Microsoft Fabric Data Engineer Associate DP-700 Practice Question

In Microsoft Fabric, every workspace item (such as a notebook, lakehouse, semantic model, or report) has its own access control list that is independent from the workspace roles. Granting someone a workspace role (Viewer, Member, or Admin) automatically exposes all items in that workspace, which violates the requirement to limit visibility. Instead, you can leave the contractor out of all workspace roles and open the Manage permissions (or Direct access) pane for the specific notebook. There you can add the contractor's user account and assign Read permission just to that single item. Because the contractor is not a workspace member and has no permissions on any other items, the notebook remains the only object visible and accessible. Other settings-such as turning off the workspace's download capability, applying row-level security to data sources, or sharing through app workspaces-do not achieve the needed item-level isolation for a single notebook.