What General Validation creates and needs in Fabric

Everything General Validation does in Microsoft Fabric runs in your tenant under your users’ identities. General Validation has no credential in your tenant and no application (app-only) permission. The enterprise application that appears in your directory after consent is the standard record that carries the delegated permissions below; it acts only when one of your users is signed in. Every permission it requests is delegated, so the app can only do what the signed-in user is already allowed to do in Fabric. No General Validation service identity receives access to your workspaces, OneLake, keys, or secrets. Use this page for procurement and security review. For the setup procedure, see Set up your Environment. For the data boundary as a whole, see Security and the data boundary.

​

Items created by setup

When an Owner clicks Set up General Validation on Environment, the browser creates the following items in your Fabric tenant with that Owner’s own Microsoft identity. General Validation stores only a reference to these items so your team can find them. No capacity is purchased or resized; the workspace is assigned to an active capacity you already own, and Runs consume that capacity. Existing business workspaces are never adopted or modified. Reinstall replaces the validation job in place and keeps the Results Lakehouse.

​

Permissions requested at sign-in

At first sign-in, Microsoft shows one consent prompt for the permissions below. All of them are delegated: the app acts as the signed-in user and never on its own. The app requests no application permissions, no Microsoft Graph permission, and no Azure Service Management permission. These permissions do not grant any Fabric access by themselves. Your Fabric roles and your tenant’s consent policy still apply to every call. If your tenant requires administrator approval for new applications, the app shows an approval page with a link your administrator can use. One approval covers every permission in this table for everyone in your organization, and nothing is installed in your tenant to grant it. See Sign-in and team access.

​

Access your users need in Fabric

Organization membership in General Validation grants no Fabric access. Your Fabric administrators grant the access below through Fabric, and Fabric checks it on every call. A Fabric workspace administrator shares the dedicated workspace with teammates through Fabric. A teammate who has a General Validation role but no Fabric access to a Table or to the Results Lakehouse cannot run that validation or open its details. Validation runs under interactive user accounts.

​

Where data is written

Each Run writes only to the Results Lakehouse, under Files/GeneralValidation/results in a folder named for the Run ID. That folder holds a summary, a details file with the exact values, and Parquet files of mismatch evidence when a Test captures it. You own these files and control their retention; General Validation never deletes them on its own and has no automatic cleanup. Only Remove on Environment deletes the workspace that holds them. You can open or query the folder in Fabric at any time. Source and target Tables are only read. The validation job never writes to them, never executes code supplied at run time, and writes nothing outside the Results Lakehouse. General Validation imports only the summary: verdicts, counts, reason codes, and a reference to the Run’s folder. Exact values and mismatched rows reach your screen directly from OneLake and are never sent to General Validation. See Runs, Results, and evidence.

​

Endpoints the browser connects to

The app runs in your browser and connects only to the endpoints below, all over HTTPS. Use this list for proxy and firewall allowlists. Your browser holds separate Microsoft tokens for General Validation, Fabric, and OneLake. The Fabric and OneLake tokens go only to Microsoft and are never sent to General Validation. The app enforces a strict Content Security Policy that limits connections to the endpoints listed above. Billing checkout and subscription management open Stripe-hosted pages, and Microsoft Marketplace purchases start on Microsoft’s site; neither carries Fabric or OneLake tokens.

​

Removal

Removing General Validation from your tenant takes these steps.

1. An Owner opens Environment, clicks Remove, and confirms with Remove Environment. This deletes the dedicated workspace and everything inside it: the validation job, the Results Lakehouse, all Results, and all mismatch evidence. Any Run still executing in that workspace is affected. Source and target Tables in other workspaces are unaffected.
2. An Entra administrator revokes consent for General Validation under Enterprise applications in Microsoft Entra. This withdraws every delegated permission listed above.
3. If you bought through Microsoft Marketplace, cancel the subscription in the Azure portal; see Buy on Microsoft Marketplace.

General Validation creates no other item or setting in your tenant, so nothing else remains after these steps. Your Table Pairs, Tests, and Run metadata stay in General Validation after removal, but details and evidence from deleted Results can no longer be opened. To delete your Organization and the metadata General Validation holds for it, contact support@generalvalidation.com.

​

Microsoft references

Use these Microsoft pages to verify the permission model independently: OneLake access, OneLake Delta Table APIs, create a workspace, create a Lakehouse, create a Spark Job Definition, and run a Spark Job Definition.