Skip to content

Commit 1e046c0

Browse files
brown9804brown9804
authored
Merge pull request #19 from MicrosoftCloudEssentials-LearningHub/purview-bestpractices
Purview Best Practices
2 parents 538c3ca + 1850f00 commit 1e046c0

File tree

1 file changed

+142
-1
lines changed

1 file changed

+142
-1
lines changed

‎Workloads-Specific/Purview/BestPractices.md‎

Lines changed: 142 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,156 @@ Costa Rica
66
[![GitHub](https://img.shields.io/badge/--181717?logo=github&logoColor=ffffff)](https://github.com/)
77
[brown9804](https://github.com/brown9804)
88

9-
Last updated: 2025-05-03
9+
Last updated: 2025-05-05
1010

1111
----------
1212

13+
> Use the Purview hub in Fabric to monitor sensitivity labels, DLP activity, and data access. Regularly review audit logs to detect anomalies and ensure compliance with internal and external regulations.
14+
1315
<details>
1416
<summary><b>List of References</b> (Click to expand)</summary>
1517

18+
- [Use Microsoft Purview to govern Microsoft Fabric](https://learn.microsoft.com/en-us/fabric/governance/microsoft-purview-fabric)
19+
- [Governance overview and guidance](https://learn.microsoft.com/en-us/fabric/governance/governance-compliance-overview)
20+
- [Metadata scanning overview](https://learn.microsoft.com/en-us/fabric/governance/metadata-scanning-overview)
21+
- [Get started with sensitivity labels](https://learn.microsoft.com/en-us/purview/get-started-with-sensitivity-labels)
22+
23+
</details>
24+
25+
<details>
26+
<summary><b>Table of Content</b> (Click to expand)</summary>
27+
28+
- [Unified Data Catalog](#unified-data-catalog)
29+
- [Access the Purview Hub in Fabric](#access-the-purview-hub-in-fabric)
30+
- [Enable Metadata Scanning](#enable-metadata-scanning)
31+
- [View and Explore the Unified Catalog](#view-and-explore-the-unified-catalog)
32+
- [Sensitivity Labeling](#sensitivity-labeling)
33+
- [Data Loss Prevention DLP](#data-loss-prevention-dlp)
34+
- [End-to-End Lineage](#end-to-end-lineage)
35+
- [Role-Based Governance](#role-based-governance)
36+
- [Trust & Endorsement](#trust--endorsement)
37+
38+
</details>
39+
40+
> [!NOTE]
41+
> Below is how to upgrade from `Free` account.
42+
43+
> `Purview Free`: Provides basic data governance capabilities, suitable for small-scale or initial exploration of Purview’s features. It includes basic cataloging, limited data discovery, and basic compliance tools. <br/>
44+
> `Purview Enterprise`: Offers comprehensive data governance, protection, and compliance features. It supports a wide range of data sources, advanced classification, full DLP, information protection, compliance management, and seamless integration with Azure services.
45+
46+
<details>
47+
<summary><b> Detailed Table: Free vs Enterprise </b> (Click to expand)</summary>
48+
49+
| **Feature** | **Purview Free** | **Purview Enterprise**|
50+
|------------------------------------|---------------------------------------------------------------------|--------------------------------------------------------------------------------------|
51+
| **Data Catalog** | Basic cataloging capabilities. <br> Limited to 1,000 annotated assets.| Full cataloging capabilities. <br> No limit on the number of annotated assets.|
52+
| **Data Discovery** | Limited to Azure and Microsoft Fabric resources. <br> Auto discovery of Azure data sources.| Supports a wide range of data sources, including on-premises, multicloud, and SaaS applications. <br> Automated scans for the hybrid data estate. |
53+
| **Data Lineage** | Basic lineage tracking for a limited set of data sources.| Comprehensive lineage tracking across all supported data sources.|
54+
| **Data Classification** | Basic classification capabilities. <br> Definition and manual application of classifications and terms.| Advanced classification with automatic labeling and sensitivity labels. <br> Automated application of classifications and terms.|
55+
| **Data Loss Prevention (DLP)** | Not included.| Full DLP capabilities to prevent unauthorized sharing of sensitive information.|
56+
| **Information Protection** | Not included.| Includes encryption and access controls to protect sensitive data.|
57+
| **Compliance Management** | Basic compliance tools.| Comprehensive compliance management, including Compliance Manager and audit capabilities. |
58+
| **Data Quality** | Basic data profiling.| Advanced data quality features, including quality rules and continuous monitoring. |
59+
| **Insider Risk Management** | Not included.| Full insider risk management capabilities to detect and respond to potential data leaks.|
60+
| **eDiscovery**| Not included.| Full eDiscovery capabilities for legal and compliance investigations.|
61+
| **Integration with Azure Services**| Limited integration with Azure services.| Seamless integration with a wide range of Azure services, including Synapse Analytics, SQL, and Power BI. |
62+
| **Data Map** | Basic data map capabilities. <br> Manual creation of assets using the data map APIs.| Full data map with detailed visualizations and relationship tracking. <br> Full use of Microsoft Purview's REST APIs.|
63+
| **Monitoring and Reporting** | Basic monitoring and reporting.| Advanced monitoring and reporting, including Data Estate Insights.|
64+
| **User Access** | Limited to data curators. <br> Role group access control to platform and apps.| Full access for all users, including data stewards and analysts. <br> Fine-grained, collection-level access control to platform and apps.|
65+
| **Support and SLA** | Community support.| Enterprise-grade support and SLA.|
66+
| **Workflows** | Not included. | Included.|
67+
| **Business Rules** | Not included.| Included.|
68+
| **Support for Business Assets and Managed Attributes** | Not included.| Included.|
69+
| **Descriptions, Tags, and Contacts** | Manual descriptions, tags, and contacts.| Manual and bulk descriptions, tags, and contacts.|
70+
1671
</details>
1772

73+
<https://github.com/user-attachments/assets/9d644322-d3fc-4827-92d3-a623e39e55de>
74+
75+
## Unified Data Catalog
76+
77+
> Use the Microsoft Purview Unified Catalog to automatically register and view metadata for Fabric items. This helps users discover datasets, semantic models, and reports with full lineage and context. Ensure metadata scanning is enabled across all Fabric workspaces.
78+
79+
> [!IMPORTANT]
80+
>
81+
> - **Admins** can configure scanning policies and permissions in the **Microsoft Purview governance portal**. <br/>
82+
> - Ensure that **Fabric is registered as a data source** in Purview. <br/>
83+
> - Use **role-based access control (RBAC)** to manage who can view or edit catalog metadata.
84+
85+
### Access the Purview Hub in Fabric
86+
87+
- Go to the [Microsoft Fabric portal](https://app.fabric.microsoft.com/)
88+
- Click on ⚙️, select **“Purview hub”**.
89+
- This is your central place for managing governance, metadata, and data protection across Fabric.
90+
91+
<img width="550" alt="image" src="https://github.com/user-attachments/assets/9f22b062-051f-41b3-b480-4c109d332a57" />
92+
93+
<https://github.com/user-attachments/assets/cf5f5a25-29bd-4b78-9d3c-c926026e13be>
94+
95+
### Enable Metadata Scanning
96+
97+
> Ensure that **metadata scanning is enabled** for all relevant Fabric workspaces.
98+
> This allows Purview to automatically discover and register items like: Lakehouses, Dataflows, Semantic models, Reports <br/>
99+
>
100+
> - Scanning can be configured at the **workspace level** or **tenant level** by an admin.
101+
102+
1. **Configure tenant settings**:
103+
- In the [Fabric admin portal](https://app.fabric.microsoft.com/), go to **Tenant Settings**.
104+
105+
<img width="550" alt="image" src="https://github.com/user-attachments/assets/39bcb3a0-a794-4fd4-9bbb-6062b067bca2" />
106+
107+
- Enable detailed metadata scanning, and allow service principal access:
108+
109+
<https://github.com/user-attachments/assets/276cf0bd-e388-4b59-89b3-5a07de214ae8>
110+
111+
2. **Run a scan**:
112+
- Use the **Purview portal** or **scanner APIs** to initiate a scan.
113+
- You can perform full, incremental, or scoped scans depending on your governance needs.
114+
115+
<https://github.com/user-attachments/assets/a815517c-f19a-41a7-a4eb-efbaf138a883>
116+
117+
3. **Where to monitor**: Once scanning is active, go to the **Purview hub in Fabric** to view registered items, lineage graphs, and metadata properties.
118+
119+
### View and Explore the Unified Catalog
120+
121+
- Once scanning is active, go to the `Data Map` section within the [Purview hub](
122+
- Here, you can:
123+
- Search for datasets, models, and reports.
124+
- View **metadata** such as schema, owner, last modified date.
125+
- See **data lineage** (e.g how data flows from source to report).
126+
- Filter by sensitivity labels, endorsements, or domains.
127+
- Use Lineage for Impact Analysis
128+
- Click on any item to view its **lineage graph**.
129+
- This shows upstream and downstream dependencies (e.g., a semantic model feeding into multiple reports).
130+
- Use this to assess the impact of changes or troubleshoot data issues.
131+
132+
<https://github.com/user-attachments/assets/846f63f1-9d53-45ae-9812-9375b93d139f>
133+
134+
- Promote Discoverability
135+
- Add **descriptions, tags, and endorsements** to important items.
136+
- This helps other users find and trust the right data assets.
137+
- Encourage data producers to maintain metadata hygiene.
138+
139+
## Sensitivity Labeling
140+
141+
> Apply sensitivity labels to all Fabric items (e.g., Lakehouses, semantic models, reports) using `Microsoft Purview Information Protection`. Labels persist across exports and help enforce data protection policies. Regularly audit label usage and ensure labels align with your data classification framework. Click [Learn about sensitivity labels](https://learn.microsoft.com/en-us/purview/sensitivity-labels).
142+
143+
## Data Loss Prevention (DLP)
144+
145+
> Implement DLP policies for Power BI semantic models to prevent accidental data leaks. Define rules that restrict sharing or exporting sensitive data. Monitor DLP alerts and refine policies based on usage patterns. Click to [Learn about data loss prevention](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp)
146+
147+
## End-to-End Lineage
148+
149+
> Enable data lineage tracking to visualize how data flows from sources (e.g., OneLake, SQL, Cosmos DB) through transformations to reports. Use this to assess impact before making changes and to support compliance audits. Click [Data lineage user guide](https://learn.microsoft.com/en-us/purview/data-governance-classic-lineage-user-guide)
150+
151+
## Role-Based Governance
152+
153+
> Use tenant, domain, and workspace-level settings to delegate governance responsibilities. Platform admins should define global policies, while domain and workspace admins manage local configurations. This supports scalability and autonomy. Click [Data governance roles and permissions in Microsoft Purview](https://learn.microsoft.com/en-us/purview/data-governance-roles-permissions)
154+
155+
## Trust & Endorsement
156+
157+
> Encourage data producers to endorse trusted datasets and models. Use tags and descriptions to improve discoverability and promote reuse. This builds a culture of data trust and reduces duplication. Click [Govern your Fabric data](https://learn.microsoft.com/en-us/fabric/governance/onelake-catalog-govern)
158+
18159
<div align="center">
19160
<h3 style="color: #4CAF50;">Total Visitors</h3>
20161
<img src="https://profile-counter.glitch.me/brown9804/count.svg" alt="Visitor Count" style="border: 2px solid #4CAF50; border-radius: 5px; padding: 5px;"/>

0 commit comments

Comments
 (0)