Which Role Creates a New Fabric Domain and Subdomains
Answer
Correct answer: D — Assign the Fabric admin role so the user can create the sales domain, its east and west subdomains, and assign both workspaces.
Your company has a sales department that uses two Fabric workspaces named Workspace1 and Workspace2. The company decides to implement a domain strategy to organize the workspaces. You need to ensure that a user can perform the following tasks: Create a new domain for the sales department. Create two subdomains: one for the east region and one for the west region. Assign Workspace1 to the east region subdomain. Assign Workspace2 to the west region subdomain. The solution must follow the principle of least privilege. Which role should you assign to the user?
Community Insight
The question tests tenant-level domain permissions, and the trap is assuming least privilege points to domain admin when no domain admin can exist until a Fabric admin creates the domain.
Microsoft Fabric domains organize workspaces into tenant-level governance structures, with subdomains nesting beneath them. Because only a Fabric administrator can create a domain in the admin portal, the correct role for all four listed tasks is the Fabric admin.
Option B (domain admin) is the most tempting wrong pick: it satisfies least privilege for subdomains and workspace assignment, but a domain admin can only operate inside an already-created domain and cannot create the initial sales domain.
Community Discussion (38 comments)
alqazqzy.asseel
👍 1
Selected: D
As per Official Fabric docs "Fabric admin (or higher): Fabric admins can create and edit domains, specify domain admins and domain contributors, and associate workspaces with domains. Fabric admins see all the defined domains on the Domains tab in the admin portal, and they can edit and delete domains."
AmirAhmadabadi
👍 1
Selected: B
Create and manage domains Create subdomains Assign workspaces to domains and subdomains Manage the domain hierarchy
Hanif53
👍 1
Selected: B
Role Scope Fabric Admin Tenant-wide (too broad) Domain Admin Domain governance Domain Contributor Limited domain actions Workspace Admin Workspace only
luckybalaji
👍 1
Selected: B
Fabric admin give full access, question is to get least privilege access
zulajariwala
👍 2
Selected: D
To create domain, you must be a Fabric adminhttps://learn.microsoft.com/en-us/fabric/governance/domains#create-a-domain
Mustafa_Shazly
👍 3
Selected: D
https://learn.microsoft.com/en-us/fabric/governance/domains#create-a-domain =To create domain, you must be a Fabric admin. =To create subdomains for a domain, you must be Fabric admin or domain admin
TorresW
👍 2
Selected: B
Why domain contributor Creating a new domain and subdomains, and assigning workspaces to those subdomains, are domain‑level actions, not workspace‑level. Microsoft’s domains documentation + DP‑600 discussion show that domain contributor is the least‑privilege role that can: Work with domains/subdomains as delegated by a domain admin Assign workspaces they administer to those domains/subdomains. Why not the others Workspace Admin: Can manage Workspace1/2, but cannot create domains or subdomains. Domain Admin: Can create/edit domains and manage settings, but is more powerful than needed (violates least privilege). Fabric Admin: Tenant‑wide powerful role; far exceeds what’s required.
friik
👍 1
Selected: B
Domain admin. They can create Domains and solves the requirement. Fabric Admin has too many privileges and is disqualified from "Principle of Least Privilege"
Rjb_073086
👍 1
Selected: B
answer should've been B. domain admin can create domains too. fabric admin is for entire tenancy
TomGray1989
👍 1
Selected: D
A Fabric Admin can manage domains themselves, a Domain Admin manages within a domain.
eegdo
👍 1
Selected: D
Only Fabric Admins can create domains: https://learn.microsoft.com/en-us/fabric/governance/domains
Psycho
👍 4
Selected: B
Workspace Admin → Can manage items within a workspace, but cannot create domains or subdomains. Domain Contributor → Can add workspaces to an existing domain but cannot create domains or subdomains. Fabric Admin → Full administrative rights across the entire Fabric tenant (too much privilege for this scenario). Domain Admin → Can create domains, subdomains, and assign workspaces. This satisfies all requirements while following the principle of least privilege.
8d82b67
👍 1
Wrong as in Jan 2026 Domain admins can access to the Domains tab in the admin portal, but they can only see and edit the domains they're admins of. Domain admins can update the domain description, define/update domain contributors, and associate workspaces with the domain.
9a69b12
👍 3
Selected: B
Domain Admin can create a new domain with sub-domains. “The solution must follow the principle of least privilege”. Would be weird if the Fabric Admin was the right answer.
larinate
👍 4
Selected: B
Fabric Admin oversees domain governance at the tenant level, but the question is not about tenant governance, it’s about: 1. creating one new domain for the sales department 2. creating its subdomains 3. assigning two specific workspaces and most important we must follow least privilege. All of this is contained within a single domain, not global. governance. "Domain Admin" can create domains/subdomain/assign worspaces/permissions only for theirs domain -> least privilege
AzureGeek79
👍 3
Selected: B
B is correct answer since it follows the principle of least privilege, not D.
wellingtonluis
👍 3
Selected: D
Only a Fabric Admin can create Domains.
d0bdf05
👍 4
Selected: B
I´m agree with B, because "Domain Admin" can create and manage domains and is covering the principle of less privilege.
fdsdfgxcvbdsfhshfg
👍 5
Domain Admin can work on already created domain, not create it and appoint himself as the admin out of thin air. Fabric Admin is required
e71e79b
👍 3
Selected: B
A domain admin has the necessary permissions to: Create a new domain Create subdomains Assign workspaces to domains or subdomains
smanzana
👍 1
Selected: D
D is correct
DarioReymago
👍 2
Selected: D
just Fabric Adm can create domains
bettermakeme
👍 3
Selected: D
https://learn.microsoft.com/en-us/rest/api/fabric/admin/domains/create-domain?tabs=HTTP Domains - Create Domain - The caller must be a Fabric administrator.
Sreeven
👍 2
Selected: D
User can => Create a new domain for the sales department needs Fabric Admin role. for sub domains Domain Admin should do.
benni_ale
👍 4
Selected: D
only fabric admin can create and edit domains
Adriel_1996
👍 1
But first say that have to create a new domain
ChenFu
👍 3
Selected: C
The Domain Contributor role provides the exact permissions needed to create subdomains and assign workspaces, without granting excessive privileges. Therefore, C is the best choices
8d6881f
👍 4
Selected: D
Only a Fabric Admin can create Domains. https://learn.microsoft.com/en-us/fabric/governance/domains?source=recommendations
MDWPartners
👍 6
Selected: D
Fabric admin (or higher) are the only ones who can create domains
neo_20
👍 26
Selected: D
Only a Fabric Admin can create Domains.
AzureGeek79
👍 4
Domain admin can create domains too. Fabric admin violates the principle of least privileges.
harshalt10
👍 5
Selected: D
The question states that user should be able to create Domains. Hence, answer should be D. https://learn.microsoft.com/en-us/fabric/onelake/onelake-shortcuts
GHill1982
👍 5
After further research it appears only a Fabric Admin can create Domains. https://learn.microsoft.com/en-us/fabric/governance/domains#create-a-domain
Zekes
👍 2
Selected: B
Domain Admin Domain contributors are workspace Admins (will only be relevant to one workspace) https://learn.microsoft.com/en-us/fabric/governance/domains#domain-roles
Stretchy
👍 3
Domain admins can only manage domains they are assigned to. Fabric Admin: Fabric admins can create and edit domains, specify domain admins and contributors, and associate workspaces with domains. They have full visibility and control over all defined domains. Domain Admin: Domain admins can manage the domains they are assigned to, including creating subdomains and managing domain-specific settings
Bharat
👍 3
Selected: B
Given answer is correct since the domain admin can create a new subdomain but a domain contributor cannot.
IshtarSQL
👍 1
Selected: C
Not B because: Domain Admin: While this role provides higher-level control over domains and subdomains, it exceeds the principle of least privilege for this scenario.
GHill1982
👍 1
Only a Domain Admin can create domains. Domain Contributor cannot access the domain tab. https://learn.microsoft.com/en-us/fabric/governance/domains#domain-roles
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Microsoft's domains documentation states that creating a domain is a tenant-level action reserved for Fabric administrators, so the very first required task — creating a new domain for the sales department — already forces the Fabric admin role. Once that domain exists, its creator becomes the domain administrator, which lets the same user create the east and west subdomains and assign Workspace1 and Workspace2 to them. Least privilege is still respected here because no lower-privileged role can complete the full task list; a narrower role would fail at step one. All four required actions (create domain, create two subdomains, assign two workspaces) are therefore covered by a single Fabric admin assignment.Why the Other Options Are Wrong
Workspace Admin (A) governs items, permissions, and settings inside Workspace1 or Workspace2 only, and has no visibility into tenant-level domains or subdomains. Domain admin (B) can indeed create subdomains and assign workspaces, but it presupposes an existing domain — the user cannot grant themselves domain admin on a domain that does not yet exist. Domain contributor (C) is the weakest of the domain roles, limited to adding workspaces to an existing domain, with no ability to create subdomains at all. Fabric admin (D) is technically broad, but it is the only role that can perform domain creation, so it is the least-privileged role that actually satisfies every stated requirement.Community Comment Notes
Several commenters reached D by citing Microsoft's documentation, with GHill1982 noting after research that "only a Fabric Admin can create Domains" and benni_ale stating "only fabric admin can create and edit domains." fdsdfgxcvbdsfhshfg captured the ordering problem precisely: "Domain Admin can work on already created domain, not create it." On the other side, larinate argued the scenario is contained within a single domain rather than global governance, and Psycho listed Domain Admin as able to create domains — a claim contradicted by the official create-a-domain documentation, so the D consensus is the better-supported position.Official Reference
Exam Strategy
On least-privilege questions, first identify which tasks are tenant-level versus workspace-level; the strictest-sounding role still fails if it cannot perform the first required action, so privilege scope beats preference for a narrower role.
Frequently Asked Questions
Why is domain admin wrong if the question requires least privilege?
A domain admin manages a domain that already exists; the user must first create the sales domain, which only a Fabric admin can do. Least privilege still applies because no lower role can complete all four tasks.
Can a domain contributor assign Workspace1 and Workspace2 to subdomains?
A domain contributor can add workspaces to an existing domain, but it cannot create subdomains or domains, so it fails two of the required tasks.