Get in touch
Workload Attestation Document

Microsoft Fabric Vendor (ISV) Attestation Documentation Process

For the 9A Smart Insights workload in Microsoft Fabric

This document provides details on how our 9A Smart Insights workload complies with the requirements for publishing in the Microsoft Fabric Workload Hub. The information outlined here will be kept up-to-date and linked in the Workload metadata manifest.

Section I (ISV Information)

9A Smart Insights workload is developed and maintained by 9altitudes Business Analytics.

Section II (Attestation Declaration)

9altitudes Business Analytics, the vendor of the 9A Smart Insights workload, confirms that the requirements in Section III have been reviewed. We attest that the 9A Smart Insights workload meets and complies with all listed requirements.

Section III: Publish Workload Requirements Attestation Checklist

We, the vendor, 9Altitudes Business Analytics, confirm and attest to reviewing, meeting and complying with the requirements outlined in the Microsoft Fabric Workload Development Kit (WDK) specifically the Publish Workload Requirements located at https://learn.microsoft.com/en-us/fabric/workload-development-kit/publish-workload-requirements.

The following sections document details, exceptions, or variances regarding the attestation of adherence to the Publish Workload Requirements.

Technical Requirements

1. Microsoft Entra Access
The workload(s) use Microsoft Entra authentication and authorization.

[x] No additional authentication and authorization mechanisms are used
[ ] Additional authentication and authorization mechanisms are used for stored data in Fabric

The 9A Smart Insights workload leverages Microsoft Entra authentication and authorization to ensure secure access and integration within the Microsoft Fabric ecosystem. This enables centralized identity management and streamlined security, adhering to Microsoft's guidelines. We do not use any alternative authentication and authorization methods.

2. OneLake
Workloads integrate with OneLake to store data in the standard formats supported by the Fabric platform so that other services can take advantage of it.

[x] All data and metadata is stored in OneLake or Fabric Data Stores
[ ] Not all data and metadata is stored in OneLake or Fabric Data Stores

The workload integrates with OneLake to store data in supported standard formats. This ensures interoperability with other Fabric services, allowing customers to leverage the platform's shared data capabilities. Any data changes by the workload is stored in the customer's OneLake. No customer data is accessed or stored outside the customer's tenant.

3. Microsoft Entra Conditional Access
Enterprise customers require centralized control and management of the identities and credentials used to access their resources and data via Microsoft Entra to further secure their environment via conditional access.

[x] The service works in its entirety even if customers enable this functionality
[ ] The service works with limitations if customers enable this functionality
[ ] The service does not work with Microsoft Entra Conditional Access

The 9A Smart Insights workload fully supports Microsoft Entra Conditional Access by relying on the capabilities of the Microsoft Azure platform. This ensures centralized control and management of identities and credentials, providing enterprise customers with enhanced security and the ability to enforce conditional access policies seamlessly within their environment.

4. Admin REST API
Admin REST APIs are an integral part of Fabric admin and governance process. These APIs help Fabric admins in discovering workspaces and items, and enforcing governance such as performing access reviews, etc. Basic functionality is supported as part of the Workload Development Kit and doesn't need any work from Partners.

[ ] Microsoft Fabric Admin APIs are being leveraged (/admin/*)
[x] No Microsoft Fabric Admin APIs are being used

5. Customer Facing Monitoring & Diagnostic
Health and telemetry data needs to be stored for a minimum of 30 days including activity ID for customer support purposes, including Trials.

[x] Minimum 30 days requirement is adhered to
[ ] Vendor stores the data for __ additional days beyond the minimum requirement

6. B2B
The implementation of the workload is in line with Microsoft Fabric's sharing strategy focused on allowing customers to collaborate with their business partners, customers, vendors, subsidiaries etc. It also means users from other tenants can potentially be granted access to items partners are creating.

[ ] Cross tenant B2B collaboration supported
[x] Workload Item Access only within the tenant

Work item access is only supported within the customer tenant.

7. Business Continuity and Disaster Recovery
The vendor has a comprehensive Business Continuity and Disaster Recovery (BCDR) plans designed to tackle unplanned disasters and recovery steps.

9Altitudes Business Analytics maintains BCDR plans that include data backup strategies, service recovery procedures, and disaster response protocols. Our service architecture leverages Azure's built-in resilience capabilities to ensure business continuity. Detailed BCDR documentation is available through our support channels and service agreements.

8. Performance
The Workload implementation takes measures to test and track performance of their Items.

[ ] Performance Metrics on workload performance are available via the monitoring hub
[ ] Workload additionally includes a separate monitoring UI to test and track performance
[x] Performance tracking is not currently available to the end user however vendor support personnel can monitor, test, track performance via their internal instrumentation and monitoring systems

9. Presence
To ensure that customer expectations independent of their home or capacity region are met, vendors need to align with Fabric regions and clouds. Availability in certain regions also impacts your Data Residency commitments.

[x] Service availability and colocation/alignment in the following fabric regions. The service is available in all Azure regions where Microsoft Fabric is supported, ensuring global availability and data residency compliance.
[ ] All or part of the service does not reside in Azure

10. Public APIs
Fabric Public APIs are the backbone of automation, enabling seamless communication and integration for both customers and partners within the Fabric ecosystem. Fabric Public API empowers users to build innovative solutions, enhance scalability, and streamline workflows.

[x] The workload uses Fabric Public APIs

Design/UX Requirements

1. Common UX
The workload and all item types the partner provides as part of it comply with the Fabric UX guidelines.

[ ] The following variance and/or exceptions have been granted by Microsoft

The workload complies with the Fabric UX guidelines, ensuring consistency and familiarity for users across different Fabric workloads.

2. Item Creation Experience
The item creation experience is in accordance with the Fabric UX System.

[x] Yes
[ ] No

3. Monitoring Hub
All long running operations need to integrate with Fabric Monitoring Hub.

[ ] Yes
[x] No

Currently we don't support any long-running operations within the workload that require monitoring hub integration.

4. Trial Experience
The workload provides a Trial Experience for users as outlined in the design guidelines.

[x] Trial Supported
[ ] Trial Not Supported

5. Monetization Experience
The monetization experience is in line with the design guidelines provided.

[ ] The monetization experience is completely integrated with the marketplace and compliant with the guidelines
[x] Bring Your Own License (BYOL)
[ ] Free / Freemium
[ ] Other

We provide an initial Trial experience with the workload. A customer can setup a license to use the full experience of the 9A Smart Insights experience.

License can be acquired through Contact Us link provided in the Azure Marketplace, or with purchasing a license directly from us.

6. Accessibility
The user experience is in compliance with the Fabric UX design guidelines for Accessibility.

[x] The user experience is completely compliant with the guidelines
[ ] The following limitations exist

7. World Readiness / Internationalization
English is supported as the default language. Localization, though optional, should be considered.

[] English is the only supported language
[x] The following are the additional languages supported

  • English
  • Dutch

8. Item Settings
Item settings are implemented as a part of the ribbon as outlined in the UX guidelines.

[x] Yes
[ ] No

Ribbon is implemented and provides access to the Item settings in accordance with Fabric UX guidelines.

9. Samples
Samples are optionally provided that preconfigure items of their type to help customers get started more easily.

[x] Samples not provided
[ ] Samples for pre-configuration of items provided

10. Custom Actions
Custom actions can be optionally provided as a part of the item editor.

[x] Custom Actions are not implemented
[ ] Custom Actions implemented as part of Workload

11. Workspace Settings
Workspace settings provide a way that workloads can be configured on a workspace level.

[x] Supported
[ ] Not Supported

12. Global Search
Searching for items in Fabric is supported through the top search bar.

[ ] Supported
[x] Not supported

Security & Compliance Requirements

1. Security General
Protection of customer data and metadata is of paramount importance. Workloads must go through a security review and assessment. Vendor attests that the security review and assessment was completed and will be periodically performed as enhancements and changes are made. Security issues discovered which could have a detrimental impact on the customer should be addressed promptly and customers notified where applicable.

The 9A Smart Insights workload is designed with the protection of customer data and metadata as a paramount concern. The following security measures are in place:

  • All metadata stored and created with the workload is stored in the tenant of the customer
  • Security vulnerabilities are addressed promptly with customer notification where applicable
  • All data processing occurs within the customer's tenant boundary
  • No customer data is transmitted outside the Microsoft Fabric environment
  • Comprehensive security documentation is maintained and updated regularly

2. Privacy
Partners that build workloads also have a responsibility to protect that data when they access it. Every workload goes through a privacy assessment and a privacy review. Vendor attests that privacy review was completed and is periodically performed as enhancements and changes are made.

Extra Requirements:

[x] Publisher attests that only essential HTTP-only cookies are used by the Workload and only after positively authenticating the user
[x] Publisher attests that it is not using or relying on third-party cookies as part of their solution
[x] Publisher attests that is obtaining any Microsoft Entra token using the JavaScript APIs provided by the Fabric Workload Client SDK

The workload complies with privacy requirements. Our privacy policy and data handling practices are available at: https://9altitudes.com/fabric-workload/privacy-policy

Key privacy measures:

  • No third-party cookies are used
  • Microsoft Entra tokens obtained through Fabric Workload Client SDK APIs
  • Customer data remains within tenant boundaries

3. Data Residency
Microsoft Fabric is making an Enterprise Promise around data not leaving the geography of the tenant for stored data and data in transit. As a workload in Fabric, customers need to be aware what your commitments to Data Residency are.

9Altitudes Business Analytics commits to ensuring that customer data does not leave the geography of the tenant. All data processing and storage occurs within the customer's designated Microsoft Fabric region. No customer data is transferred outside the tenant's geographic boundary during processing or storage operations.

4. Compliance
The publisher attests to the following security, data and compliance regulations and standards.

The 9A Smart Insights workload adheres to industry-standard security, data, and compliance regulations:

Security and Compliance Standards:

  • GDPR compliance for data protection

Data Handling Practices:

  • All data processing occurs within customer tenant
  • Encryption in transit and at rest
  • Access controls aligned with Microsoft Entra
  • Audit logging and monitoring capabilities

Support

1. Live Site
Partner workloads are an integral part of Fabric that require the Microsoft support teams to be aware of how to contact you in case customers are reaching out to us directly.

Microsoft direct vendor outreach:

Contact Name/Team: 9A Smart Insights Development Team
Number: +31 (0)318 561 055
Email alias: smartinsights.dev.ba@9altitudes.com
Self Service portal: N/A

2. Supportability
Vendors are responsible for defining and documenting their support parameters (Service level agreement, contact methods, ...). This information needs to be linked from the Workload page and should always be accessible to customers. In addition, the Marketplace criteria need to be taken into account for the listing of the SaaS offer.

[x] Vendor attests that support information is published to the marketplace offering and available to users/customers directly via the workload

Licensing for the 9A Smart Insights for Fabric solution includes an SLA and support with implementing 9A Smart Insights Fabric solutions, and optionally includes a matching quickstart with a semantic model and reports.

We also provide support using our Customer Success Team.

Contact Name/Team: 9A Smart Insights Customer Support Team
Number: +31 (0)318 742 147
Email alias: support.ba@9altitudes.com
Self Service portal: https://portal.hillstar.nl

3. Service Health and Availability
Vendors need to host a service health dashboard that shows their service health and availability to customers. This information can be included on the Supportability page.

We currently do not have the a service health dashboard available.

Fabric Features

1. Application Life Cycle Management (ALM)
Microsoft Fabric's lifecycle management tools enable efficient product development, continuous updates, fast releases, and ongoing feature enhancements.

[ ] Supported
[x] Not Supported

2. Private Links
In Fabric, you can configure and use an endpoint that allows your organization to access Fabric privately.

[ ] Supported
[x] Not Supported

3. Data Hub
The OneLake data hub makes it easy to find, explore, and use the Fabric data items in your organization that you have access to. It provides information about the items and entry points for working with them. If you're implementing a Data Item, show up in the Data Hub as well.

[] Supported
[x] Not Supported

4. Data Lineage
In modern business intelligence (BI) projects, understanding the flow of data from the data source to its destination can be a challenge. The challenge is even bigger if you built advanced analytical projects spanning multiple data sources, data items, and dependencies. Questions like "What happens if I change this data?" or "Why isn't this report up to date?" can be hard to answer.

[ ] Supported
[x] Not Supported

5. Sensitivity Labels
Sensitivity labels from Microsoft Purview Information Protection on items can guard your sensitive content against unauthorized data access and leakage. They're a key component in helping your organization meet its governance and compliance requirements. Labeling your data correctly with sensitivity labels ensures that only authorized people can access your data.

Extra requirements:
For partners that are using Export functionality within their Item they need to follow the guidelines.

[ ] Supported
[x] Not Supported

Additional Notes

References

Document Version: 1.0
Last Updated: October 17, 2025