Automatic access restriction via DLP with Microsoft Purview

Use cases

Imagine you store confidential customer data in a lakehouse and a data loss prevention policy detects credit card numbers. With the access restriction action, the system automatically blocks unauthorized users from accessing the data to keep it secure.

• Apply automatic access restrictions based on DLP policies.
• Notify administrators and data owners via alerts and compliance dashboards.
• Monitor violations and policy usage in the Purview portal.

How to use

Configuration is performed directly in the Microsoft Purview compliance portal by creating a custom policy for Microsoft Fabric, selecting sensitivity labels or sensitive info types as conditions, and choosing the restrict access action.

Limitations and requirements

• Generally available for supported items such as lakehouses, warehouses, SQL databases, KQL databases, Cosmos databases, and semantic models.
• Applies only to workspaces hosted in Fabric or Premium capacities.
• Not supported in the China North region.
• Applies to data in Delta format tables, excluding specific complex data types and compression codecs like LZ4, Zstd, and Gzip.

Using it in a pipeline

This validation acts at the governance and security layer, blocking improper consumption of sensitive data right after ingestion and processing in Delta tables within the Silver or Gold layer.