The Fabric Environment Agent connects with read only access, walks every workspace and every item, and writes a health report you can act on. Findings come with a severity, the exact item they fired on, and a draft remediation plan. It never changes anything in your tenant.
Workspaces get created for a proof of concept and never cleaned up. Semantic models drift from Direct Lake into Import without a decision being recorded. Capacity throttling shows up as "Power BI is slow" three months later. The evidence needed to answer "is this environment healthy?" is scattered across the admin portal, the Capacity Metrics app, and the settings of every single workspace. Nobody has time to walk that manually, so the review happens after the incident instead of before it.
Counting workspaces, lakehouses, warehouses, notebooks, pipelines and semantic models with their owners means clicking through the portal or writing throwaway API scripts each time. The answer is stale the day after you produce it.
Naming conventions, workspace roles versus Entra groups, dev/test/prod separation, Git integration on every code item, sensitivity labels on anything leaving OneLake. Everyone agrees these matter, nobody checks them systematically, and new joiners cannot tell which rules are real.
Interactive delays, background rejections and smoothing overruns sit in the metrics data, but only if someone opens the app, knows which visual to trust, and correlates the spike back to the workspace and item that caused it.
The agent enumerates the tenant through the Fabric and Power BI admin APIs, lands everything in a lakehouse as a dated snapshot, runs a versioned rule set over it, and turns the raw findings into a readable narrative. An architect reviews the output before it reaches a client, because a rule that says "this workspace has no Git integration" is correct in general and wrong for the data science sandbox.
Enumerates workspaces, capacities, domains, lakehouses, warehouses, semantic models, reports, notebooks, pipelines, dataflows, eventhouses and shortcuts, with owner, dates and workspace role assignments, written to a lakehouse as a versioned snapshot.
Declarative checks versioned in YAML, so a client specific set can be forked without touching code. Orphaned workspaces, personal workspaces holding production content, missing Git integration, direct user assignments instead of Entra groups, Import models where Direct Lake would fit.
Pulls capacity metrics to flag sustained CU pressure, throttling and rejection events, and background operation overruns, then attributes them back to the workspace and item that generated the load.
Because snapshots are dated, the second run answers a more useful question than the first: what changed, what got worse, and which findings from last quarter were actually closed.
Emits Markdown and HTML alongside a machine readable JSON findings file. Executive summary for the sponsor, findings grouped by theme and ranked by severity, plus a draft remediation backlog that pastes into Azure DevOps or Jira.
The service principal needs tenant read and capacity read scopes only. No write permission is requested, so the agent cannot modify or delete anything in the tenant it is assessing.
The agent runs as Fabric notebooks orchestrated by a data pipeline, writing Delta to a lakehouse and surfacing results through a semantic model and a Power BI report. Collection uses the Fabric REST APIs, the admin scanner and activity events APIs, and the Fabric CLI where it beats raw REST. Authentication is an Entra service principal with read scopes, secrets in Key Vault. The narrative layer runs on structured findings only, never on raw tenant content.
If you run a Fabric tenant that grew faster than its documentation, request an assessment. We point the agent at a read only service principal, run the collection, and walk you through the findings in a working session. You keep the report, the JSON findings and the inventory snapshot regardless of whether anything follows.