Tenant-wide visibility of networking policies in Microsoft Fabric

The List Networking Communication Policies API provides a tenant-wide, paginated view of inbound and outbound networking settings across all workspaces in Microsoft Fabric. It helps administrators audit public access rules, IP firewalls, Git policies, gateways, and managed private endpoints.

Use cases

Imagine you need to audit which workspaces in the tenant have public access blocked or restricted outbound rules. With this API, you can:

• Retrieve a complete inventory of inbound and outbound network rules for all workspaces.
• Filter workspaces based on inbound or outbound policy directions.
• Audit managed private endpoints and allowed connections.

How to use

You can query the data by making an HTTP GET request to the administrative endpoint.

GET https://api.fabric.microsoft.com/v1/admin/workspaces/networking/communicationpolicies

What happens in this code:

1. The request is sent to the Fabric networking communication policies admin endpoint.
2. The service validates the caller's administrator permissions.
3. The API returns a paginated list containing the network policies for all workspaces in the tenant.

To filter only workspaces with inbound public access denied, use the filter query parameter:

GET https://api.fabric.microsoft.com/v1/admin/workspaces/networking/communicationpolicies?filter=inbound/publicAccessRules/defaultAction eq 'deny'

What happens in this code:

1. The filter parameter is applied to the request URL.
2. Fabric processes the expression to isolate matching workspaces.
3. The response returns only items matching the inbound denial criteria.

Limitations and requirements

• Stage: Generally Available (GA).
• Permissions: The caller must be a Fabric administrator or authenticate using a service principal.
• Required delegated scopes: Tenant.Read.All or Tenant.ReadWrite.All.