Only a Fabric admin can create top-level domains; domain admin handles subdomains

DP-700 By islever Editorial Last updated

Configure security and governance

Short answer

D Only a Fabric admin can create a new top-level domain; domain admin and domain contributor cannot create the domain itself.

Question

Your company has a sales department that uses two Fabric workspaces named Workspace1 and Workspace2. The company decides to implement a domain strategy to organize the workspaces. You need to ensure that a user can perform the following tasks: Create a new domain for the sales department. Create two subdomains: one for the east region and one for the west region. Assign Workspace1 to the east region subdomain. Assign Workspace2 to the west region subdomain. The solution must follow the principle of least privilege. Which role should you assign to the user?
  1. workspace Admin
  2. domain admin
  3. domain contributor
  4. Fabric admin Correct Answer

Key Takeaways

Domain creation is a Fabric-admin-only capability; the principle of least privilege here still requires Fabric admin because no lower role can create a domain at all.

Creating a new top-level domain in Microsoft Fabric requires the Fabric admin role. A domain admin can create and manage subdomains and assign workspaces within an existing domain, but cannot create the parent domain itself.

Common mistake: Assigning domain admin and assuming it covers creating the top-level domain; domain admin authority begins after a Fabric admin creates the domain.

Expert Analysis

Why the Answer Is Correct

Fabric domain documentation states that only Fabric admins (or higher) can create and edit domains. The scenario requires creating a brand-new domain for the sales department, which is exclusively a Fabric admin capability. Although the same user must later create subdomains and assign workspaces, those tasks can be performed by a domain admin, but the initial domain creation cannot be done without Fabric admin.

Why the Other Options Are Wrong

Option B (domain admin) can create subdomains and assign workspaces but cannot create the top-level domain. Option C (domain contributor) has even narrower rights and cannot create domains or subdomains. Option A (workspace admin) governs a single workspace and has no domain-creation authority.

Community Comment Notes

Community voting strongly favors D (79 vs 15). Multiple comments (neo_20, MDWPartners, benni_ale) confirm only a Fabric admin can create domains, with several noting a domain admin could handle the subdomains once the domain exists.

Official Reference

https://learn.microsoft.com/en-us/fabric/governance/domains

This link opens the official vendor documentation in a new tab.

Community Votes

D
84%
B
16%

84% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. neo_20 👍 13 Answered D
    Only a Fabric Admin can create Domains.
  2. harshalt10 👍 4 Answered D
    The question states that user should be able to create Domains. Hence, answer should be D. https://learn.microsoft.com/en-us/fabric/onelake/onelake-shortcuts
  3. MDWPartners 👍 4 Answered D
    Fabric admin (or higher) are the only ones who can create domains
  4. Bharat 👍 3 Answered B
    Given answer is correct since the domain admin can create a new subdomain but a domain contributor cannot.
  5. benni_ale 👍 3 Answered D
    only fabric admin can create and edit domains
Show 5 more comments
  1. Zekes 👍 2 Answered B
    Domain Admin Domain contributors are workspace Admins (will only be relevant to one workspace) https://learn.microsoft.com/en-us/fabric/governance/domains#domain-roles
  2. 8d6881f 👍 2 Answered D
    Only a Fabric Admin can create Domains. https://learn.microsoft.com/en-us/fabric/governance/domains?source=recommendations
  3. ChenFu 👍 1 Answered C
    The Domain Contributor role provides the exact permissions needed to create subdomains and assign workspaces, without granting excessive privileges. Therefore, C is the best choices
  4. IshtarSQL 👍 1 Answered C
    Not B because: Domain Admin: While this role provides higher-level control over domains and subdomains, it exceeds the principle of least privilege for this scenario.
  5. Sreeven 👍 1 Answered D
    User can => Create a new domain for the sales department needs Fabric Admin role. for sub domains Domain Admin should do.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

A 500-million-row fact table exceeds the F32 Direct Lake guardrail, so increase the capacity to F64

S-grade

Shortcut caching supports only S3/GCS shortcuts and excludes files larger than 1 GB

S-grade

Updating warehouse tables requires at least the Contributor workspace role because Write is not shareable to a Viewer

S-grade

Run T-SQL in a KQL database only by prefixing the query with a -- comment line

S-grade

← Back to DP-700 Study Guide