A domain nested under a Fabric domain to group workspaces more finely. It doesn't get its own admins, since admins of the parent domain look after it, and for now only general settings are available for it.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Subdomain in context, with comparison tables and the common traps.
Terms in this definition
- Domain
A way of grouping workspaces by area of the business, in support of a data mesh approach. Items take on their workspace's domain, letting you filter the OneLake catalog by it, and certain tenant settings can be passed to domain admins; domains have no effect on access permissions.
- Get
Key Vault permission on secrets that allows a single secret to be read; App Service Key Vault references need nothing beyond it.
Related terms
- Apex domain
The bare domain without any subdomain (example.com), also known as the zone apex or root domain. Since a CNAME is not allowed there, routing it to a service like Front Door relies on CNAME flattening or Azure DNS alias records.
- Child zone
When a subdomain like research.adatum.com gets its own DNS zone, the parent zone delegates to it using an NS record set with the subdomain's name.
- Cognitive Services Speech User
Grants use of the Speech transcription and synthesis APIs, real-time and batch, and lets you view but not change custom models; pair it with a custom subdomain when authenticating through Entra ID.
- _dnsauth TXT record
A TXT record named
_dnsauth.<subdomain>that Front Door Standard/Premium checks to confirm you own a domain. It plays no part in routing. - Regional endpoint (Foundry Tools)
Endpoint shared by everyone in a region, for example eastus.api.cognitive.microsoft.com. Keys work with it, but Microsoft Entra ID authentication requires a custom subdomain instead.
- Wildcard certificate
Issued for *.domain, this TLS certificate secures any first-level subdomain, so new host names on a listener are covered; the bare apex and multi-level subdomains are not.