Fabric now has catalog governance, attribute-based policies and access audit. Most of it is for enterprises. Here is the small set a mid-market team needs.
Governance arrived late, and now there is a lot of it
For the first two years, governing Microsoft Fabric meant a handful of tenant settings, workspace roles, and whatever discipline the team brought with them. Through 2026 that changed. The OneLake catalog gained a Govern area that shows a data owner their items, workspaces and domains, how stale they are, how much sensitivity label coverage they have, and which items are endorsed. At FabCon Europe in October it gained table and column level discovery in general availability. Policies in Fabric arrived in preview, letting an administrator restrict who can create which kinds of items. OneLake access audit shows who can reach what. Workspace level surge protection and unified capacity management followed.
It is good tooling. It is also designed for organisations with a data governance office. A UK business with two hundred staff and a two-person data team does not have one, and will not get one. This post is about which parts of the 2026 governance toolset such a team should actually switch on, and which parts they can safely leave until there is a reason.
Start with the question governance is answering
Governance in a mid-market estate exists to answer four questions. Can people find the right data? Can they tell it is the right data? Who can see it? And is anyone looking after it? Everything below maps to one of those four. If a feature does not help answer one of them for your business, it can wait. Our lightweight data governance framework is the longer version of that argument.
Can people find it: OneLake catalog
The OneLake catalog is the front door. With table and column discovery now generally available, someone in finance can search for a column name and find the lakehouse table that holds it, without asking the data team. For that to work, two cheap things need doing. Items need descriptions, a sentence each is enough. And the items you want people to use need endorsing as promoted or certified, so the search result tells them which of the three copies of the sales table is the real one.
That is the whole job for a small team. Domains, which group workspaces by business area, are worth setting up only when you have more than a dozen workspaces. Tags are useful once you have a reason to filter by them. Do not build a taxonomy before you have the content.
Can they tell it is right: endorsement, labels and the Govern area
The Govern area in the catalog gives each data owner a list of recommended actions: increase label coverage, refresh stale items, apply tags. The useful habit is to open it once a month and act on the stale items list. A semantic model nobody has refreshed in ninety days is either dead or dangerous, and the catalog now tells you which items those are.
Sensitivity labels matter for one reason in most mid-market businesses: payroll, HR and anything with customer personal data. Label those items and let the coverage number for everything else sit low. The catalog will nag you about coverage. That is advice for an enterprise, not a rule for you.
Who can see it: OneLake access audit and security
OneLake access audit, now generally available, answers a question that used to take an afternoon: who can see this table? The View users in role view shows, for a given item, every person and group with access and how they got it. Use it before the auditor asks and when someone leaves.
The companion rule is to grant access to groups, never to people. Fabric now supports nested groups in SQL endpoints, so a Finance group containing a Finance Managers group works the way you would expect. If your workspace roles list named individuals, that is the first thing to fix. Our post on row-level security in the FAQ bank covers how to handle it inside semantic models.
Is anyone looking after it: Policies, surge protection and monitoring
Policies in Fabric, in preview, is the feature most likely to save a small team from themselves. It lets you say that only a named group may create lakehouses, or warehouses, or capacity-hungry items, while everyone else can still build reports. It is the Fabric equivalent of the switch we described for Microsoft managed apps: deliberate creation, not accidental sprawl. Combine it with the tenant and capacity settings in our Fabric policies explained post and you have most of the control you need.
Workspace level surge protection, in preview with general availability coming, caps how much capacity a single workspace can consume. Put a limit on the sandbox workspace and the overnight notebook that someone forgot about can no longer throttle the finance dashboards at 9am. With the new overage billing at three times the pay-as-you-go rate, this is also a cost control, which our Fabric capacity guide covers.
Unified monitoring and the operations agents are worth watching rather than adopting yet. For a small estate, an Activator alert on pipeline failure that goes to a Teams channel does ninety percent of the job.
What about Microsoft Purview?
Purview is the enterprise answer to all of the above and it is where the catalog, labels and data quality come together across Fabric, Microsoft 365 and everything else. If your organisation already has Purview for Microsoft 365 compliance, connecting Fabric to it is worth doing and mostly automatic. If you do not, do not buy it for Fabric alone at mid-market scale. The in-platform tools above cover the four questions for a long time. That answer may change as Purview pricing and the Fabric integration mature, and we will update this post when it does.
The short list
Descriptions and endorsement on the items that matter. Sensitivity labels on personal and payroll data. Access by group, checked with access audit. Policies in Fabric so only named people create heavy items. Surge protection on the sandbox. A monthly look at the Govern area. That is a morning's work to set up and an hour a month to keep. Everything else can wait for a reason. If you want a second pair of eyes on it, our data governance FAQ and strategy and leadership team are where to start.
Related reading
Data governance for the mid-market: a lightweight framework that actually gets used
The Fabric rollout that quietly goes wrong: workspace sprawl, shadow BI and the readiness checks
Data governance that people actually follow, not a policy nobody reads
Kiran Sahiba
Analytics Solutions Consultant
Part of the Hopton Analytics team, delivering governed analytics programmes for UK mid-market organisations.
