> ## Documentation Index > Fetch the complete documentation index at: https://docs.generalvalidation.com/llms.txt > Use this file to discover all available pages before exploring further. # What General Validation creates and needs in Fabric > An inventory of the Fabric items setup creates in your tenant, the delegated permissions the app requests, the Fabric access your users need, the endpoints the browser calls, and what removal deletes. Everything General Validation does in Microsoft Fabric runs in your tenant under your users' identities. General Validation has no credential in your tenant and no application (app-only) permission. The enterprise application that appears in your directory after consent is the standard record that carries the delegated permissions below; it acts only when one of your users is signed in. Every permission it requests is delegated, so the app can only do what the signed-in user is already allowed to do in Fabric. No General Validation service identity receives access to your workspaces, OneLake, keys, or secrets. Use this page for procurement and security review. For the setup procedure, see [Set up your Environment](https://docs.generalvalidation.com/get-started/environment.md). For the data boundary as a whole, see [Security and the data boundary](https://docs.generalvalidation.com/administration/security.md). ## Items created by setup When an Owner clicks **Set up General Validation** on Environment, the browser creates the following items in your Fabric tenant with that Owner's own Microsoft identity. | Item | Where | Purpose | | - | - | - | | Dedicated workspace, named for General Validation | Your selected Fabric capacity | Holds the items below. It is never a source or target for validation. | | Default Spark runtime set to Fabric Runtime 2.0 | A setting on the dedicated workspace | The runtime the validation job runs on. | | Lakehouse named GeneralValidationResults | The dedicated workspace | Stores each Run's Results, exact values, and mismatch evidence. | | Spark Job Definition named General Validation executor | The dedicated workspace | One reusable job that runs the instructions prepared for each Run, reads the source and target Tables, and writes Results to the Results Lakehouse. | General Validation stores only a reference to these items so your team can find them. No capacity is purchased or resized; the workspace is assigned to an active capacity you already own, and Runs consume that capacity. Existing business workspaces are never adopted or modified. Reinstall replaces the validation job in place and keeps the Results Lakehouse. ## Permissions requested at sign-in At first sign-in, Microsoft shows one consent prompt for the permissions below. All of them are delegated: the app acts as the signed-in user and never on its own. The app requests no application permissions, no Microsoft Graph permission, and no Azure Service Management permission. | Permission | Used for | | - | - | | Microsoft Fabric: Workspace.ReadWrite.All | List the workspaces and Warehouses you can access, and create, update, or delete only the dedicated General Validation workspace. | | Microsoft Fabric: Capacity.Read.All | List your capacities so an Owner can choose one for the dedicated workspace. | | Microsoft Fabric: Lakehouse.ReadWrite.All | Create the Results Lakehouse and list the Lakehouses you can access. | | Microsoft Fabric: SparkJobDefinition.ReadWrite.All | Install or replace the validation job in the dedicated workspace. | | Microsoft Fabric: SparkJobDefinition.Execute.All | Run the validation job when you start a Run. | | Azure Storage: user\_impersonation | Read Table metadata, Result summaries, exact values, and evidence in OneLake as you. | | General Validation: sign-in | Identify you to General Validation and your Organization. | These permissions do not grant any Fabric access by themselves. Your Fabric roles and your tenant's consent policy still apply to every call. If your tenant requires administrator approval for new applications, the app shows an approval page with a link your administrator can use. One approval covers every permission in this table for everyone in your organization, and nothing is installed in your tenant to grant it. See [Sign-in and team access](https://docs.generalvalidation.com/administration/access.md). ## Access your users need in Fabric Organization membership in General Validation grants no Fabric access. Your Fabric administrators grant the access below through Fabric, and Fabric checks it on every call. | Who | Needs | | - | - | | The Owner who runs setup | Permission to create workspaces and assign them to the chosen active capacity. | | Anyone who starts a Run | Read access to both the source and target Table of the Table Pair, and write access to the Results Lakehouse in the dedicated workspace. | | Anyone who validates a Warehouse Table | Read on the Warehouse item plus SQL SELECT on the Table. SQL permissions alone do not grant OneLake access. | | Anyone who creates Table Pairs or Tests | OneLake access to read Table metadata, such as schemas, Table names, and column names. | | Anyone who opens **View details** on a Result | Access to the dedicated workspace and OneLake read access to the Results Lakehouse, because the browser reads exact values and evidence from there. | A Fabric workspace administrator shares the dedicated workspace with teammates through Fabric. A teammate who has a General Validation role but no Fabric access to a Table or to the Results Lakehouse cannot run that validation or open its details. Validation runs under interactive user accounts. ## Where data is written Each Run writes only to the Results Lakehouse, under `Files/GeneralValidation/results` in a folder named for the Run ID. That folder holds a summary, a details file with the exact values, and Parquet files of mismatch evidence when a Test captures it. You own these files and control their retention; General Validation never deletes them on its own and has no automatic cleanup. Only Remove on Environment deletes the workspace that holds them. You can open or query the folder in Fabric at any time. Source and target Tables are only read. The validation job never writes to them, never executes code supplied at run time, and writes nothing outside the Results Lakehouse. General Validation imports only the summary: verdicts, counts, reason codes, and a reference to the Run's folder. Exact values and mismatched rows reach your screen directly from OneLake and are never sent to General Validation. See [Runs, Results, and evidence](https://docs.generalvalidation.com/validate-data/runs-and-evidence.md). ## Endpoints the browser connects to The app runs in your browser and connects only to the endpoints below, all over HTTPS. Use this list for proxy and firewall allowlists. | Endpoint | Purpose | | - | - | | app.generalvalidation.com | The General Validation application. | | api.generalvalidation.com | The General Validation API: configuration, Run status, and Result summaries. | | login.microsoftonline.com | Microsoft Entra sign-in and consent. | | api.fabric.microsoft.com | Fabric REST API: Environment setup, workspace and Table discovery, Run submission, and job status. | | onelake.dfs.fabric.microsoft.com and onelake.table.fabric.microsoft.com | OneLake: Table metadata such as schemas and column names, Result summaries, exact values, and evidence. | Your browser holds separate Microsoft tokens for General Validation, Fabric, and OneLake. The Fabric and OneLake tokens go only to Microsoft and are never sent to General Validation. The app enforces a strict Content Security Policy that limits connections to the endpoints listed above. Billing checkout and subscription management open Stripe-hosted pages, and Microsoft Marketplace purchases start on Microsoft's site; neither carries Fabric or OneLake tokens. ## Removal Removing General Validation from your tenant takes these steps. 1. An Owner opens **Environment**, clicks **Remove**, and confirms with **Remove Environment**. This deletes the dedicated workspace and everything inside it: the validation job, the Results Lakehouse, all Results, and all mismatch evidence. Any Run still executing in that workspace is affected. Source and target Tables in other workspaces are unaffected. 2. An Entra administrator revokes consent for General Validation under Enterprise applications in Microsoft Entra. This withdraws every delegated permission listed above. 3. If you bought through Microsoft Marketplace, cancel the subscription in the Azure portal; see [Buy on Microsoft Marketplace](https://docs.generalvalidation.com/administration/marketplace.md). General Validation creates no other item or setting in your tenant, so nothing else remains after these steps. Your Table Pairs, Tests, and Run metadata stay in General Validation after removal, but details and evidence from deleted Results can no longer be opened. To delete your Organization and the metadata General Validation holds for it, contact [support@generalvalidation.com](mailto:support@generalvalidation.com). ## Microsoft references Use these Microsoft pages to verify the permission model independently: [OneLake access](https://learn.microsoft.com/en-us/fabric/onelake/onelake-access-api), [OneLake Delta Table APIs](https://learn.microsoft.com/en-us/fabric/onelake/table-apis/delta-table-apis-overview), [create a workspace](https://learn.microsoft.com/en-us/rest/api/fabric/core/workspaces/create-workspace), [create a Lakehouse](https://learn.microsoft.com/en-us/rest/api/fabric/lakehouse/items/create-lakehouse), [create a Spark Job Definition](https://learn.microsoft.com/en-us/rest/api/fabric/sparkjobdefinition/items/create-spark-job-definition), and [run a Spark Job Definition](https://learn.microsoft.com/en-us/rest/api/fabric/sparkjobdefinition/background-jobs/run-on-demand-spark-job-definition). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.