2.2.3. Domain and Subdomain Configuration

💡 First Principle: Domains provide a governance layer above workspaces—like corporate policies that apply to entire departments. Without them, you'd need to configure the same security policies workspace by workspace, and inevitably something would be inconsistent. Domains let you say "all Finance workspaces must have these sensitivity labels" once, rather than repeating it in 20 places.

Scenario: The Finance department wants to ensure all their workspaces follow consistent security policies and data classification, but individual teams within Finance (Accounting, Treasury) need their own workspaces.

Domain Configuration Steps

1. Create Domain (Admin Portal → Domains)
2. Create Subdomains (optional, for deeper hierarchy)
3. Assign Workspaces to domains/subdomains
4. Configure Domain Settings (default policies, data owner)

Key Domain Settings

• Data Domain Owner: Responsible individual for the domain
• Contributors: Who can contribute to domain governance
• Default Policies: Sensitivity labels, endorsement requirements

⚠️ Exam Trap: Workspace-to-subdomain assignment can be done in two places: by a workspace admin (who is a domain contributor) in the workspace settings, or by a Fabric admin or domain admin from the domain or subdomain page in the admin portal (Assign workspaces, by name, admin or capacity). Subdomain settings hold only general settings, so they are never where assignment happens.

• One home per workspace: a workspace belongs to exactly one domain or subdomain at a time; a workspace in a subdomain rolls up under the parent domain, whose domain admins also administer the subdomain
• Governance, not access: domain assignment groups workspaces for discovery (OneLake catalog filtering) and delegated settings such as a default sensitivity label or certification; it does not change who can see or access the data—workspace roles and item permissions still decide that
• Roles: only Fabric admins create domains and name domain admins; domain admins manage their domain's contributors, subdomains and workspace assignments