How Do Fabric Default Domains Affect Workspace3 Access?

Answer: No / Yes / No ✅ This question is about Fabric domains and default domain assignment. Let's analyze step by step. Given Workspace1 admin = User1 Workspace2 admin = User2 Group1 contains User1 and User3 Domains: Domain1 admin = User1 Domain2 admin = User2 Then: User1 creates Workspace3 Group1 is added to the default domain of Domain1 Important Fabric rule When a user or security group is added to a domain's default domain, any new workspaces they create are automatically associated with that domain. Since: Group1 contains User1 Group1 is assigned to Domain1's default domain User1 creates Workspace3 ⇒ Workspace3 automatically belongs to Domain1. Statement 1 "User3 has Viewer role access to Workspace3." Being a member of a group assigned to a domain does not grant access to workspaces in that domain. Workspace permissions and domain membership are separate concepts. ✅ Answer: No Statement 2 "User3 has Domain contributor access to Domain1." Members of a security group assigned to a domain's default domain become Domain contributors for that domain. User3 belongs to Group1. ✅ Answer: Yes Statement 3 "User2 has Contributor role access to Workspace3." User2 is the admin of Domain2, but Workspace3 belongs to Domain1. Domain administrators do not automatically become workspace contributors for workspaces in another domain. No permission was granted to User2 on Workspace3. ✅ Answer: No Final Answers Statement AnswerUser3 has Viewer role access to Workspace3 No User3 has Domain contributor access to Domain1 Yes User2 has Contributor role access to Workspace3 No Answer: No / Yes / No ✅

No YES NO Select Default domain and specify users and/or security groups. When you add people to the default domain list, unassigned workspaces they're admins of, and new workspaces they create, will automatically be assigned to the domain. -The users and/or members of the security groups specified in the default domain definition generally automatically become domain contributors of the workspaces that get assigned to the domain via the default domain mechanism. https://learn.microsoft.com/en-us/fabric/governance/domains#define-the-domain-as-a-default-domain

Statement Answer User3 has Viewer access ❌ No User3 has Domain contributor access ✅ Yes User2 has Contributor access ❌ No

Domain permissions = metadata + catalog governance Workspace permissions = item-level access These are completely separate. answer is NO / YES / NO

my bad, it's NYN actually " The specified users and/or members of the specified security groups generally automatically become domain contributors of workspaces that are assigned in this manner. " https://learn.microsoft.com/en-us/fabric/governance/domains#default-domain

NYN User1 creates a new workspace named Workspace3 - at this moment the Workspace3 is unassigned, i.e. no domain. When Group1 (User1 and User3) is added to the default domain of Domain1: 1. "When you add people to the default domain list, unassigned workspaces they're admins of, and new workspaces they create, will automatically be assigned to the domain". I.e. Workspace3 is assigned to Domain1 2. "The users and/or members of the security groups specified in the default domain definition generally automatically become domain contributors of the workspaces that get assigned to the domain via the default domain mechanism." I.e User3 becomes Domain1 contributor, not Viewer. From <https://learn.microsoft.com/en-us/fabric/governance/domains#create-subdomains>

Y-N-N Y - whenever a specified user or member of a specified security group creates a new workspace, it is assigned to the default domain. https://learn.microsoft.com/en-us/fabric/governance/domains N - Domain admins must be explicitly set by the domain admin or Fabric admin N - Contributor role access to a workspace must be set by the Admin or Member of the workspace

NYN Users or groups assigned to a domain’s default group automatically receive the Domain Contributor role.

https://learn.microsoft.com/en-us/fabric/governance/domains#define-the-domain-as-a-default-domain """ To define a domain as a default domain, you must be a Fabric admin or a domain admin of the domain. Select Default domain and specify users and/or security groups. When you add people to the default domain list, unassigned workspaces they're admins of, and new workspaces they create, will automatically be assigned to the domain. """ User1 creates a new workspace named Workspace3. So WS3 is assigned to the domain 1 """ Note The users and/or members of the security groups specified in the default domain definition generally automatically become domain contributors of the workspaces that get assigned to the domain via the default domain mechanism. """ User3 is on security Group1, which is assigned to Domain1. So User3 has Domain contributor access to Domain1. Statement 2 -> Y

N Y N https://learn.microsoft.com/en-us/fabric/governance/domains Default domain A default domain is a domain that has been defined as the default domain for specified users and/or security groups. When you define a domain as the default domain for specified users and/or security groups, the following happens: The system scans the organization's workspaces. When it finds a workspace whose admin is a specified user or member of a specified security group: If the workspace already has a domain assignment, it is preserved. The default domain doesn't override the current assignment. If the workspace is unassigned, it is assigned to the default domain. After this, whenever a specified user or member of a specified security group creates a new workspace, it is assigned to the default domain. The specified users and/or members of the specified security groups generally automatically become domain contributors of workspaces that are assigned in this manner.

When a workspace is created by a user who is a member of a domain, that workspace is automatically associated with that domain. You can configure a default domain group (e.g., Group1) for a domain, and: That group gains the Domain Contributor role for all workspaces in the domain. This does not grant workspace-level Viewer or Contributor roles. Let’s apply that to your scenario: User3 and Group1: Group1 contains User3 Group1 is the default domain group for Domain1 So, User3 has the Domain Contributor role in Domain1 Statement 2: "User3 has Domain contributor access to Domain1" YES Statement 1: "User3 has Viewer role access to Workspace3" NO Because domain roles don’t give workspace Viewer permissions. User2 and Workspace3: User2 is not a member of Group1 User2 did not create Workspace3 No indication they were added to it manually Statement 3: "User2 has Contributor access to Workspace3" NO

N/Y/N https://learn.microsoft.com/en-us/fabric/governance/domains#default-domain

N,N,N User3 doesn't have Viewer or Domain contributor access because Group1 was only added to the default domain, not explicitly granted permissions. User2 has no access to Workspace3 since User1 created it and didn’t add User2. Therefore, all three statements are false.

Default domain When you add people to this list their new and unassigned workspaces will be automatically assigned to the domain. It also makes them domain contributors. This is from MS Fabric itself. So, NYN.

finally a voice of sanity in this pile of garbage

NYN is correct

N Y N https://learn.microsoft.com/en-us/fabric/governance/domains Being a domain contributor doesn't give you any permissions on the workspace itself, only on the domain. Workspace roles are set differently. This excludes the first and last option. User 3 will be domain contributor on the new workspace. Even though without domain admin permissions, there's nothing user 3 can do with Workspace 3.

Why "User 3 will be domain contributor on the new workspace"? In https://learn.microsoft.com/en-us/fabric/governance/domains#default-domain, it is written that "The specified users and/or members of the specified security groups GENERALLY automatically become domain contributors of workspaces that are assigned in this manner." but we have a word GENERALLY here...

Y/Y/N I think User 3 has Domain contributor access based on the document: https://learn.microsoft.com/en-us/fabric/governance/domains When you define a domain (Domain1) as the default domain for specified users and/or security groups (Group1), the system scans the organization's workspaces. When it finds a workspace whose admin (User1) is a specified user or member of a specified security group (Group1). If the workspace is unassigned (Workspace3), it is assigned to the default domain (Domain1). The specified users and/or members of the specified security groups (User 1 and User3) generally automatically become domain contributors of workspaces (Workspace3) that are assigned in this manner.

NYN Being a domain contributor doesn't give you any permissions on the workspace itself, only on the domain. Workspace roles are set differently. This excludes the first and last option. User 3 will be domain contributor on the new workspace. Even though without domain admin permissions, there's nothing user 3 can do with Workspace 3.

Should be Y Y N https://learn.microsoft.com/en-us/fabric/governance/domains "After this, whenever a specified user or member of a specified security group creates a new workspace, it is assigned to the default domain. The specified users and/or members of the specified security groups generally automatically become domain contributors of workspaces that are assigned in this manner."

I correct myself. The answer is Correct. Y N N. Mind the order of things

Y Y N https://learn.microsoft.com/en-us/fabric/governance/domains