Microsoft Fabric spreads the state of your estate across a dozen screens; Fabric Control puts it on one. Workspace health, capacity, refresh outcomes, configuration drift, and who has access to what — read from operational metadata, so your data never leaves your tenant. The governance tier costs nothing.
Fabric shows you these things one screen at a time. A refresh that failed quietly for a week, a capacity setting someone changed, an access grant nobody remembers — each sits in its own corner of the portal, and nothing shows all of it at once. That gap is where estate problems hide until they surface at the worst moment.
Why is visibility into Fabric so scattered?
Fabric is several products under one roof — workspaces, capacities, lakehouses, warehouses, pipelines, semantic models — and each has its own corner of the portal. Health lives in one place, capacity in another, refresh history in another, permissions per workspace. There's no single operational screen that answers "what is the state of my whole estate right now?" So teams either click through it manually, or build their own reporting on the admin APIs and then own that forever.
What a control plane for Fabric actually shows you
The point of a control plane is one live picture of the estate. In practice that means:
- Workspace health and capacity — what's running, what's under pressure, all in one view.
- Refresh outcomes — what succeeded, what failed, and when — so a silent failure surfaces the day it happens.
- Configuration drift — settings, permissions, and structure that changed, tracked instead of discovered later.
- Entitlement visibility — who has access to what across the estate, so "who can see this?" is a question you can actually answer.
None of that requires touching your data. It's all operational metadata — the shape and status of the estate, not its contents.
What Fabric admins run into — and where this helps
A refresh fails and nobody notices. Refresh outcomes live per item, so a failure can sit for days before anyone opens the right screen. Fabric Control surfaces every refresh result across the estate in one place, so a failure shows up the day it happens.
Capacity throttles and the cause is hard to trace. When a capacity is under pressure, workloads slow or queue, but what's consuming it isn't obvious. The control plane shows utilization across workspaces, so you see the pressure building before it throttles a report.
"Who has access to this?" takes an afternoon to answer. Access is set per workspace and per item, so an audit means checking each one by hand. Entitlement visibility gives you the estate-wide answer directly.
Settings change and no one is tracking it. A capacity setting flipped, a permission granted, a workspace reconfigured — usually discovered after it breaks a refresh or a review. Drift detection records the change when it happens, not a week later.
An auditor asks for evidence you can't quickly produce. Proving current state, who has access, and that data never left the tenant means scrambling across screens. The metadata the control plane already collects is that evidence, on demand.
Getting that view
Fabric Control's governance tier provides it. You register a service principal you create and control; it reads the operational metadata — counts, status, size, configuration — and presents the single view: health, capacity, refresh, drift, and entitlements. It never reads your rows or tables. The governance tier is free for one Azure tenant, for as long as you use it.
You can also build this yourself on the Fabric admin APIs. That's the right call if you have an engineer to own a monitoring project and keep it current through Fabric's monthly changes. The governance tier is there so you don't have to.
Fabric Control is my product, so this isn't a neutral comparison. The governance tier is genuinely free for one tenant. Backup and operations are separate paid tiers; nothing on this page depends on them.
Does this give a vendor access to my data?
No. Only operational metadata — counts, status, size, configuration — crosses the boundary. Your rows, records, and table contents stay in your tenant. Access is through a service principal you create, scoped to least privilege, and revocable at any time; when you revoke it, the access ends. The boundary is enforced by the architecture rather than a promise, which is why it holds up in regulated environments.
Frequently asked questions
Does Microsoft Fabric have a single monitoring dashboard?
Not one unified operational view. Fabric surfaces health, capacity, refresh status, and settings across different admin and workspace screens, so a full picture of your estate means stitching together several portal areas — or building your own reporting on the admin APIs.
How do I see who has access to what in Microsoft Fabric?
Access is set per workspace and per item, so there is no single native screen that lists every person's access across the whole estate. Answering "who can see this?" for an audit usually means checking each workspace by hand, or pulling it from the admin APIs. A governance layer that reads entitlements gives you that estate-wide view directly.
What is configuration drift in Fabric, and why does it matter?
Drift is when the settings, permissions, or structure of your estate quietly change over time — a capacity setting flipped, access granted, a workspace reconfigured — without anyone tracking it. It matters because the change you can't see is the one that breaks a refresh or fails an audit. Detecting drift means you learn about the change when it happens, not a week later.
Is Fabric Control's governance tier really free?
Yes — free forever for one Azure tenant, no credit card. It gives you live control-plane visibility: workspace health, capacity, refresh outcomes, configuration, drift detection, and entitlement visibility. Backup and operations are separate paid tiers you only add if and when you want them.
Does Fabric Control see my data?
No. It reports operational metadata only — counts, status, size, configuration. Your rows, records, and table contents never leave your tenant. Access is through a service principal you create and can revoke instantly, and the metadata-only boundary is enforced by the architecture, not just promised.