Overview
Important exam status: the old Azure Data Engineer Associate exam, DP-203, retired on 31 March 2025 together with its certification. This page keeps the DP-203 address but covers its replacement, DP-700, which earns Microsoft Certified: Fabric Data Engineer Associate. Domain 1 is one of three equally weighted skill areas at 30–35%.
Microsoft lists four functional groups here. The first configures workspace settings for Spark, Fabric domains, OneLake and data workflows. The second covers lifecycle management with Git version control, database projects and deployment pipelines. The third is security and governance: workspace roles, item permissions, row, column, object and file level controls, dynamic data masking, sensitivity labels and endorsement. The fourth is orchestration, where you choose between a pipeline and a notebook, set schedules and event-based triggers, and pass parameters with dynamic expressions.
How it's tested
Domain 1 questions usually describe a Fabric workspace, a team with different roles and a governance or release requirement. You pick the setting, role, permission or orchestration item that meets the requirement with the least access and effort. Expect several answer choices that would work but grant more access than needed.
-
Least privilege in Fabric
Users need to read one table or run queries only, and you choose between workspace roles, item permissions and SQL-level grants.
-
Promote safely
Content moves from development to production, and you pick Git integration, deployment pipelines, deployment rules or a database project.
-
Pipeline or notebook
A process must copy, branch, loop or transform, and you decide which item orchestrates it and how parameters and triggers are passed.
Analysts must query a warehouse but must never see the national ID column, and they must not edit any workspace item. A Viewer workspace role is too broad if other items are sensitive, so share the warehouse with Read and ReadData instead. Then apply column-level security with GRANT SELECT on the permitted columns only. Dynamic data masking alone is weaker, because it hides values rather than blocking access.
Functional groups 4
Official functional groups from the Microsoft outline, in outline order.
1.1 Configure Microsoft Fabric workspace settingsSpark, domain, OneLake and data workflow settings at workspace level.
- What it means
- This group covers the workspace settings a data engineer controls: Spark settings such as the default pool, runtime version, environments and high concurrency; assigning the workspace to a Fabric domain; OneLake settings such as access from apps outside Fabric and shortcut caching; and settings for data workflows, the Apache Airflow job experience in Fabric.
- What to understand
- Starter pools start sessions in seconds because nodes are prewarmed, while custom pools let you set node size, autoscale and dynamic executor allocation at the cost of slower startup. An environment bundles libraries, Spark properties and a runtime, and can be set as the workspace default. High concurrency mode lets several notebooks share one Spark session. Fabric domains group workspaces by business area so governance and discovery follow the organization; a workspace belongs to one domain. Data workflows run Airflow DAGs on a starter or custom pool configured in workspace settings.
- How it shows up
- Expect a requirement such as faster session startup, a shared library set, or grouping workspaces for a department, and choose the setting.
- Common confusion
- Confusing Fabric domains, which group workspaces, with the DP-700 exam domains or with the Microsoft Entra ID tenant domain.
1.2 Implement lifecycle management in FabricGit version control, database projects and deployment pipelines.
- What it means
- This group covers connecting a workspace to Git in Azure DevOps or GitHub, committing and updating items through a branch, managing warehouse or SQL database schema as a database project, and creating deployment pipelines that promote content through stages such as development, test and production.
- What to understand
- Git integration connects one workspace to one branch and folder; you commit workspace changes to Git or update the workspace from Git, and resolve conflicts when both sides changed. Developers often work in their own branch and workspace, then merge with a pull request. A database project stores warehouse objects as SQL scripts that build into a DACPAC for schema compare and deployment. Deployment pipelines have between two and ten stages, compare content between stages, and use deployment rules or variable libraries to change data sources or parameters per stage. Data is not copied by deployment, only item definitions.
- How it shows up
- Expect a release process and a choice between Git integration, deployment pipelines, deployment rules or a database project.
- Common confusion
- Assuming a deployment pipeline copies lakehouse data or warehouse rows to the next stage; it deploys metadata and definitions.
1.3 Configure security and governanceWorkspace and item access, granular data controls, masking, labels and endorsement.
- What it means
- This group covers granting access with workspace roles and item sharing, enforcing row-level, column-level, object-level and file-level controls, applying dynamic data masking, applying Microsoft Purview sensitivity labels to Fabric items, and endorsing items as promoted or certified so users can find trusted content.
- What to understand
- Workspace roles are Admin, Member, Contributor and Viewer; Contributor and above can edit items and see unmasked data. Item sharing grants narrower permissions such as Read, ReadData for the SQL analytics endpoint, ReadAll for OneLake files, and Build for semantic models. In a warehouse, row-level security uses an inline table-valued predicate function bound by a security policy, column and object level use GRANT and DENY, and OneLake security roles restrict folders and files in a lakehouse. Dynamic data masking hides values with functions such as default, email, random and partial, and the UNMASK permission reveals them. Sensitivity labels flow to downstream items and exports. Certification requires an authorized reviewer set by an admin.
- How it shows up
- Expect a requirement to hide rows, columns or files from a specific group and a choice of the narrowest control.
- Common confusion
- Treating dynamic data masking as security; users with query access can still infer masked values, so use column-level security to block access.
1.4 Orchestrate processesPipelines versus notebooks, schedules and triggers, and parameterized patterns.
- What it means
- This group covers deciding whether a pipeline or a notebook should run a process, designing schedules and event-based triggers, and building orchestration patterns where pipelines call notebooks and other pipelines using parameters and dynamic expressions.
- What to understand
- Pipelines suit low-code orchestration: Copy activity, control flow such as ForEach, If Condition and Until, dependency paths on success or failure, and alerts through Outlook or Teams activities. Notebooks suit code-first transformation and can orchestrate other notebooks with notebookutils.notebook.run or runMultiple, which accepts a DAG with dependencies and concurrency. Schedules run items on a time basis, and event-based triggers start a pipeline when, for example, a file lands in OneLake or Azure Blob Storage. Parameters pass into notebooks through a cell marked as the parameter cell, and dynamic expressions such as @pipeline().parameters.date or @activity('Lookup').output build values at run time. A notebook can return a value with notebookutils.notebook.exit.
- How it shows up
- Expect a scenario asking which item to orchestrate with, how to start it on an event, or how to pass a value.
- Common confusion
- Thinking a notebook parameter works without a parameter cell; the pipeline value only overrides variables in the cell toggled as parameters.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Starter pool
Prewarmed Spark pool that Fabric provides for each workspace.
- Remember
- Fast session start, limited customization.
- Tested as
- Workspace settings questions.
- Trap
- Choosing a custom pool when the requirement is startup speed.
-
Environment
Fabric item holding libraries, Spark properties and runtime choice.
- Remember
- Can be the workspace default.
- Tested as
- Library and configuration questions.
- Trap
- Installing libraries inline in every notebook.
-
Fabric domain
Logical grouping of workspaces by business area, with domain admins.
- Remember
- Supports federated governance.
- Tested as
- Governance questions.
- Trap
- Confusing it with a DNS or Entra ID domain.
-
Git integration
Links a workspace to a branch in Azure DevOps or GitHub.
- Remember
- Commit and update are separate actions.
- Tested as
- Version control questions.
- Trap
- Expecting data to be stored in Git.
-
Deployment pipeline
Stage-based promotion of Fabric items, two to ten stages.
- Remember
- Deployment rules change sources per stage.
- Tested as
- Release questions.
- Trap
- Assuming it moves table data.
-
Database project
Source-controlled warehouse schema built as a DACPAC.
- Remember
- Supports schema compare and repeatable deployment.
- Tested as
- Warehouse lifecycle questions.
- Trap
- Using it for lakehouse files.
-
Workspace roles
Admin, Member, Contributor and Viewer.
- Remember
- Contributor can edit and sees unmasked data.
- Tested as
- Access questions.
- Trap
- Granting Contributor when read is enough.
-
Item permissions
Read, ReadData, ReadAll and Build on a shared item.
- Remember
- Narrower than a workspace role.
- Tested as
- Least privilege questions.
- Trap
- Sharing the whole workspace.
-
Row-level security
Predicate function plus security policy that filters rows.
- Remember
- Applies to SQL queries, not to Spark reading OneLake files directly.
- Tested as
- Data access questions.
- Trap
- Expecting RLS to protect files read with ReadAll.
-
Dynamic data masking
Masks column values in query results.
- Remember
- UNMASK reveals; admins see real data.
- Tested as
- Privacy questions.
- Trap
- Treating it as access control.
-
Sensitivity labels
Purview labels applied to Fabric items.
- Remember
- Labels inherit downstream and persist on export.
- Tested as
- Compliance questions.
- Trap
- Confusing labels with endorsement.
-
Endorsement
Promoted or certified marking on items.
- Remember
- Certified needs an authorized certifier.
- Tested as
- Discovery questions.
- Trap
- Expecting endorsement to restrict access.
-
notebookutils.notebook.runMultiple
Runs several notebooks in one session, optionally as a DAG.
- Remember
- Supports dependencies and concurrency.
- Tested as
- Orchestration questions.
- Trap
- Building a pipeline when a notebook DAG is enough.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Fabric access layers
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Workspace role | Access to every item in a workspace | Broadest control | Using Viewer to restrict one table |
| Item permission | Access to one shared item | Read, ReadData, ReadAll, Build | Forgetting ReadAll exposes OneLake files |
| SQL granular security | RLS, CLS and OLS in the warehouse or SQL endpoint | Applies to T-SQL queries | Assuming Spark honors it |
| OneLake security role | Folder and file access in a lakehouse | Covers file-level control | Using SQL GRANT for files |
Lifecycle tools
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Git integration | Source control for item definitions | Branching and pull requests | Using it as a promotion tool on its own |
| Deployment pipeline | Stage-to-stage promotion | Rules adjust connections per stage | Expecting data copy |
| Database project | Warehouse schema as code | Builds a DACPAC | Applying it to Spark tables |
Pipeline vs notebook orchestration
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Pipeline | Low-code activities and control flow | Copy, ForEach, triggers, alerts | Writing complex transforms in expressions |
| Notebook | Code-first Spark with notebookutils | runMultiple DAG in one session | Using it for simple scheduled copies |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Viewer is always safe
- What candidates pick
- Assign the Viewer role so analysts can read one warehouse.
- Why it looks right
- Viewer sounds like the lowest access level.
- Why it's wrong
- Viewer exposes every item in the workspace; sharing one item with ReadData is narrower.
Clue to watch for Only one item or one table is mentioned.
-
Masking as a block
- What candidates pick
- Apply dynamic data masking to stop users reading compensation data.
- Why it looks right
- Masked output looks protected.
- Why it's wrong
- Masking only obscures results; column-level security denies the column itself.
Clue to watch for The requirement says users must not access the column.
-
Pipeline copies data
- What candidates pick
- Use a deployment pipeline to move test tables to production.
- Why it looks right
- Pipelines move content between stages.
- Why it's wrong
- Deployment pipelines promote definitions and metadata, not stored rows or files.
Clue to watch for The scenario needs data, not schema, in the target stage.
-
Contributor for reviewers
- What candidates pick
- Grant Contributor to reviewers who only check reports.
- Why it looks right
- Contributor seems moderate.
- Why it's wrong
- Contributor can edit items and sees unmasked data, which breaks least privilege.
Clue to watch for The users only read or review content.
-
RLS protects files
- What candidates pick
- Rely on warehouse row-level security for Spark users reading OneLake files.
- Why it looks right
- The same data is involved.
- Why it's wrong
- SQL security applies to T-SQL queries; file access needs OneLake security roles.
Clue to watch for Users read with Spark or have ReadAll.
-
Endorsement restricts access
- What candidates pick
- Certify a lakehouse so only approved users can open it.
- Why it looks right
- Certified sounds controlled.
- Why it's wrong
- Endorsement signals trust and helps discovery; it grants or removes no permissions.
Clue to watch for The goal is helping users find trusted data.
Answer framework
Work through these steps when a Domain 1 scenario asks how to configure, secure or orchestrate Fabric.
- Identify the scope: the whole workspace, one item, certain rows or columns, files in OneLake, or a process that needs running.
- For access, start with the narrowest option: item permissions, then SQL row, column or object controls, then OneLake security roles, and only then workspace roles.
- For release, use Git integration for versioning and branching, deployment pipelines with rules to promote between stages, and database projects for warehouse schema.
- For orchestration, choose a pipeline for copy and control flow with alerts, or a notebook DAG with runMultiple for code-heavy Spark work.
- Finish with governance: correct domain assignment, sensitivity labels, endorsement, and workspace Spark or OneLake settings that match the stated need.
Practice question
Want more like this? The DP-700 practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin by setting aside any DP-203 notes on Synapse dedicated pools; they will mislead you here. Create a Fabric trial or capacity workspace and change the Spark settings yourself: switch between starter and custom pools, attach an environment with one extra library and note how startup time changes. Assign the workspace to a domain so the governance view makes sense.
Next, connect the workspace to a GitHub or Azure DevOps repository, commit a notebook, edit it in the repository and update the workspace. Then build a three-stage deployment pipeline with a rule that switches a lakehouse connection. Keep a small warehouse to practice a security policy, column grants and a masked column, testing each with a second user account.
Finish with orchestration. Build a pipeline that runs a parameterized notebook inside ForEach, add a storage event trigger and a failure path that sends a Teams message. Then reproduce the same flow with runMultiple so you can argue for either option in a question.
FAQ
How much of DP-700 is Domain 1, Implement and manage an analytics solution?
Microsoft weights it at 30–35%, the same range as the other two skill areas. It contains four functional groups: workspace settings, lifecycle management, security and governance, and orchestration.
Is DP-203 still available?
No. Microsoft retired the Azure Data Engineer Associate certification and its renewal assessment on 31 March 2025. DP-700, Microsoft Certified: Fabric Data Engineer Associate, is the data engineering replacement and is what this page covers.
Does a deployment pipeline move data between stages?
No. It deploys item definitions and metadata. Each stage keeps its own data, and deployment rules can repoint data sources per stage.
Is dynamic data masking enough to protect sensitive columns?
Not for strict requirements. Masking changes what results show, but column-level security with GRANT and DENY is what blocks access.
When should I use a notebook instead of a pipeline to orchestrate?
Use a notebook when the work is mostly Spark code and steps can share one session, for example with runMultiple. Use a pipeline for copy activities, control flow, triggers and alerts.
What does endorsement do in Fabric?
It marks items as promoted or certified so users can find trusted content. It does not change who can open the item.
Which Git providers does Fabric support?
Fabric Git integration works with Azure DevOps and GitHub repositories, connecting each workspace to one branch and folder.
Other Data & Analytics certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 1 knowledge
You have reviewed workspace settings, Git and deployment pipelines, Fabric security layers and orchestration. Check whether you can pick the narrowest control and the right orchestration item.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the DP-700 AI tutor Get any concept explained your way