Enable workspace outbound access protection

Workspace outbound access protection in Microsoft Fabric lets admins secure the outbound data connections from items in their workspaces to external resources. Admins can block all outbound connections, and then allow only approved connections to external resources through secure links between Fabric and virtual networks. Learn more.

This article explains how to configure outbound access protection for your Fabric workspaces to block all outbound connections by default. After completing the steps in this article, you can enable outbound access through managed private endpoints or data connection rules.

Prerequisites

• Make sure you have an admin role in the workspace.

• Make sure the workspace where you want to set up outbound access protection resides on a Fabric capacity (F SKUs). No other capacity types are supported. You can check assignment by going to the workspace settings and selecting License info.

• The tenant setting Configure workspace-level outbound network rules must be enabled by a Fabric tenant administrator. See Manage admin access to outbound access protection settings.

• The Microsoft.Network feature must be re-registered for the subscription. From the Azure portal home page, go to Subscriptions > Settings > Resource providers. Select Microsoft.Network and select Re-register.

Enable workspace outbound access protection

{
  "inbound": {
    "publicAccessRules": {
      "defaultAction": "Allow"
    }
  },
  "outbound": {
    "publicAccessRules": {
      "defaultAction": "Deny"
    }
  }
}

After outbound public access is blocked, you can create an allow list of approved connections to external resources using either data connection rules or managed private endpoints.

Next steps

• Create an allow list with managed private endpoints