13Federated Data Governance — Purview, Databricks & Fabric on One Policy Plane
One governance pane for Databricks and Fabric — RLS gap managed, not hidden
Role: Governance Solution Engineer
Executive summary
Integrated Microsoft Purview with Azure Databricks and Microsoft Fabric to deliver a unified catalog, cross-platform masking and an Entra ID-based access model—giving a financial-services client a single governance pane.
- Microsoft Purview
- Azure Databricks
- Unity Catalog
- Microsoft Fabric
- Entra ID
- RLS / CLS
- Conditional Access
A key Financial Services concern is governance consistency across multiple data platforms. I worked on federated data governance in Azure, integrating Microsoft Purview with Azure Databricks and Microsoft Fabric for a single pane of cataloging, lineage and policy across the data estate.
- Configure Purview to scan and catalog Databricks Delta tables (Unity Catalog) and Fabric assets for a unified catalog.
- Implement security/privacy policies spanning platforms (sensitive labels and masking enforceable on both engines).
- Demonstrate RLS and CLS across consumption layers (one policy masking a column in both Databricks and Power BI).
- Use Entra ID so identities and conditional access (MFA) apply uniformly across Spark and Fabric SQL.
- Document a governance operating model (central oversight + domain-managed local permissions).
I connected Purview to the client's Databricks Unity Catalog and registered the Fabric tenant, then created sample classification and masking policies—verifying that a Databricks query returned masked data per Purview policy. For RLS, I aligned Fabric's internal RLS for Power BI with Purview classifications and documented the policy-translation gap with its interim workaround instead of papering over it—a governance design must show its seams. I integrated Entra ID Conditional Access requiring MFA for external access to both Fabric and Databricks, and delivered a technical guide.
The client gained a unified view of assets across Databricks and Fabric in Purview, streamlining discovery and compliance tracking — auditors could obtain lineage regardless of platform from one portal. Consistent masking proved that privacy rules defined centrally can be enforced per platform—verified by the same policy returning masked data on both engines. The federated model allowed domain autonomy under central oversight, and the RLS limitation was shipped inside the design—an explicit exception list the compliance team tracks—so the gap became managed, not hidden.
Cross-platform governance hinges on integration points like Purview connectors, and on the discipline of naming what doesn't propagate yet — presenting the RLS gap as a tracked exception with an interim solution earned more trust than an unqualified "unified governance" pitch would have. Security must be by design, and the Purview scanning and policy engine experience from this project carried directly into later scenarios.