DP-700 - Implement and Manage an Analytics Solution (34% of the exam) - Section 1.3

Implement workspace-level and item-level access controls in Microsoft Fabric.

Distinguish between workspace roles (Admin, Member, Contributor, Viewer) and item-level sharing in Microsoft Fabric. Choose between granting workspace access and sharing an individual item when scoping SQL analytics endpoint and semantic model permissions.

workspace roles (Admin, Member, Contributor, Viewer)item-level sharing and permissionsSQL endpoint and semantic model permissionsshare an item versus grant workspace access

Practice question for this objective

Free sampleImplement and Manage an Analytics Solutionmedium

An external auditor needs to query a single Microsoft Fabric Lakehouse through its SQL analytics endpoint for a two-week engagement. The auditor must be able to run SELECT statements over the Lakehouse tables but must not be able to browse files in the Lakehouse explorer, edit any notebooks, or appear in the workspace membership list. The data engineer wants to grant the narrowest access that still lets the auditor query the endpoint. What should the data engineer do?

AAdd the auditor to the workspace with the Viewer role, because Viewer is read-only and so naturally limits the auditor to querying the SQL analytics endpoint without edit rights.
BShare the Lakehouse with the auditor and grant the full Read permission, since Read is required for any access and it confines the auditor to reading rather than editing.
CShare the Lakehouse with the auditor and grant ReadData on the SQL analytics endpoint, which lets the auditor run SELECT queries through the endpoint without workspace membership or file access. Correct
DCreate a separate Microsoft Fabric Warehouse, copy the tables into it, and grant the auditor access there so the original Lakehouse is never exposed to the auditor at all.

Use item sharing with the ReadData SQL endpoint permission to grant query-only access to a Lakehouse without workspace membership or file access. Sharing a Lakehouse exposes granular permissions: ReadData authorises querying through the SQL analytics endpoint, while the broader Read permission additionally exposes file and OneLake access; granting ReadData alone to a non-member is the least-privilege way to allow SELECT queries only.

Why A is wrong: Viewer puts the auditor in the workspace membership list and grants read access to all items, which violates both the non-member and the files-not-browsable constraints.

Why B is wrong: The Read permission on a Lakehouse exposes file browsing in the explorer and OneLake, which the requirement forbids, so it grants more surface than the auditor should have.

Why C is correct: Sharing the item with the ReadData permission grants endpoint query rights to a non-member while withholding the Read permission that would expose Lakehouse files, giving the narrowest qualifying access.

Why D is wrong: Copying data into a new Warehouse duplicates storage and adds maintenance overhead, and item-level sharing already meets the need, so this is not the narrowest or simplest approach.

See more DP-700 practice questions, answers explained.

Exam traps in Implement and Manage an Analytics Solution

Answers that look right on this material and are not. Each one is a distractor from a different question in the DP-700 bank for this domain.

Add the analyst to the workspace as a Viewer so the SQL analytics endpoint and its tables become queryable from outside the team.
Why it is wrong: Viewer exposes every workspace item and grants Lakehouse file read, so it is wider than the endpoint-only requirement and breaks isolation.
Grant Read only, because read access to the semantic model is all that is needed to connect to it and create new Power BI reports from its data.
Why it is wrong: Read alone lets the analyst view content that uses the model but does not permit connecting a brand-new report to the model, so report authoring would be blocked.
Rely on the OneLake folder role alone, since storage-layer permissions on the regulated path automatically propagate to the SQL analytics endpoint columns.
Why it is wrong: Storage-layer folder roles and SQL analytics endpoint permissions are governed independently, so a folder role does not constrain which columns the endpoint exposes; assuming propagation leaves the two columns readable through T-SQL.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.