Workspaces, Domains, & the Architecture Decisions You’re Going to Regret

The Headache

You have done the work. Issue One forced you to be honest about which operating model you actually run. Issue Two got you to write down the four documents most organizations are missing: the certification contract, the change management protocol, the ownership matrix, the escalation path. They are signed. They are in SharePoint. The executive sponsor has read them.

It is Tuesday afternoon, six weeks later. A finance analyst publishes a personal version of the certified Sales semantic model into a workspace called “Sales_v2_TEMP_DO_NOT_USE.” Three people connect reports to it within a week, because they cannot find the actual certified model in the tenant’s 187 other workspaces, all of which are named things like “Reporting,” “Reporting (Mike),” “Reporting Final,” and one inexplicably called “asdfjkl.” The operating agreement says certified models are the only acceptable source. The platform makes it nearly impossible to find them. Compliance loses to convenience, every single time.

This is the part of the series where most consultancies would now give you an architecture diagram with seventeen boxes and three swim lanes, declare victory, and invoice. We are not going to do that. Architecture diagrams are easy. The reason most hybrid models still fail at this point is not that the architecture is wrong on paper. It is that the technical structure of the Fabric tenant is the physical embodiment of the operating model, and an operating agreement that lives in a SharePoint folder cannot enforce itself if the platform is fighting it.

Issue Three closes the series. This is where the operating model becomes the platform.

The Blueprint: The Architecture That Enforces the Agreement

The goal is a tenant structure that makes compliance the path of least resistance and shadow work harder than just doing it the right way. In our engagements, this comes down to three architectural decisions that compound. Get all three right and the operating agreement enforces itself. Get any one of them wrong and the documents become decorative.

1. Domains as the Organizing Primitive

Fabric domains are now generally available with delegated governance, and they are the structural feature that makes hybrid governance work at scale. Domains sit above workspaces, group them by business function, and let the tenant admin delegate specific settings (default sensitivity labels, certification authority, external sharing rules) to domain admins who are closer to the actual business need. The pattern we recommend for mid-market organizations is functional alignment: typically Finance, Sales, Operations, HR, and IT/Platform, plus one or two subdomains where genuinely needed. Most mid-market clients need four to seven domains. We have seen organizations spin up twenty-three domains in their first month of using the feature, which is a failure mode we now warn against in the first workshop. Over-decomposition is more common and more damaging than under-decomposition. Start coarse. Add subdomains only when the absence of one is creating a real navigation or governance problem.

2. The Workspace Tier Pattern

Within each domain, the workspace structure should follow the same pattern. The shape we use across nearly every engagement is four tiers per domain: a Foundation workspace where certified semantic models live (owned by the central platform team), a Curated workspace where promoted reports and shared datasets live (owned by power users embedded in the business, with central team oversight), a Sandbox workspace where exploration happens and nothing is guaranteed to be stable, and a clear convention for Personal workspaces with a documented expiration policy. The critical word is consistent. Same shape in every domain. A Finance analyst who moves to Operations should be able to find the certified Sales model in 30 seconds because the structural pattern is identical. The reason consistency matters more than cleverness is that human discoverability beats sophisticated taxonomy every time. We have rebuilt enough tenants that were cleverly organized by the original architect and then promptly abandoned by everyone who came after.

3. Workspace Identity and Lifecycle

This is where almost every mid-market organization is currently failing without realizing it. Fabric workspace identity, which is generally available, creates a service principal in Entra ID that is automatically managed by Fabric and persists independently of any individual user. When the analyst who originally built the workspace leaves the company, the refreshes do not break, the connections do not orphan, and the central team does not find out six months later when a board member’s dashboard goes red. In our audits, we typically find that 60 to 80 percent of mid-market Fabric tenants have refresh dependencies on individual user accounts rather than workspace identities. That is a quiet, slow-motion crisis that announces itself at the worst possible moment, usually right after a resignation. The fix is straightforward, but it has to be done deliberately, workspace by workspace. We treat this as a standard part of every workspace audit because it is almost always the highest-leverage finding.

The Gotcha

The single most common mistake mid-market organizations make at this layer is copying Fortune 500 patterns. A 60,000-person enterprise with 400 analysts and a dedicated BI center of excellence needs sophisticated workspace governance. A 900-person mid-market manufacturer with twelve people who use Power BI seriously needs a structure that one person can hold in their head. If your workspace architecture requires a Confluence page to navigate, it is too complicated for your scale. The patterns we apply for mid-market are deliberately simpler than what you will see in vendor case studies, because the audience for those case studies is the enterprise buyer, not you. Build the smallest structure that works, document the rule for when you would add complexity, and let the structure grow under pressure rather than in anticipation. Premature architecture is the most expensive form of premature optimization in this stack.

The Reddit Reality Check

A recurring thread, paraphrased: an IT director inherits a Fabric tenant from a predecessor who left abruptly. There are 230 workspaces, no clear naming convention, no obvious owners, and nobody remembers what most of them are for. The director asks where to start.

The community answers tend to recommend a workspace audit, which is correct but vague. The realistic starting point is more specific. Run the lineage view across the tenant and identify the workspaces that have downstream dependencies. Those are the ones that matter. The other 180 are probably abandoned, and the deprovisioning ritual we recommend is a quarterly review where any workspace with no refresh in 90 days, no owner currently employed, and no downstream consumer gets archived with a one-week warning. Eighty percent of the sprawl problem solves itself this way. The remaining 20 percent is where the structural work begins.

What We’re Watching

Domain-level default sensitivity label inheritance, which we mentioned briefly in Issue One, has now reached the maturity where it can be combined with workspace identity authentication to create a genuinely governed-by-default tenant. New items inherit the domain’s label automatically. Workspace identity handles authentication without per-user credential management. The two features together close a governance gap that used to require dedicated tooling. If you have been deferring a labeling initiative because the manual classification burden seemed too high, the feature combination has materially changed the math in the last six months. Worth a fresh look.

One question for the comments: What is the most embarrassing workspace name in your current tenant? No judgment. We have all seen worse.

The Strategist’s Corner

If reading through the three architectural decisions above made you mentally inventory your current tenant and quietly wince, you are exactly the audience this issue was written for. Most mid-market Fabric tenants we audit have one of the three right, sometimes two, almost never all three. The Allston Yale Workspace Architecture Audit is a structured 60-minute review of your current tenant against the pattern above, ending with a one-page map of your existing state, a recommended target state, and the three highest-leverage changes ranked by impact and effort. It is the natural next step for organizations that have worked through the operating model questions in Issues One and Two and are now ready to translate them into platform changes. Book a 30-minute scoping call →

Closing the series. Measure Twice began three issues ago with a diagnostic, walked through the four documents that turn hybrid governance from aspirational into enforceable, and closes here with the architectural decisions that make those documents stick. If you have read all three, you are no longer in the majority who confidently say “we run a hybrid model” without being able to prove it. You are in the smaller group who actually knows.

The next series will start next week. We are weighing three candidate topics: semantic model design patterns for mid-market complexity, the Import versus DirectLake decision (with the framework we use to actually make the call), and capacity sizing and cost management for organizations whose Fabric bill is starting to surprise them.

Measure Twice. #3: Originally Posted on LinkedIn, June 24, 2026