Fabric Atlas gives a team one readable map of its Fabric workspace. It brings together lineage, item metadata, access, sensitivity and run history, then keeps the last validated snapshot in Fabric so everyone sees the same state.

Install · Architecture · Whitepaper · Functionalities · Roadmap · Changelog · Contribute

Watch the Full HD version on YouTube

The Fabric Atlas whitepaper explains how the product collects and validates metadata, publishes immutable snapshots, traces item and DAX dependencies, reviews effective access, and builds principal-centred departure packs. It also covers governance, operations, security boundaries, deployment and known API limits.

The screenshots use FGI-MAIN as one example deployment. Its counts and findings are not product defaults or a reference architecture.

Read the PDF · Read the Markdown version

Fabric workspaces spread operational metadata across many portal pages and APIs. Fabric Atlas collects that metadata without copying business data.

• Browse workspace items as cards or a sortable table, then inspect their internal objects.
• Inspect Lakehouse, Warehouse, SQL Database and KQL tables, views, columns, functions and materialized views when the required metadata access is available.
• Explore Ontology entities, properties, relationships and bindings, Graph Model node and edge types, and Data Agent source selections.
• Trace item and verified object lineage from physical sources through models, ontologies, graphs, agents and reports.
• Review effective access, direct shares and external principals.
• Check sensitivity coverage and confidential assets.
• Compare validated snapshots and review governance findings.
• Focus on newly introduced risks with Governance Radar and personal acknowledgements.
• Track six posture pillars against explicit governance targets.
• Generate departure packs with ownership, blast radius and reassignment evidence.
• Trace resolved DAX dependencies between measures and synchronized schema objects.
• Search the whole workspace with Ctrl+K and save useful filter views.
• Export access reviews and verified lineage impact reports.
• Inspect jobs, configuration and team notes in one workspace hub.
• Refresh the catalog through a guided synchronization flow.

The first deployment or a new major/minor snapshot contract starts with a controlled metadata refresh. A five-phase tracker, active stage, elapsed time and target workspace stay visible throughout the scan. The same tracker appears during later refreshes, while compatible patch releases reuse the validated catalog. Deep discovery advances with the real completed-item count. A slow type is continued in a new UDF slice, and an individual slow item is retried in isolation. Repeated no-progress attempts stop with an explicit item-level error instead of looping forever. The browser warns before leaving while this resumable queue is active.

The overview brings health, freshness, governance signals and inventory reach together in a Fabric-native operational landing page.

The map follows Fabric assets from orchestration to consumption. Selecting an item highlights its verified path while the inspector keeps schema, access, runs and impact actions beside the graph.

Object mode expands a synchronized table into its columns and connected Fabric items. The inspector keeps ownership, impact and related metadata visible while objects are selected or rearranged. Selecting an object from another Fabric item switches the active item and rebuilds the object graph. Deep-lineage tables can be expanded or collapsed together. Connected Fabric items are grouped into collapsible summary nodes, while Impact mode preserves the graph layout and only changes the highlighted dependency paths. Hold the left mouse button on the canvas background and drag to pan the complete graph.

Tables, views, columns and measures are grouped by Fabric item. Selecting an asset exposes its source, model context and additive effective access.

Governance Radar, findings, snapshot changes, history, coverage and posture are grouped into one governance workspace with saved views and evidence links.

The review matrix combines inherited and direct permissions, then supports focused filtering, personal decisions and CSV export.

An item or schema object can produce an exportable report with verified upstream, downstream and relationship evidence.

flowchart LR
  U["Fabric user"]
  APP["Fabric Atlas<br/>React + Rayfin"]
  AUTH["Brokered authentication"]
  BASE["Base UDF slice<br/>sync_all · max 180 s"]
  PLAN["Type-grouped item queue"]
  ITEMS["Enrichment UDF slices<br/>sync_items · max 180 s each"]
  MERGE["Validate and merge<br/>complete workspace result"]
  API["Fabric and Power BI APIs"]
  DB[("Atomic Rayfin snapshot<br/>manifest written last")]

  U -->|"open in Fabric"| APP
  APP <-->|"brokered session"| AUTH
  APP -->|"authoritative topology"| BASE
  BASE <-->|"workspace metadata"| API
  BASE -->|"items to enrich"| PLAN
  PLAN -->|"next item type and batch"| ITEMS
  ITEMS <-->|"KQL, SQL and definition metadata"| API
  ITEMS -->|"completed IDs + remaining IDs"| PLAN
  PLAN -->|"all items complete"| MERGE
  MERGE -->|"validated snapshot"| DB

  classDef user fill:#742774,stroke:#a66dd4,color:#ffffff,stroke-width:2px;
  classDef app fill:#1677c8,stroke:#6fc7ff,color:#ffffff,stroke-width:2px;
  classDef auth fill:#5b5fc7,stroke:#a7a9ff,color:#ffffff,stroke-width:2px;
  classDef udf fill:#0e8a99,stroke:#67e8e2,color:#ffffff,stroke-width:2px;
  classDef api fill:#16855b,stroke:#6ee7a8,color:#ffffff,stroke-width:2px;
  classDef database fill:#9a6b00,stroke:#f2c94c,color:#ffffff,stroke-width:2px;

  class U user;
  class APP,PLAN,MERGE app;
  class AUTH auth;
  class BASE,ITEMS udf;
  class API api;
  class DB database;

Microsoft Fabric limits one User Data Function invocation to 200 seconds. Atlas uses a 180-second budget for each invocation, leaving 20 seconds for projection, serialization and the platform response.

The 180-second limit does not apply to the complete synchronization. Atlas first runs sync_all for the authoritative workspace topology, then invokes sync_items repeatedly for item batches grouped by Fabric type. Before a slice runs out of time, it returns both completedItemIds and remainingItemIds. The browser keeps the completed results and starts a fresh slice for the remaining items. Slow batches are split, and a slow individual item is retried alone.

Only after every slice is complete does Atlas validate the merged result and write the Rayfin manifest. A complete synchronization can therefore run for several minutes without any individual UDF invocation exceeding 180 seconds.

The browser cannot call Fabric management APIs directly. A published User Data Function performs the metadata scan server-side with the signed-in user's delegated token. Its versioned response reports required, optional and capability status. Atlas first retrieves the authoritative workspace topology, then invokes resumable enrichment slices grouped by item type. Each slice returns completed and remaining item IDs, so timeout or response-size pressure causes automatic continuation instead of truncation. The app validates and size-bounds every result, stores one complete workspace-scoped snapshot through Rayfin, and keeps the previous valid snapshot if a refresh fails.

See Architecture for the full data flow.

The following P2 and P3 work is planned for the v2 series. It is outside the v1.11 release scope. The table describes intended behaviour, not features available in the current app.

Multi-workspace catalog support is planned and tracked in #4. The implementation will stay focused on a controlled set of workspaces rather than scanning an entire tenant automatically.

v2.0.0 is the multi-workspace catalog milestone planned for Q4 CY26. v2.0.1 adds lineage comparison, followed by verified cross-workspace relationships in v2.0.2 during Q1 CY27. These dates are targets and may move if Fabric API coverage changes.

Clone directly, or scaffold a reusable copy with npx rayfin init my-atlas -t https://github.com/fredgis/FabricAtlas.

git clone https://github.com/fredgis/FabricAtlas.git
Set-Location FabricAtlas
$env:VITE_RAYFIN_ATLAS_DEMO_MODE = "true"
npm ci
npm run dev

The local app uses the included AlpineRent preview estate.

npx rayfin login --tenant <tenant-id> --select
$env:RAYFIN_PUBLIC_ATLAS_SYNC_ADMIN_EMAIL = "<authorized-sync-user>"
$env:RAYFIN_PUBLIC_ATLAS_SYNC_ADMIN_SUBJECT = "<authorized-sync-subject>"
npx rayfin up --workspace "<workspace-name>"

Publish the function in fabric/udf/atlas_sync_functions/, then add these public values to the git-ignored rayfin/.env file:

RAYFIN_PUBLIC_ATLAS_SPA_CLIENT_ID=<entra-client-id>
RAYFIN_PUBLIC_ATLAS_UDF_URL=https://<host>/functions/sync_all/invoke
RAYFIN_PUBLIC_ATLAS_WORKSPACE_NAME=<workspace-display-name>
RAYFIN_PUBLIC_ATLAS_SYNC_ADMIN_EMAIL=<authorized-sync-user>
RAYFIN_PUBLIC_ATLAS_SYNC_ADMIN_SUBJECT=<authorized-sync-subject>
RAYFIN_PUBLIC_ATLAS_SNAPSHOT_RETENTION_COUNT=12
# Optional during synchronizer rotation:
RAYFIN_PUBLIC_ATLAS_PREVIOUS_SYNC_WRITERS=<former-user@example.com>
RAYFIN_PUBLIC_ATLAS_SENSITIVITY_RANKS='{"<label-id>":3,"<lower-label-id>":1}'

Keep the configured synchronizer available in the CLI process environment when running npx rayfin up: its immutable Rayfin subject is needed to compile the database policies, while the email remains the visible contact and historical snapshot identifier. The app opens on a guided synchronization screen.

The complete Entra, UDF and deployment steps are in docs/installation.md.

npm test
npm run lint
npm run build

npm run typecheck runs tsc -b --force with strict checking and noEmit. The project does not enable TypeScript's noCheck option.

The current production build intentionally ships one main application chunk of about 0.9 MB minified, or about 0.25 MB gzip. Vite also reports that the dynamic Rayfin client import in backend.ts cannot form a separate chunk because personal-state modules import the same client statically. This is accepted for the current accelerator scale and should be revisited if the application or startup cost grows materially.

Fabric Atlas v1.x is scoped to one configured workspace and uses a shared governance catalog. Every authenticated user who can open the deployed app can read the complete synchronized metadata graph, including items, object inventory, lineage, principals, access grants, jobs, configuration, snapshot history and team notes. Catalog reads are not filtered per user. Control this audience through the Fabric app and workspace access settings.

Saved views, access-review decisions and Governance Radar acknowledgements are different: Rayfin policies bind those records to the authenticated subject, so each user sees only their own personal state.

Access decisions are now append-only events. Older decisions remain in the history but require a new review because they do not contain a permission fingerprint. Clearing a decision appends an event rather than deleting history.

Governance targets and exceptions are shared workspace settings. Only the configured synchronization administrator can change them. All six targets default to 70%; the same current targets apply to Overview and historical posture comparisons. Historical versions of the target policy are not stored. An exception needs a reason and a future expiry. It annotates the finding without hiding it or improving the underlying score, and it remains separate from a user's personal mute.

Team notes are append-only in v1.x. Creation is bound to the authenticated email and subject. Atlas stores the authenticated session email as the author label, and that label remains stable after reload. Client-selected catalog labels cannot impersonate another note author. Notes cannot currently be edited or deleted.

Only the configured synchronization administrator can publish or prune snapshots. When another user reaches the first-sync gate, Atlas displays the configured account to contact.

Fabric Atlas stores workspace metadata and team notes. It does not persist workspace business data. Tokens and deployment values stay outside Git in rayfin/.env.

The synchronization boundary excludes scanner rows, datasource and connection details, and Power Query or source expressions. Measure DAX is retained only as explicit Semantic Model metadata.

The project has been reviewed against OWASP Top 10:2025 and ASVS 5.0. Security hardening is part of the release process.

The shared authenticated read scope and append-only note behavior are described above so deployments can set the app audience deliberately.

Report vulnerabilities through GitHub private vulnerability reporting.

Found a bug, a missing Fabric object type or a useful governance workflow? Open an issue.

Pull requests are welcome. Read the contribution guide before starting.

• Releases
• Changelog
• Installation
• Architecture
• Data model
• Metadata coverage audit
• Security policy
• Code of conduct

_{Atlas always indexes top-level items from the Fabric Items API. Deeper inventory, lineage and item-level access depend on what the Fabric and Power BI APIs expose for each type and on the required tenant settings. N/A means a metadata capability was not collected; it is not treated as a missing value.}

_{Across these elements, Atlas also records configuration facts, up to three recent job instances per supported item, scanner-reported relationships, workspace principals, explicit item users, raw endorsement, sensitivity-label IDs and tag IDs. It stores metadata only, never workspace business data.}