Microsoft Fabric Private Link: Secure a Workspace in an Azure VNet

In this workshop-style video, we'll walk through configuring a Microsoft Fabric workspace with a Workspace-scoped Private Link so that access is restricted to an Azure Virtual Network (VNet). For a detailed runbook of the configuration demonstrated in this video: https://robkerr.com/secure-microsoft-fabric-with-private-link-workspace/ This is a complete end-to-end walkthrough where we build the solution from scratch in both Microsoft Fabric and Azure, including the VNet, subnets, private endpoint, virtual network data gateway, and a jump box VM used for testing private connectivity. We also look at a practical architecture pattern where: • A restricted Fabric workspace hosts Lakehouse data behind a Private Link • An open reporting workspace hosts Semantic Models and Power BI reports • Reports refresh through a Virtual Network Data Gateway that securely accesses the restricted data This pattern allows organizations to combine strong network isolation with flexible reporting access. If you’re working with secure analytics architectures in Microsoft Fabric, this pattern is extremely useful. # What you’ll learn • What Private Link is and how it works with Microsoft Fabric • When to use workspace-level Private Links vs tenant-level Private Links • How Private Link compares to other controls like Entra Conditional Access and workspace IP firewall rules • How to configure a VNet and subnets for Fabric Private Link connectivity • Creating the Private Link resource and private endpoint with an ARM template • Deploying a Jumpbox VM and Azure Bastion for testing private connectivity • Restricting a Fabric workspace to Private Link only access • Using a Virtual Network Data Gateway to refresh Semantic Models from a restricted Lakehouse • Building Power BI reports in an open workspace that securely query restricted data # Architecture covered in this video The final architecture includes: • A restricted Fabric Lakehouse workspace accessible only through a Private Endpoint • An open reporting workspace hosting Power BI semantic models and reports • An Azure Virtual Network with four subnets for: • Private Link endpoint • Virtual Network Data Gateway • Jumpbox VM • Azure Bastion This enables secure data isolation while still supporting enterprise reporting scenarios. Related concepts discussed • Microsoft Fabric security architecture • Zero Trust data platforms • Azure Private Link • Virtual Network Data Gateway • Lakehouse SQL Analytics Endpoint • Power BI semantic models across workspaces Chapters 0:00 Introduction 1:42 Architecture 2:58 Workspace Creation 4:15 Create VNet 6:51 Resource Providers 7:17 Private Link 8:42 Private Endpoint 9:26 Azure JumpBox VM 10:34 Test DNS 10:53 Add Private Link to Fabric 11:38 Test Private Link 12:33 Create Semantic Model 15:34 Teste Semantic Model 15:46 Summary