace assignment - Add or remove workspaces from the domain
- Subdomain management - Create and manage subdomains
- Delegated tenant settings - Override certain tenant settings within the domain (when delegated by Fabric Administrator)
- Domain default workspace - Set the default workspace for domain content
Common use cases
- Business unit data lead governing their unit's Fabric workspaces
- Decentralised data mesh implementations (domain per data product team)
- Federated governance model where tenant Fabric Admin delegates per-domain ops
Best practices
- Use security groups for Domain Admin assignment
- Pair with Purview Data Governance roles when data products in the domain are catalogued in Purview
- Document domain scope and ownership in the CoE inventory
Security considerations
- Domain Admin can grant Domain Contributor to others
- Workspace-level RBAC still applies inside domain workspaces
Common questions
When should I assign the Domain Admin role?
Assign Domain Admin when you need to: Business unit data lead governing their unit's Fabric workspaces; Decentralised data mesh implementations (domain per data product team); and Federated governance model where tenant Fabric Admin delegates per-domain ops. It is part of Microsoft Fabric and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Domain Admin role do?
The Domain Admin role grants permissions including: Domain settings - Configure domain name, description, image, contributors; Workspace assignment - Add or remove workspaces from the domain; Subdomain management - Create and manage subdomains; Delegated tenant settings - Override certain tenant settings within the domain (when delegated by Fabric Administrator); and Domain default workspace - Set the default workspace for domain content. See the Permissions section above for the full list.
What are the security risks of the Domain Admin role?
Key considerations when assigning Domain Admin: Domain Admin can grant Domain Contributor to others; and Workspace-level RBAC still applies inside domain workspaces. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.