Workspaces - List Networking Communication Policies

Service:: Admin

API Version:: v1

Returns network communication policy settings for all workspaces in the tenant.
Returns paginated network communication policy details for all workspaces. The response includes inbound access protection settings (public access rules and IP firewall rules), outbound access protection settings (public access rules, connection rules, gateway rules, Git policy, and managed private endpoints), and workspace metadata.

This API supports pagination. With the continuation token provided in the response, you can get the next set of records.

Permissions

The caller must be a Fabric administrator or authenticate using a service principal.

Required Delegated Scopes

Tenant.Read.All or Tenant.ReadWrite.All

Microsoft Entra supported identities

This API supports the Microsoft identities listed in this section.

Identity	Support
User	Yes
Service principal and Managed identities	Yes

Interface

GET https://api.fabric.microsoft.com/v1/admin/workspaces/networking/communicationpolicies

With optional parameters:

GET https://api.fabric.microsoft.com/v1/admin/workspaces/networking/communicationpolicies?continuationToken={continuationToken}&filter={filter}

URI Parameters

Name	In	Required	Type	Description
continuationToken	query		string	A token for retrieving the next page of results.
filter	query		string	Filters workspaces by policy direction. Supported filter expressions: `inbound/publicAccessRules/defaultAction eq 'deny'`, `outbound/publicAccessRules/defaultAction eq 'deny'`, or both combined with `or`.

Responses

Name Type Description

200 OK

Name	Type	Description
200 OK	NetworkCommunicationPolicies	The operation was successful.
429 Too Many Requests	ErrorResponse	The service rate limit was exceeded. The server returns a `Retry-After` header indicating, in seconds, how long the client must wait before sending additional requests. Headers Retry-After: integer
Other Status Codes	ErrorResponse	Common error codes: InsufficientPrivileges - The caller doesn't have permissions to call the API. InvalidFilterExpression - The filter expression is invalid or contains unsupported properties.

NetworkCommunicationPolicies

The operation was successful.

429 Too Many Requests

ErrorResponse

The service rate limit was exceeded. The server returns a Retry-After header indicating, in seconds, how long the client must wait before sending additional requests.

Headers

Retry-After: integer

Other Status Codes

ErrorResponse

Common error codes:

InsufficientPrivileges - The caller doesn't have permissions to call the API.
InvalidFilterExpression - The filter expression is invalid or contains unsupported properties.

Examples

List network communication policy settings filtered by inbound policy example

List network communication policy settings for all workspaces example

List network communication policy settings filtered by inbound policy example

Sample request

HTTP

GET https://api.fabric.microsoft.com/v1/admin/workspaces/networking/communicationpolicies?filter=inbound/publicAccessRules/defaultAction eq 'deny'

Sample response

Status code:: 200

{
  "value": [
    {
      "workspaceId": "fa9ad228-3e6b-44d4-b5f4-e275f337afa9",
      "workspaceName": "Finance Analytics",
      "workspaceType": "Workspace",
      "inbound": {
        "publicAccessRules": {
          "defaultAction": "Deny"
        },
        "firewall": {
          "rules": [
            {
              "displayName": "CorpNet",
              "value": "10.0.0.0-10.255.255.255"
            }
          ]
        }
      },
      "outbound": {
        "publicAccessRules": {
          "defaultAction": "Allow"
        },
        "connections": {
          "defaultAction": "Allow",
          "rules": []
        },
        "gateways": {
          "defaultAction": "Allow",
          "allowedGateways": []
        },
        "git": {
          "defaultAction": "Allow"
        },
        "managedPrivateEndpoints": []
      }
    }
  ]
}

List network communication policy settings for all workspaces example

Sample request

HTTP

GET https://api.fabric.microsoft.com/v1/admin/workspaces/networking/communicationpolicies

Sample response

Status code:: 200

{
  "value": [
    {
      "workspaceId": "fa9ad228-3e6b-44d4-b5f4-e275f337afa9",
      "workspaceName": "Finance Analytics",
      "workspaceType": "Workspace",
      "inbound": {
        "publicAccessRules": {
          "defaultAction": "Deny"
        },
        "firewall": {
          "rules": [
            {
              "displayName": "CorpNet",
              "value": "10.0.0.0-10.255.255.255"
            },
            {
              "displayName": "VPN",
              "value": "172.16.0.0-172.31.255.255"
            }
          ]
        }
      },
      "outbound": {
        "publicAccessRules": {
          "defaultAction": "Deny"
        },
        "connections": {
          "defaultAction": "Deny",
          "rules": [
            {
              "connectionType": "SQL",
              "defaultAction": "Deny",
              "allowedEndpoints": [
                {
                  "hostnamePattern": "*.microsoft.com"
                }
              ]
            },
            {
              "connectionType": "lakehouse",
              "defaultAction": "Deny",
              "allowedWorkspaces": [
                {
                  "workspaceId": "91c5ae74-e82d-4dd3-bfeb-6b1814030123"
                }
              ]
            }
          ]
        },
        "gateways": {
          "defaultAction": "Deny",
          "allowedGateways": [
            {
              "id": "17d8929d-ab32-46d1-858b-fdea74e93bf2"
            }
          ]
        },
        "git": {
          "defaultAction": "Deny"
        },
        "managedPrivateEndpoints": [
          {
            "id": "f3d04593-28fe-409e-a568-ebffbea69f37",
            "name": "SqlProdEndpoint",
            "targetPrivateLinkResourceId": "/subscriptions/11111111-1111-1111-1111-111111111111/resourceGroups/rg-prod/providers/Microsoft.Sql/servers/sql-prod-server",
            "targetSubresourceType": "sqlServer",
            "provisioningState": "Succeeded",
            "connectionState": {
              "status": "Approved",
              "description": "Auto-approved",
              "actionsRequired": "None"
            }
          }
        ]
      }
    },
    {
      "workspaceId": "b2c3d4e5-f6a7-4890-abcd-ef1234567890",
      "workspaceName": "Marketing Reports",
      "workspaceType": "Workspace",
      "inbound": {
        "publicAccessRules": {
          "defaultAction": "Allow"
        }
      },
      "outbound": {
        "publicAccessRules": {
          "defaultAction": "Allow"
        },
        "connections": {
          "defaultAction": "Allow",
          "rules": []
        },
        "gateways": {
          "defaultAction": "Allow",
          "allowedGateways": []
        },
        "git": {
          "defaultAction": "Allow"
        },
        "managedPrivateEndpoints": []
      }
    }
  ],
  "continuationUri": "https://api.fabric.microsoft.com/v1/admin/workspaces/networking/communicationpolicies?continuationToken=eyJMYXN0U2VlbkNvbm5lY3Rpb25JZCI6NX0%3D",
  "continuationToken": "eyJMYXN0U2VlbkNvbm5lY3Rpb25JZCI6NX0%3D"
}

Definitions

Name	Description
ConnectionAccessActionType	Defines the access control behavior for outbound connections. This enum is used for the field defaultAction to specify whether outbound communication should be allowed or denied by default. This type enables both global and connection-specific control over outbound access, helping enforce secure and predictable network communication policies. Additional connection access action types may be added over time.
ConnectionRuleEndpointMetadata	Represents a single endpoint-level exception rule that allows outbound communication to a specific external domain or host. This object is used within the allowedEndpoints array of a connection rule to explicitly authorize outbound access to trusted endpoints for a given connectionType. This is applicable only to connection types that support endpoint-based filtering (e.g., SQL, MySQL, Web, etc.).
ConnectionRuleWorkspaceMetadata	Represents a workspace-level exception rule that allows outbound communication to a specific workspace for a given connectionType. This object is used within the allowedWorkspaces array of a connection rule to explicitly authorize cross-workspace access. This is applicable only to connection types that support workspace-based filtering, such as Lakehouse, Warehouse, FabricSql, and PowerPlatformDataflows.
ConnectionStatus	Private endpoint connection status. Additional connection status may be added over time.
ErrorRelatedResource	The error related resource details object.
ErrorResponse	The error response.
ErrorResponseDetails	The error response details.
FirewallRule	Represents a single IP firewall rule.
FirewallRules	Represents the IP firewall rules configured for a workspace's inbound access protection.
GatewayAccessActionType	Defines the access control behavior for outbound gateways. This enum is used for the field defaultAction to specify whether outbound communication should be allowed or denied by default. This type enables both global and gateway-specific control over outbound access, helping enforce secure and predictable network communication policies. Additional gateway access action types may be added over time.
GatewayAccessRuleMetadata	Represents a gateway that is allowed for outbound communication. This object is used within the allowedGateways to explicitly authorize outbound access.
ManagedPrivateEndpoint	Managed private endpoint.
NetworkAccessRule	The default policy for workspace access from public networks. If omitted from a PUT request body, this field defaults to `Allow`, which may unintentionally open network access. Always explicitly specify this field in every PUT request body.
NetworkCommunicationPolicies	A list of network communication policy settings for workspaces in the tenant.
NetworkCommunicationPolicyDetails	Represents the details of network communication policy settings for each workspace.
NetworkCommunicationPolicyInboundDetails	Represents the inbound network communication policy settings for a workspace.
NetworkCommunicationPolicyOutboundDetails	Represents the outbound network communication policy settings for a workspace.
NetworkRules	The policy defining access to/from a workspace to/from public networks.
OutboundConnectionRule	Defines an outbound access rule for a specific cloud connection.
PrivateEndpointConnectionState	Private endpoint connection state
PrivateEndpointProvisioningState	Provisioning state of endpoint.
WorkspaceOutboundConnections	Represents the complete set of outbound access protection cloud connection rules configured for a workspace as part of its networking communication policy. This object defines the connection rules that govern which external endpoints and workspaces are permitted or denied for outbound communication
WorkspaceOutboundGateways	Represents the complete set of gateway outbound access protection rules configured for a workspace as part of its networking communication policy. This object defines the gateway rules that govern outbound communication
WorkspaceType	A workspace type. Additional workspace types may be added over time.

ConnectionAccessActionType

Enumeration

Defines the access control behavior for outbound connections. This enum is used for the field defaultAction to specify whether outbound communication should be allowed or denied by default. This type enables both global and connection-specific control over outbound access, helping enforce secure and predictable network communication policies. Additional connection access action types may be added over time.

Value	Description
Allow	Permits outbound connections. When used as a default action, all cloud connections are allowed.
Deny	Blocks outbound connections. When used as a default action, all cloud connections are denied unless explicitly allowed.

ConnectionRuleEndpointMetadata

Object

Represents a single endpoint-level exception rule that allows outbound communication to a specific external domain or host. This object is used within the allowedEndpoints array of a connection rule to explicitly authorize outbound access to trusted endpoints for a given connectionType. This is applicable only to connection types that support endpoint-based filtering (e.g., SQL, MySQL, Web, etc.).

Name	Type	Description
hostnamePattern	string	A wildcard-supported pattern that defines the allowed external endpoint. Examples include *.microsoft.com, api.contoso.com, or data.partner.org.

ConnectionRuleWorkspaceMetadata

Object

Represents a workspace-level exception rule that allows outbound communication to a specific workspace for a given connectionType. This object is used within the allowedWorkspaces array of a connection rule to explicitly authorize cross-workspace access. This is applicable only to connection types that support workspace-based filtering, such as Lakehouse, Warehouse, FabricSql, and PowerPlatformDataflows.

Name	Type	Description
workspaceId	string (uuid)	The unique identifier (GUID) of the target workspace that is allowed to be connected from current workspace.

ConnectionStatus

Enumeration

Private endpoint connection status. Additional connection status may be added over time.

Value	Description
Pending	Pending approval
Approved	Endpoint approved
Rejected	Endpoint rejected
Disconnected	Endpoint disconnected

ErrorRelatedResource

Object

The error related resource details object.

Name	Type	Description
resourceId	string	The resource ID that's involved in the error.
resourceType	string	The type of the resource that's involved in the error.

ErrorResponse

Object

The error response.

Name	Type	Description
errorCode	string	A specific identifier that provides information about an error condition, allowing for standardized communication between our service and its users.
isRetriable	boolean	When true, the request can be retried. Use the `Retry-After` response header to determine the delay, if available.
message	string	A human readable representation of the error.
moreDetails	ErrorResponseDetails[]	List of additional error details.
relatedResource	ErrorRelatedResource	The error related resource details.
requestId	string (uuid)	ID of the request associated with the error.

ErrorResponseDetails

Object

The error response details.

Name	Type	Description
errorCode	string	A specific identifier that provides information about an error condition, allowing for standardized communication between our service and its users.
message	string	A human readable representation of the error.
relatedResource	ErrorRelatedResource	The error related resource details.

FirewallRule

Object

Represents a single IP firewall rule.

Name	Type	Description
displayName	string	The display name of the firewall rule.
value	string	The IP range in start-end format (for example, `0.0.0.0-255.255.255.255`) or CIDR notation.

FirewallRules

Object

Represents the IP firewall rules configured for a workspace's inbound access protection.

Name	Type	Description
rules	FirewallRule[]	A list of IP firewall rules configured for the workspace.

GatewayAccessActionType

Enumeration

Defines the access control behavior for outbound gateways. This enum is used for the field defaultAction to specify whether outbound communication should be allowed or denied by default. This type enables both global and gateway-specific control over outbound access, helping enforce secure and predictable network communication policies. Additional gateway access action types may be added over time.

Value	Description
Allow	Permits outbound gateways. When used as a default action, all gateways are allowed.
Deny	Blocks outbound gateways. When used as a default action, all gateways are denied unless explicitly allowed.

GatewayAccessRuleMetadata

Object

Represents a gateway that is allowed for outbound communication. This object is used within the allowedGateways to explicitly authorize outbound access.

Name	Type	Description
id	string (uuid)	Gateway Id to be allowed.

ManagedPrivateEndpoint

Object

Managed private endpoint.

Name	Type	Description
connectionState	PrivateEndpointConnectionState	Endpoint connection state of provisioned endpoints.
id	string (uuid)	Managed private endpoint Id.
name	string	The private endpoint name.
provisioningState	PrivateEndpointProvisioningState	Provisioning state of endpoint.
targetPrivateLinkResourceId	string	Resource Id of data source for which private endpoint is created
targetSubresourceType	string	Sub-resource pointing to Private-link resoure.

NetworkAccessRule

Enumeration

The default policy for workspace access from public networks. If omitted from a PUT request body, this field defaults to Allow, which may unintentionally open network access. Always explicitly specify this field in every PUT request body.

Value	Description
Allow	Allow all connections.
Deny	Deny all connections.

NetworkCommunicationPolicies

Object

A list of network communication policy settings for workspaces in the tenant.

Name	Type	Description
continuationToken	string	The token for the next result set batch. If there are no more records, it's removed from the response.
continuationUri	string	The URI of the next result set batch. If there are no more records, it's removed from the response.
value	NetworkCommunicationPolicyDetails[]	A list of network communication policy settings for workspaces in the tenant.

NetworkCommunicationPolicyDetails

Object

Represents the details of network communication policy settings for each workspace.

Name	Type	Description
inbound	NetworkCommunicationPolicyInboundDetails	Defines the inbound access protection settings.
outbound	NetworkCommunicationPolicyOutboundDetails	Defines the outbound access protection settings.
workspaceId	string (uuid)	The workspace ID.
workspaceName	string	The display name of the workspace.
workspaceType	WorkspaceType	The workspace type.

NetworkCommunicationPolicyInboundDetails

Object

Represents the inbound network communication policy settings for a workspace.

Name	Type	Description
firewall	FirewallRules	The IP firewall rules configured for the workspace's inbound access protection.
publicAccessRules	NetworkRules	The policy for all inbound communications to a workspace.

NetworkCommunicationPolicyOutboundDetails

Object

Represents the outbound network communication policy settings for a workspace.

Name	Type	Description
connections	WorkspaceOutboundConnections	Represents the complete set of outbound access protection cloud connection rules configured for a workspace as part of its networking communication policy. This object defines the connection rules that govern which external endpoints and workspaces are permitted or denied for outbound communication.
gateways	WorkspaceOutboundGateways	Represents the complete set of gateway outbound access protection rules configured for a workspace as part of its networking communication policy. This object defines the gateway rules that govern outbound communication.
git	NetworkRules	Represents the Git outbound policy for the workspace as part of its networking communication policy.
managedPrivateEndpoints	ManagedPrivateEndpoint[]	The managed private endpoints configured for the workspace's outbound access protection.
publicAccessRules	NetworkRules	The policy for all outbound communications from a workspace.

NetworkRules

Object

The policy defining access to/from a workspace to/from public networks.

Name	Type	Description
defaultAction	NetworkAccessRule	The default policy for workspace access from public networks. If omitted from a PUT request body, this field defaults to `Allow`, which may unintentionally open network access. Always explicitly specify this field in every PUT request body.

OutboundConnectionRule

Object

Defines an outbound access rule for a specific cloud connection.

Name	Type	Description
allowedEndpoints	ConnectionRuleEndpointMetadata[]	Defines a list of explicitly permitted external endpoints for the connectionType. Each entry in the array represents a hostname pattern that is allowed for outbound communication from the workspace. This field is applicable only to connection types that support endpoint-based filtering (e.g., SQL, MySQL, Web, etc.). If defaultAction is set to "Deny" for the connection type, only the endpoints listed here will be allowed; all others will be blocked.
allowedWorkspaces	ConnectionRuleWorkspaceMetadata[]	Specifies a list of workspace IDs that are explicitly permitted for outbound communication for the given fabric connectionType. This field is applicable only to fabric connection types that support workspace-based filtering, limited to Lakehouse, Warehouse, FabricSql, and PowerPlatformDataflows. When defaultAction is set to "Deny" for a connection type, only the workspaces listed in allowedWorkspaces will be allowed for outbound access; all others will be blocked.
connectionType	string	Specifies the cloud connection type to which the rule applies. The behavior and applicability of other rule properties (such as allowedEndpoints or allowedWorkspaces) may vary depending on the capabilities of connection type.
defaultAction	ConnectionAccessActionType	Defines the default outbound access behavior for the connectionType. This field determines whether connections of this type are permitted or blocked by default, unless further refined by allowedEndpoints or allowedWorkspaces. If set to "Allow": All connections of this type are permitted unless explicitly denied by a more specific rule. This field provides fine-grained control over each connection type and complements the global fallback behavior defined by defaultAction.

PrivateEndpointConnectionState

Object

Private endpoint connection state

Name	Type	Description
actionsRequired	string	Actions required to establish connection.
description	string	Description message (if any) provided on approving or rejecting the end point.
status	ConnectionStatus	Connection status

PrivateEndpointProvisioningState

Enumeration

Provisioning state of endpoint.

Value	Description
Provisioning	Private endpoint in provisioning is in-progress
Succeeded	Private endpoint provisioning Succeeded
Updating	Private endpoint updating
Deleting	Private endpoint deleting
Failed	Private endpoint provisioning failed

WorkspaceOutboundConnections

Object

Represents the complete set of outbound access protection cloud connection rules configured for a workspace as part of its networking communication policy. This object defines the connection rules that govern which external endpoints and workspaces are permitted or denied for outbound communication

Name	Type	Description
defaultAction	ConnectionAccessActionType	Defines the default behavior for all cloud connection types that are not explicitly listed in the rules array. If set to "Allow", all unspecified connection types are permitted by default. If set to "Deny", all unspecified connection types are blocked by default unless explicitly allowed. This setting acts as a global fallback policy and is critical for enforcing a secure default posture in environments where only known and trusted connections should be permitted. If omitted from a PUT request body, this field defaults to `Allow`, which may unintentionally permit all outbound connections. Always explicitly specify this field in every PUT request body.
rules	OutboundConnectionRule[]	A list of rules that define outbound access behavior for specific cloud connection types. Each rule may include endpoint-based or workspace-based restrictions depending on supported connection types.

WorkspaceOutboundGateways

Object

Represents the complete set of gateway outbound access protection rules configured for a workspace as part of its networking communication policy. This object defines the gateway rules that govern outbound communication

Name	Type	Description
allowedGateways	GatewayAccessRuleMetadata[]	A list of rules that define outbound access behavior for gateways.
defaultAction	GatewayAccessActionType	Defines the default behavior for all gateways that are not explicitly listed in the allowed list array. If set to "Allow", all unspecified gateways are permitted by default. If set to "Deny", all unspecified gateways are blocked. If omitted from a PUT request body, this field defaults to `Allow`, which may unintentionally permit all outbound gateway connections. Always explicitly specify this field in every PUT request body.

WorkspaceType

Enumeration

A workspace type. Additional workspace types may be added over time.

Value	Description
Personal	My folder or My workspace used to manage user items.
Workspace	Workspace used to manage the Fabric items.
AdminWorkspace	Admin monitoring workspace. Contains admin reports such as the audit report and the usage and adoption report.