Configure Microsoft Fabric workspace settings

The exam objective groups Spark, domain, OneLake, and Apache Airflow settings under one heading. This chapter covers all four. The reliable way to reason through them is to identify the administrative scope, the workload or data affected, and the operational consequence before selecting an option.

Objective coverage

Orient yourself: OneLake, workspace, item

OneLake is the single organizational data lake supplied with a Fabric tenant. Workspaces divide that lake into independently administered project or domain containers. A OneLake workspace setting therefore controls storage or diagnostics behavior for that workspace; it does not create another OneLake.

Keep three scopes separate:

Changing a workspace setting is not the same as granting access to data. Workspace roles and OneLake security roles belong to the security model; storage-tier and diagnostic settings govern how workspace data is retained, observed, or billed.

Configure Spark workspace settings

Fabric supplies managed Spark compute for Data Engineering and Data Science. At workspace scope, the administrator establishes the default compute behavior and decides whether individual environment items may override it. That governance switch is the first exam distinction:

In the portal, the path is Workspace settings > Data Engineering/Science > Spark settings. The workspace administrator can select or create a pool and control whether item-level customization is allowed. An environment can then define a runtime, pool, driver sizing, and executor sizing when the workspace policy permits it.

Separate the Spark configuration layers

An environment change is not active merely because it was edited. Runtime and library changes must be saved and published. Publishing can fail when the selected runtime is incompatible with configured libraries or compute settings.

Choose a Spark pool and size compute

• Use the workspace default when workloads have similar requirements and centralized consistency matters most.
• Allow environment overrides when distinct workloads need different runtimes or driver/executor resources.
• Choose a starter pool when fast startup and managed defaults fit the workload.
• Choose an approved custom pool when node family, node size, autoscale, or dynamic allocation requirements justify dedicated configuration.
• Size the driver for coordination and planning needs; size executors for distributed processing. More resources are not automatically better if they reduce concurrency or waste capacity.

When an exam question describes every notebook inheriting an unsuitable configuration, start at the workspace default. When only one workload needs different compute, look for an environment-level override—provided the workspace administrator has enabled customization.

Configure domain workspace settings

A Fabric domain is a logical business grouping used for organization, discovery, and federated governance. Assigning a workspace to a domain associates every item in that workspace with the domain and adds domain metadata that users can filter in the OneLake catalog.

Domain assignment does not grant access to the workspace or its items. Visibility and data access still depend on workspace roles, item permissions, and data security. This is a frequent exam trap: domain membership organizes and governs; it is not an authorization grant.

Know who can perform each domain action

Fabric and domain administrators can assign workspaces centrally. A domain contributor works from the workspace settings and must also hold the workspace Admin role. Subdomains refine the logical hierarchy but inherit the administrators of their parent domain.

Default domains and delegated governance

A default domain targets specified users or security groups. Existing unassigned workspaces administered by those principals are assigned to the default domain, and new workspaces they create are assigned automatically. Existing domain assignments are preserved rather than overwritten by the default-domain mechanism.

Some tenant settings can be delegated to domain administration. That enables a business area to apply domain-specific governance within boundaries established at tenant scope. Delegation does not transfer every Fabric-administrator capability to the domain administrator.

Use these clues in scenario questions:

• Improve catalog discovery by business area: assign workspaces to domains.
• Automatically organize new workspaces for a department: configure a default domain for the department's users or groups.
• Let business owners manage an allowed governance setting: delegate the supported tenant setting to domain scope.
• Restrict access to domain data: use workspace, item, or OneLake security—not domain assignment alone.

Terminology that drives the decision

What the OneLake settings control

The settings are related but not interchangeable. Diagnostics produces evidence. Immutability protects that evidence. The default tier supplies a baseline for untiered files. Lifecycle rules change tiers later when their conditions are met.

Responsibility and prerequisite boundaries

A workspace administrator manages these OneLake settings. For diagnostics, the administrator also needs contributor access to the destination lakehouse. Microsoft Learn states that the destination lakehouse must be in the same capacity as the workspaces being monitored. Network protection can narrow the valid destination further.

Before enabling diagnostics, verify:

1. A suitable lakehouse exists for the diagnostic events.
2. Capacity and network placement meet the documented constraints.
3. The configuring principal has both workspace-admin and destination-lakehouse permissions.
4. Retention, privacy, and cleanup ownership are agreed before immutability is applied.

That last check is deliberately operational. Immutability is not a temporary display option: protected files remain noneditable and nondeletable until their individual retention windows expire.

Choose storage behavior deliberately

Hot, cool, and cold tiers exchange storage cost for access cost and minimum-retention commitments. The OneLake storage-tier documentation identifies a 30-day minimum for cool storage and a 90-day minimum for cold storage. Moving or deleting data before the applicable minimum can incur an early-deletion charge.

Use this sequence:

1. Measure how often the data is read and changed.
2. Separate active paths from retention-oriented paths.
3. Estimate storage savings together with retrieval, transaction, and early-deletion costs.
4. Set a default tier only when it is appropriate for files that do not carry an explicit tier.
5. Use path-scoped lifecycle rules when different parts of the workspace have different access patterns.

Do not select the coldest tier merely because it has the lowest storage rate. A frequently queried dataset can cost more overall and perform less predictably when retrieval behavior is ignored.

Build a lifecycle policy from the evidence

A workspace has one lifecycle policy containing rules. A rule combines a scope, enabled state, time condition, and tiering action. Conditions can use age since creation, modification, or last access. Rules without a path filter affect all eligible files in the workspace, so a broad rule deserves explicit review.

Example decision—not a production prescription:

{
  "rules": [
    {
      "name": "cool-stable-diagnostic-exports",
      "enabled": true,
      "scope": "Files/DiagnosticExports/",
      "condition": "daysAfterModificationGreaterThan: 30",
      "action": "tierToCool"
    }
  ]
}

The example expresses intent in a readable form. When implementing a policy, use the current portal or API schema from Microsoft Learn rather than treating this study representation as an importable payload.

Lifecycle changes are asynchronous. Microsoft Learn notes that new rules can take up to 24 hours to take effect and that policies attempt to run daily. An exam scenario that requires an immediate, one-time tier change is therefore different from a scenario asking for ongoing automated management.

Portal and API views describe the same workspace state

In the portal, lifecycle management is under Workspace settings > OneLake > Lifecycle management. The Fabric REST API can also retrieve workspace OneLake settings:

GET https://api.fabric.microsoft.com/v1/workspaces/{workspaceId}/onelake/settings

The caller must have the Admin workspace role and an appropriate delegated scope such as OneLake.Read.All or OneLake.ReadWrite.All. A response can report diagnostics status, diagnostic-log immutability, and lifecycle state, including the default tier. Reading settings does not itself enable or modify them.

Configure Apache Airflow workspace settings

Fabric Apache Airflow jobs use a workspace default runtime chosen under Workspace settings > Data Factory > Apache Airflow Runtime Settings. The main decision is whether to use the managed starter pool or create a custom pool.

If item-level compute customization is disabled, Airflow environments use the workspace starter pool. When a custom pool is justified, the workspace administrator chooses its name, compute-node size, autoscale behavior, and extra nodes. Extra nodes increase concurrent DAG worker capacity; they are a concurrency decision, not a substitute for fixing an inefficient DAG.

Translate workload evidence into Airflow settings

Use a starter pool when the workload is intermittent, development-oriented, and tolerant of the managed configuration. Consider a custom pool when production scheduling needs predictable availability, nondefault sizing, autoscaling, or more concurrent workers.

A useful decision sequence is:

1. Measure concurrent DAG runs, task duration, and scheduling delay.
2. Separate startup-delay problems from insufficient worker-concurrency problems.
3. Choose node size for task requirements and extra nodes for justified concurrency.
4. Enable autoscaling when demand varies enough to outweigh the added operational complexity.
5. Define who pauses, resumes, monitors, and revises the pool.

Current Microsoft Learn documentation states that Fabric Apache Airflow jobs do not support private networks or virtual networks. Treat that as a time-sensitive product limitation and recheck the authoritative source when designing a secured deployment.

Troubleshooting and practice

Spark practice. In a test workspace, record the default pool and whether item customization is enabled. Attach an environment to a notebook, change its runtime or pool, save without publishing, and predict which configuration the next session will use. Publish and repeat. If publication fails, inspect runtime and library compatibility; if a session starts with unexpected resources, compare workspace default, environment publication state, attached environment, and session-level configuration. Distinguish slow startup from slow execution: starter-pool availability affects the former, while partitioning, shuffle, skew, executor sizing, and capacity pressure affect the latter.

Domain practice. Draw a tenant with Sales and Finance domains, one subdomain, two default-domain groups, and an already assigned shared workspace. Predict the workspace assignment after each administrator creates a new workspace. Then verify who can assign each workspace and whether a consumer gains access. If an assignment control is unavailable, check Fabric/domain role, workspace Admin, the domain's allowed contributors, and tenant delegation. If catalog placement is correct but access is denied, stop troubleshooting domains and inspect workspace, item, and data permissions.

OneLake practice. Design a diagnostics destination and a lifecycle rule for Files/DiagnosticExports/. Record capacity placement, configuring identity, immutability period, path scope, age condition, tier action, and cleanup owner. After enabling, allow for documented activation and asynchronous evaluation instead of repeatedly toggling settings. For missing diagnostic events, check destination prerequisites, permissions, activation time, and the requested access route. For unexpected tiering, inspect default tier, explicit file tier, rule scope, time basis, access-time tracking, minimum-retention cost, and the policy's asynchronous run—not only the file's current modified timestamp.

Airflow practice. Given four concurrent DAGs, separate scheduler delay, pool-resume delay, worker saturation, and slow task code. Compare starter versus custom pool, node size, extra nodes, autoscale, and uptime ownership. Create a decision record for an intermittent development workload and a production workload with a start-time objective. If an Airflow environment uses an unexpected pool, check the workspace default and whether item customization is allowed. If tasks queue after the environment is running, examine worker concurrency and task demand before increasing compute.

Scenario drills

Spark: one workload, different runtime

A workspace uses the starter pool and the default runtime for every job. One machine-learning notebook needs a newer runtime, a published library, and more executor memory. Other notebooks must remain unchanged. The workspace Admin should first allow item-level compute customization, then the owner should configure an environment with the required runtime, library, pool/resources, save and publish it, and attach it to the notebook. Changing only spark.conf does not select the environment runtime or driver/executor allocation.

The negative tests matter: confirm another notebook still inherits the workspace default; confirm the target notebook fails predictably if the environment is unpublished or incompatible; and confirm the scheduled identity can use the environment and data. If all notebooks instead need the same change, revise the workspace default rather than creating many identical overrides.

Domain: discovery without accidental authorization

The organization wants all new Sales workspaces discoverable under Sales, with Sales data stewards managing supported governance settings. Existing Finance workspaces must not move, and catalog organization must not grant sales staff access. Create a Sales domain, appoint the appropriate domain administrators and contributors, configure a default domain scoped to Sales creators/groups, and delegate only supported governance settings. Existing assigned workspaces remain assigned; eligible unassigned and new workspaces follow the default mechanism.

Test catalog placement and authorization separately. A user who can find the workspace through the domain should still fail to open its items without a workspace/item/data grant. A contributor assigning a workspace must also administer that workspace. This is the exam pattern: domains organize and delegate; security controls authorize.

OneLake: compliance logs and historical data

A compliance workspace needs access diagnostics protected from modification for 180 days. Curated tables are queried hourly, while exported evidence is rarely read after 30 days. Select a same-capacity diagnostic lakehouse satisfying network constraints; grant the configuring workspace Admin appropriate destination access; enable diagnostics; and apply the documented immutability window. Define privacy, reviewer, and cleanup ownership before protection begins.

Keep active curated data hot. Use a path-scoped lifecycle rule for eligible evidence exports after modeling cool/cold minimum retention, access, transaction, and early-deletion cost. Monitor activation and asynchronous lifecycle timing. Diagnostics creates evidence, immutability protects it, lifecycle manages its tier, and a later cleanup process removes it after legal retention. No one setting performs all four jobs.

Airflow: startup objective versus worker capacity

A production team needs DAGs to begin within a predictable window at 06:00 and runs eight independent worker tasks. The managed starter pool is acceptable for development but its availability and configuration do not meet the production objective. Evaluate a custom pool whose active uptime covers the schedule, choose node size from task demand, choose extra nodes from justified concurrent workers, and use autoscaling only when variable demand warrants it. Assign an owner for pause/resume, cost, and monitoring.

If the environment takes time to resume, adjust uptime/pool readiness. If it is running but tasks wait, examine worker concurrency and task duration. If one task is slow, fix or size for that task rather than adding workers. Finally, recheck current network limitations from Microsoft Learn before assuming private/VNet connectivity is supported.

Exam distinctions

• Diagnostics versus monitoring: diagnostics records OneLake data-access events. It is not a replacement for every workload-specific execution or performance log.
• Immutability versus retention cleanup: immutability prevents change during a fixed window; a separate cleanup process is still needed after the window expires.
• Default tier versus lifecycle rule: the default applies when no explicit tier is set; a rule evaluates conditions and changes eligible files over time.
• Workspace setting versus data permission: OneLake storage settings do not grant a user access to a lakehouse, table, row, or folder.
• Workspace admin versus Fabric admin: the workspace administrator manages the workspace policy; tenant-wide enablement and delegation remain tenant concerns.
• Spark workspace default versus environment compute: the workspace establishes the baseline and whether overrides are allowed; an environment holds reusable workload-specific configuration.
• Environment compute versus spark.conf: driver and executor resources belong to environment compute; spark.conf controls application properties inside a session.
• Domain assignment versus authorization: a domain organizes metadata and delegated governance; it does not grant access to workspace items or data.
• Default domain versus forced reassignment: a default domain assigns eligible unassigned and newly created workspaces; it preserves an existing assignment.
• Airflow starter versus custom pool: the starter pool minimizes administration; a custom pool adds control over sizing, autoscaling, concurrency, and uptime.

Active recall

1. Every Spark job in a workspace inherits an unsuitable pool. Which configuration layer should you examine first?
2. One notebook needs a different runtime and executor size. What must the workspace administrator allow before an environment can solve the problem?
3. Why is changing spark.conf not equivalent to changing environment compute?
4. A sales workspace should appear under Sales in the OneLake catalog. Which feature applies, and why does it not grant sales users access?
5. How does a default domain treat a workspace that already belongs to another domain?
6. A compliance team needs access events retained in a tamper-resistant form for 180 days. Which two OneLake capabilities work together, and what cleanup decision remains?
7. A workspace contains frequently queried curated tables and rarely accessed historical exports. Why is one workspace-wide default tier insufficient as the complete design?
8. What permissions and placement constraints must be checked before selecting a diagnostic lakehouse?
9. A question asks for a tier change to happen immediately. Why should you hesitate before choosing lifecycle management?
10. An Airflow team reports slow scheduling during concurrent production DAG runs. Which evidence distinguishes a node-sizing problem from a worker-concurrency problem?

Sources and provenance

This original study chapter was verified against the official Microsoft Learn pages linked below, retrieved September 1, 2026 (Pacific time). The Git-backed source registry records the retrieval timestamp and SHA-256 content hash for each page.