Microsoft Fabric Workspace and Data Domain Architecture

Microsoft Fabric uses a combination of workspaces and data domains to provide data governance and user access controls. The illustration shows a multinational Fabric deployment where data is accessed and shared across capacities.

Fabric Architecture Basics 

A Fabric deployment contains multiple levels for organizing users, content, and data, where each part is used for a different part of the overall design:

Tenancy, the highest level, is aligned with the customer’s Entra ID (previously called Azure Active Directory) tenancy and is used to authenticate users and store credentials that are used to secure workspaces, reports, and data.

Capacity is a set of allocated resources, inside a tenancy, that is analogous to a VM with assigned virtual cores.

Workspace is a secure area, inside a capacity, for creating and sharing content; typically for specific activities or departments.

Data Domain is a subdivision that allows admins to apply data governance and user access controls to specific data across capacities and workspaces (a data-mesh concept). For example, to apply common data loss prevention policies across all resources in the finance domain.