Microsoft Fabric F64 migration

Architected and led the move off a per-user Power BI Pro footprint onto a single Microsoft Fabric F64 capacity. The licensing change was the visible part; the durable part was replacing manual access management with attribute-driven provisioning and putting row-level security under the partner-facing datasets. Approved by the board as one licensing modernization alongside the security platform bundle, and now in steady-state production.

The problem with per-user licensing

• Cost scaled with curiosity. Every additional person who wanted to look at a dashboard was another license, which quietly taught the organization not to ask for access.
• External sharing was awkward, requiring purchased licenses or guest-access workarounds for partners who should simply be able to read their own numbers.
• Access management was manual, which meant it was also inconsistent and occasionally stale.

Why capacity over per-seat

A single capacity decouples cost from user count entirely. Beyond retiring the per-seat Pro estate, it removes licensing as a gate on adoption: onboarding a new viewer becomes a group membership change rather than a purchase decision. It also unlocked capability the Pro tier could not offer, particularly external sharing and Copilot-driven natural-language querying.

The decision was made on best fit rather than lowest price. A capacity tier is not automatically cheaper at every scale, and the analysis had to establish where the crossover actually sat for this footprint.

Access control by attribute, not by hand

Access runs on Entra ID dynamic groups keyed to user attributes (role, region, department), which assign users into the right workspaces automatically. This is the same attribute-driven pattern the naming and identity standards exist to make reliable: one correctly set field on the user object, and the rest follows.

The alternative, granting workspace access per person as requests arrive, works until it doesn't. It accumulates edge cases, and its characteristic failure is access that is never removed rather than access that is never granted, which is the harder kind to notice.

Row-level security

Implemented row-level security across the customer-facing datasets so the data a user sees is a function of who they are:

• A manufacturer partner sees only their own sales performance.
• Regional teams see their region.
• Corporate sees the whole picture.

Enforcing this in the semantic model rather than in report design means the boundary holds regardless of how someone reaches the data, which is the only way to treat a data-segregation requirement as a control rather than a convention.

Migration

All reports, dashboards, and datasets moved across, with data models redesigned for the new platform rather than lifted as-is. Cutovers ran evenings and weekends for zero downtime against business hours, and every report was validated after the move. External sharing went live for partners as part of the same rollout, and Copilot was enabled for natural-language self-service, reducing routine ad-hoc report requests on the BI team.

Ongoing role

Continue as the platform subject-matter expert: workspace permissions and role-based access architecture, row-level security refinement as the business changes, and semantic model and refresh-strategy optimization for query performance. The platform belongs to the BI team day to day; the capacity, identity, and security architecture underneath it stays with IT.