Skip to main content

Security Considerations for DevOps in Microsoft Fabric Landing Zones

Security is a foundational concern in the design and operation of DevOps platforms within Microsoft Fabric Landing Zones. As you adopt DevOps practices for managing infrastructure as code (IaC), pipelines, and deployment workflows, it’s critical to follow secure-by-design principles to protect code, environments, and organizational data.

Identity and Access Management (IAM)​

  • Integrate Microsoft Entra ID for unified identity governance.
  • Enforce Single Sign-On (SSO) across Azure DevOps, GitHub, and Fabric environments.
  • Use Microsoft Entra Privileged Identity Management (PIM) to limit permanent access to sensitive roles such as Pipeline Admin, Fabric Capacity Admin, and Deployment Operators.
  • Apply least-privilege principles through Azure DevOps security groups and Microsoft Entra ID access packages.

Repository and Pipeline Security​

  • Restrict repository access using role-based access control (RBAC) at the project level.
  • Enforce branch protection and mandatory pull request (PR) approvals.
  • Secure YAML pipeline files using variable groups scoped to environments (e.g., Dev, Test, Prod).
  • Use approvals and checks before deploying to higher environments via Fabric CLI or REST APIs.

Secure Agent Strategy​

  • Use Microsoft-hosted agents for stateless, ephemeral builds.
  • Use hardened self-hosted agents for pipelines that deploy to production or connect to sensitive Fabric workspaces.
  • Ensure agents are deployed in secure network zones with monitored outbound access.

Secrets Management​

  • Use Azure Key Vault to store and access secrets securely in CI/CD pipelines.
  • Never store credentials in YAML or repo code. Instead, use service connections with limited scope.
  • For GitHub workflows, integrate GitHub Secrets or Azure Key Vault via OIDC federated credentials.

DevOps Workstation Security​

  • Require hardened Secure Admin Workstations (SAW) for platform engineers deploying changes to Fabric capacities, pipelines, and artifacts.
  • Enable Defender for Endpoint on admin workstations and enforce multi-factor authentication.

Security Automation​

  • Use static code analysis tools (e.g., SonarQube, Semgrep) to detect vulnerabilities in scripts and IaC templates.
  • Integrate secret scanning in GitHub (Advanced Security) or Azure DevOps Credential Scanner tasks.
  • Scan Docker containers and dependencies in CI builds with Microsoft Defender for Cloud.

Auditing and Compliance​

  • Enable audit logging in Azure DevOps and stream logs to Log Analytics or Microsoft Sentinel.
  • Use Azure Policy and Defender for DevOps to monitor and remediate non-compliant deployments.
  • Use Microsoft Purview for data classification and access reviews across Fabric and DevOps resources.

Secure Deployment Practices​

  • Use scoped service connections for each environment (Dev/Test/Prod) with specific role assignments (e.g., Contributor, Reader).
  • Automate role assignments using IaC and validate changes through PR review workflows.
  • Implement “what-if” checks before applying infrastructure changes via Fabric CLI or REST.

By incorporating these practices into your DevOps platform architecture for Microsoft Fabric Landing Zones, you establish strong security boundaries, reduce attack surface, and empower teams to deploy safely at scale.

Contributors