What access controls should be applied per data asset to secure Fabric assets?

• A. Public by default
• B. RBAC and ACLs per asset with MFA and conditional access.
• C. Global admin access only
• D. IP-based allowlists only

Answer: (B)

Granular, identity-driven access control for each data asset is essential in Fabric. Apply RBAC and per-asset ACLs so permissions are assigned by role and by asset, ensuring least privilege and precise control over who can read, write, or manage each asset. Adding MFA strengthens authentication, so even stolen credentials can’t grant immediate access. Conditional access sharpens security further by evaluating context such as location, device health, and risk signals to allow, require additional verification, or block access as needed. This combination provides layered protection that scales across many assets and users.

Public by default would expose data to everyone, which is unsafe. Relying on global admin access is too coarse and concentrates risk in a single set of powerful accounts. IP-based allowlists alone don’t address user identity or per-asset permissions and can be circumvented or become brittle as environments change.