The Fabric admin portal and tenant settings

What the admin portal contains

The Fabric admin portal (reached from the service, or via the admin APIs) is the governance surface for the entire tenant. Its main sections:

• Tenant settings — 170+ toggles controlling features, sharing, export, developer access, and information protection across the whole org. This is the security-critical section (its own concept).
• Capacity settings — the F-SKU (and legacy P-SKU) capacities, their admins, and workspace assignment.
• Workspaces — an org-wide list of every workspace, its state, and its capacity.
• Domains — Fabric domains that group workspaces for federated governance.
• Embed codes / Publish-to-web — the inventory of publicly exposed reports (a critical audit list).
• Usage / audit — links into activity logging and the admin monitoring workspace.

The admin roles

Access to this surface comes from Entra ID roles, not from Power BI itself:

• Fabric administrator (formerly Power BI administrator) — full control of tenant settings, capacities and workspaces.
• Global administrator — inherits Fabric admin rights.
• Capacity admins — delegated control of a specific capacity only, not the tenant.

The least-privilege pattern is a small named set of Fabric admins, with capacity admins delegated per-capacity — not everyone holding Global Admin.

How governance delegates downward

Tenant settings sit at the top and can be scoped to security groups. Below them, capacity admins control workload behaviour on their capacity, and workspace admins control their container. Governance is therefore layered: tenant → capacity → workspace → item. A mistake at the tenant layer (a dangerous toggle set org-wide) overrides all the careful work below it.

Failure modes

• Global Admin sprawl. Because Global Admin inherits Fabric admin, an oversized Global Admin population is an oversized Power BI admin population — often unnoticed.
• Unattributed change. Multiple admins editing 170+ settings with no diff means dangerous changes (publish-to-web on, export loosened) land silently.
• Default drift. Microsoft ships feature launches that flip defaults; a setting reviewed a year ago may not be in the state you left it.
• Capacity-admin over-grant. Handing capacity admin broadly lets people move workspaces onto/off capacity and change workload settings that affect cost and performance.

What to watch (proofs)

• Admin population: Get-MgDirectoryRole / role membership for Fabric administrator and Global administrator — the count of people who can change the whole tenant.
• The full settings state, nightly: serv365 scans all 171 Fabric tenant settings, canonicalises and diffs them — every change dated and attributed (the drift concept).
• Capacity and workspace inventory: Get-PowerBICapacity and Get-PowerBIWorkspace -Scope Organization, plus the admin/capacities and admin/groups REST endpoints — the estate map.
• Change attribution: the Fabric activity log records tenant-setting edits with the actor — an unexpected admin on a security toggle is an incident.
• Publish-to-web inventory: the admin portal's embed-codes list — every publicly exposed report, enumerated.