Limiting the worst-case bill from a Fabric F2 capacity

I passed DP-600. Below is a setup I had for making a Fabric F2 Capacity for personal testing with a limited blast radius. Headers so you can skip sections that aren’t relevant.

Background

A lot of companies only use part of Fabric, so getting experience with the whole ecosystem can be tough. I’m more familiar with Databricks for engineering/ML, and Fabric for dataflows, Power BI, and Copilot. There’s some serious strengths in an overlapping Databricks/Fabric ecosystem (for a future post), but since Fabric is designed to be end-to-end, some of the more Microsoft-specific exam components including its eventstream implementation, dataflows writing into a lakehouse, domains, and Fabric Python libraries weren’t part of my day-to-day stack.

It’s possible to set up Fabric for cheap on Azure, less than a dollar an hour, pennies when you pause it. Fabric is also a single resource that is contained, no worrying about making networking and external storage pieces mix together by default, so it’s super easy to provision and manage through the front-end. I use Terraform for other hosts (Ramnode, Railway, and Backblaze being some of them), but only when there’s a hard spending cap. None of my personal machines will ever have api or terminal access to anything with unlimited spending.

With pay-as-you-go on Azure, there’s no hard spending cap. You sign an agreement saying you’re going to pay for the resources you provision. I’ve read horror stories about people being on the hook for a $40k gpu mining operation on their account, or leaving an expensive service running. I love Azure and fear it in equal measures. I think that’s healthy.

Okay, so the setup.

Objects

At a high level there’s two administrator accounts. One as a global admin in entra, one as an admin in Azure in case for some reason the global admin was locked out and there was a resource still online.

Entra

I created these accounts. The admin and analyst aren’t strictly needed. Analyst is useful if you want to test out role based access controls, which the exam covers. Contributor and above roles in Fabric workspace can sidestep some of the rules, so it’s useful to have someone where you can see what it looks like from their perspective.

• me@my_domain.onmicrosoft.com: card and billing relationship
• admin@my_domain.onmicrosoft.com: global admin, subscription owner
• jonathan@my_domain.onmicrosoft.com: daily account, capacity admin and operator role (custom role created, more below)
• analyst@my_domain.onmicrosoft.com: test identity, no admin roles

In entra, I enforced MFA and created the four accounts. Set them up one at a time.

Fabric

In https://app.fabric.microsoft.com/, I signed in with admin, jonathan, and analyst to set up their free accounts. Admin is required to sign in so it can create the capacity.

Azure

Single subscription fabric-test, created by admin, signed in private mode on my browser. The me and admin accounts are kept signed out. These are the only two accounts that can create subscriptions.

In fabric-test I created the objects:

• Policies: allowed resource types (Fabric capacities, action groups, and activity log alerts), allowed locations (eastus), and a custom F2-only SKU rule.
• Logging and alerting:
  • Catch-all activity log alert rule
  • Action group for emailing my account
• Budget alerts
• Fabric F2 capacity, created with jonathan as the admin.
• Fabric Operator role

The F2 SKU rule:

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Fabric/capacities"
        },
        {
          "not": {
            "field": "Microsoft.Fabric/capacities/sku.name",
            "equals": "F2"
          }
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

The custom Azure Fabric operator role has Read Fabric capacity, suspend Fabric capacity, and resume Fabric capacity. It’s assigned to jonathan, the account that stays signed in. It’s upper limited at about $260 a month. The built-in contributor grant would let it create more F2 capacities, so that was out, since the policy limits size and not count.

{
  "assignableScopes": [
    "/subscriptions/<subscription-id>"
  ],
  "permissions": [
    {
      "actions": [
        "Microsoft.Fabric/capacities/resume/action",
        "Microsoft.Fabric/capacities/suspend/action",
        "Microsoft.Fabric/capacities/read"
      ],
      "notActions": [],
      "dataActions": [],
      "notDataActions": []
    }
  ]
}

Capacity admin and the operator role are separate systems. Capacity admin is a Fabric setting that lets jonathan assign workspaces to the capacity. Pausing is an Azure action, so it needs the custom role too.

If you use Copilot, you might come up against capacity limits (I’ve written about it here, here, and here). If you’re comfortable you can widen the SKU limits to F2-F4, allow write, and scope the role to a single existing capacity.

Daily driver can spend money, but it’s capped above by simply leaving the Fabric capacity online. Annoying more than devastating.

Guardrails

• MFA
• Subscription is locked down to a single paying resource
• Anyone who can create resources is signed out by default, only accessed from ephemeral sessions
• The only user that is capable of triggering spend is limited by about $260 a month
• Every change to an Azure resource triggers a log alert email
• Budget alerts at $5, $20, and $50

Final

So that’s the setup that’s worked for me. The holes I know about: admin and me can remove the policies, so if either is compromised there’s no cap, and budget alerts lag about a day behind spend. Let me know the other holes you see.

Fabric is much wider and more capable than I had imagined in my prior roles. A lot of headaches I had about Power BI, thinking Microsoft did something backwards, were actually “no, that’s not what that tool is for.” Knowing how Microsoft conceptualizes its system makes it easier to understand how to coordinate with other tools, like Databricks. While certification without use can be hollow, use without certification can lead to misunderstandings.

I’m excited to do more building on the platform.