Which Role Creates a New Fabric Domain and Subdomains

DP-700 By islever Editorial Last updated

Configure security and governance

Short answer

D Assign the Fabric admin role so the user can create the sales domain, its east and west subdomains, and assign both workspaces.

Question

Your company has a sales department that uses two Fabric workspaces named Workspace1 and Workspace2.
The company decides to implement a domain strategy to organize the workspaces.
You need to ensure that a user can perform the following tasks:
Create a new domain for the sales department.
Create two subdomains: one for the east region and one for the west region.
Assign Workspace1 to the east region subdomain.
Assign Workspace2 to the west region subdomain.
The solution must follow the principle of least privilege.
Which role should you assign to the user?
  1. workspace Admin
  2. domain admin
  3. domain contributor
  4. Fabric admin Correct Answer

Key Takeaways

The question tests tenant-level domain permissions, and the trap is assuming least privilege points to domain admin when no domain admin can exist until a Fabric admin creates the domain.

Microsoft Fabric domains organize workspaces into tenant-level governance structures, with subdomains nesting beneath them. Because only a Fabric administrator can create a domain in the admin portal, the correct role for all four listed tasks is the Fabric admin.

Common mistake: Option B (domain admin) is the most tempting wrong pick: it satisfies least privilege for subdomains and workspace assignment, but a domain admin can only operate inside an already-created domain and cannot create the initial sales domain.

Expert Analysis

Why the Answer Is Correct

Microsoft's domains documentation states that creating a domain is a tenant-level action reserved for Fabric administrators, so the very first required task — creating a new domain for the sales department — already forces the Fabric admin role. Once that domain exists, its creator becomes the domain administrator, which lets the same user create the east and west subdomains and assign Workspace1 and Workspace2 to them. Least privilege is still respected here because no lower-privileged role can complete the full task list; a narrower role would fail at step one. All four required actions (create domain, create two subdomains, assign two workspaces) are therefore covered by a single Fabric admin assignment.

Why the Other Options Are Wrong

Workspace Admin (A) governs items, permissions, and settings inside Workspace1 or Workspace2 only, and has no visibility into tenant-level domains or subdomains. Domain admin (B) can indeed create subdomains and assign workspaces, but it presupposes an existing domain — the user cannot grant themselves domain admin on a domain that does not yet exist. Domain contributor (C) is the weakest of the domain roles, limited to adding workspaces to an existing domain, with no ability to create subdomains at all. Fabric admin (D) is technically broad, but it is the only role that can perform domain creation, so it is the least-privileged role that actually satisfies every stated requirement.

Community Comment Notes

Several commenters reached D by citing Microsoft's documentation, with GHill1982 noting after research that "only a Fabric Admin can create Domains" and benni_ale stating "only fabric admin can create and edit domains." fdsdfgxcvbdsfhshfg captured the ordering problem precisely: "Domain Admin can work on already created domain, not create it." On the other side, larinate argued the scenario is contained within a single domain rather than global governance, and Psycho listed Domain Admin as able to create domains — a claim contradicted by the official create-a-domain documentation, so the D consensus is the better-supported position.

Official Reference

https://learn.microsoft.com/en-us/fabric/governance/domains

This link opens the official vendor documentation in a new tab.

Exam Strategy

On least-privilege questions, first identify which tasks are tenant-level versus workspace-level; the strictest-sounding role still fails if it cannot perform the first required action, so privilege scope beats preference for a narrower role.

Frequently Asked Questions

Why is domain admin wrong if the question requires least privilege?

A domain admin manages a domain that already exists; the user must first create the sales domain, which only a Fabric admin can do. Least privilege still applies because no lower role can complete all four tasks.

Can a domain contributor assign Workspace1 and Workspace2 to subdomains?

A domain contributor can add workspaces to an existing domain, but it cannot create subdomains or domains, so it fails two of the required tasks.

More DP-700 FAQ →

Discussion 37 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 37

  1. MDWPartners 👍 6 Answered D
    Fabric admin (or higher) are the only ones who can create domains
  2. harshalt10 👍 5 Answered D
    The question states that user should be able to create Domains. Hence, answer should be D. https://learn.microsoft.com/en-us/fabric/onelake/onelake-shortcuts
  3. GHill1982 👍 5
    After further research it appears only a Fabric Admin can create Domains. https://learn.microsoft.com/en-us/fabric/governance/domains#create-a-domain
  4. fdsdfgxcvbdsfhshfg 👍 5
    Domain Admin can work on already created domain, not create it and appoint himself as the admin out of thin air. Fabric Admin is required
  5. larinate 👍 4 Answered B
    Fabric Admin oversees domain governance at the tenant level, but the question is not about tenant governance, it’s about: 1. creating one new domain for the sales department 2. creating its subdomains 3. assigning two specific workspaces and most important we must follow least privilege. All of this is contained within a single domain, not global. governance. "Domain Admin" can create domains/subdomain/assign worspaces/permissions only for theirs domain -> least privilege
Show 25 more comments
  1. Psycho 👍 4 Answered B
    Workspace Admin → Can manage items within a workspace, but cannot create domains or subdomains. Domain Contributor → Can add workspaces to an existing domain but cannot create domains or subdomains. Fabric Admin → Full administrative rights across the entire Fabric tenant (too much privilege for this scenario). Domain Admin → Can create domains, subdomains, and assign workspaces. This satisfies all requirements while following the principle of least privilege.
  2. 8d6881f 👍 4 Answered D
    Only a Fabric Admin can create Domains. https://learn.microsoft.com/en-us/fabric/governance/domains?source=recommendations
  3. d0bdf05 👍 4 Answered B
    I´m agree with B, because "Domain Admin" can create and manage domains and is covering the principle of less privilege.
  4. AzureGeek79 👍 4
    Domain admin can create domains too. Fabric admin violates the principle of least privileges.
  5. benni_ale 👍 4 Answered D
    only fabric admin can create and edit domains
  6. Stretchy 👍 3
    Domain admins can only manage domains they are assigned to. Fabric Admin: Fabric admins can create and edit domains, specify domain admins and contributors, and associate workspaces with domains. They have full visibility and control over all defined domains. Domain Admin: Domain admins can manage the domains they are assigned to, including creating subdomains and managing domain-specific settings
  7. Mustafa_Shazly 👍 3 Answered D
    https://learn.microsoft.com/en-us/fabric/governance/domains#create-a-domain =To create domain, you must be a Fabric admin. =To create subdomains for a domain, you must be Fabric admin or domain admin
  8. ChenFu 👍 3 Answered C
    The Domain Contributor role provides the exact permissions needed to create subdomains and assign workspaces, without granting excessive privileges. Therefore, C is the best choices
  9. 9a69b12 👍 3 Answered B
    Domain Admin can create a new domain with sub-domains. “The solution must follow the principle of least privilege”. Would be weird if the Fabric Admin was the right answer.
  10. bettermakeme 👍 3 Answered D
    https://learn.microsoft.com/en-us/rest/api/fabric/admin/domains/create-domain?tabs=HTTP Domains - Create Domain - The caller must be a Fabric administrator.
  11. e71e79b 👍 3 Answered B
    A domain admin has the necessary permissions to: Create a new domain Create subdomains Assign workspaces to domains or subdomains
  12. Bharat 👍 3 Answered B
    Given answer is correct since the domain admin can create a new subdomain but a domain contributor cannot.
  13. AzureGeek79 👍 3 Answered B
    B is correct answer since it follows the principle of least privilege, not D.
  14. wellingtonluis 👍 3 Answered D
    Only a Fabric Admin can create Domains.
  15. TorresW 👍 2 Answered B
    Why domain contributor Creating a new domain and subdomains, and assigning workspaces to those subdomains, are domain‑level actions, not workspace‑level. ​ Microsoft’s domains documentation + DP‑600 discussion show that domain contributor is the least‑privilege role that can: Work with domains/subdomains as delegated by a domain admin Assign workspaces they administer to those domains/subdomains. Why not the others Workspace Admin: Can manage Workspace1/2, but cannot create domains or subdomains. ​ Domain Admin: Can create/edit domains and manage settings, but is more powerful than needed (violates least privilege). ​ Fabric Admin: Tenant‑wide powerful role; far exceeds what’s required. ​
  16. Zekes 👍 2 Answered B
    Domain Admin Domain contributors are workspace Admins (will only be relevant to one workspace) https://learn.microsoft.com/en-us/fabric/governance/domains#domain-roles
  17. Sreeven 👍 2 Answered D
    User can => Create a new domain for the sales department needs Fabric Admin role. for sub domains Domain Admin should do.
  18. zulajariwala 👍 2 Answered D
    To create domain, you must be a Fabric adminhttps://learn.microsoft.com/en-us/fabric/governance/domains#create-a-domain
  19. DarioReymago 👍 2 Answered D
    just Fabric Adm can create domains
  20. alqazqzy.asseel 👍 1 Answered D
    As per Official Fabric docs "Fabric admin (or higher): Fabric admins can create and edit domains, specify domain admins and domain contributors, and associate workspaces with domains. Fabric admins see all the defined domains on the Domains tab in the admin portal, and they can edit and delete domains."
  21. 8d82b67 👍 1
    Wrong as in Jan 2026 Domain admins can access to the Domains tab in the admin portal, but they can only see and edit the domains they're admins of. Domain admins can update the domain description, define/update domain contributors, and associate workspaces with the domain.
  22. IshtarSQL 👍 1 Answered C
    Not B because: Domain Admin: While this role provides higher-level control over domains and subdomains, it exceeds the principle of least privilege for this scenario.
  23. GHill1982 👍 1
    Only a Domain Admin can create domains. Domain Contributor cannot access the domain tab. https://learn.microsoft.com/en-us/fabric/governance/domains#domain-roles
  24. friik 👍 1 Answered B
    Domain admin. They can create Domains and solves the requirement. Fabric Admin has too many privileges and is disqualified from "Principle of Least Privilege"
  25. Hanif53 👍 1 Answered B
    Role Scope Fabric Admin Tenant-wide (too broad) Domain Admin Domain governance Domain Contributor Limited domain actions Workspace Admin Workspace only

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

A 500-million-row fact table exceeds the F32 Direct Lake guardrail, so increase the capacity to F64

S-grade

Shortcut caching supports only S3/GCS shortcuts and excludes files larger than 1 GB

S-grade

Updating warehouse tables requires at least the Contributor workspace role because Write is not shareable to a Viewer

S-grade

Run T-SQL in a KQL database only by prefixing the query with a -- comment line

S-grade

← Back to DP-700 Study Guide