For years, Fabric governance has meant tenant settings: a switch that's on for everyone or off for everyone, softened at best by a security group. Fabric Policies, introduced in September 2026, replace that blunt instrument with rules that describe who may do what, and where. For example, you can let only the finance engineers create Dataflows Gen2, and only in their own workspaces.

This session is a practical introduction for tenant and capacity admins. We start with the model: Policy Sets as Fabric items, the Policies Center in the OneLake Catalog, and how rules combine (AND within a rule, OR across rules). Then we look at the part that catches people out. When no rule matches, the action is denied. Activate an item-creation policy with a single Allow rule, and you have blocked every other item type on that capacity.

From there we build real policies for item creation, security-sensitive workspace settings, and external data sharing. We manage them through the REST APIs and Git, and trace their lifecycle in the audit log. You'll leave knowing where Fabric Policies fit next to tenant settings, Purview DLP and connection policies, and how to roll them out without locking out your own users.