Granular lakehouse data security with Workspace Private Links

Hi KimMW, 

Right now there is no nice way to enforce RLS with private links. 

• OneLake Security isn't currently supported when a workspace-level private link is enabled for a workspace.

It does appear that the private link will work with the SQL Endpoint: 

Supported scenarios for workspace private links - Microsoft Fabric | Microsoft Learn

But that would not work when working in Notebooks or anything that accesses the data through OneLake. 

Hello KimMW 

Yes, however, OneLake Security cannot be applied directly within the Lakehouse when using workspace-level private links.

RLS/CLS enforcement at the Lakehouse storage layer is not possible in this scenario, as OneLake Security is unsupported with workspace-level private links.

Microsoft has highlighted this restriction as you rightly mention:

• Workspace-level private links do not support OneLake Security (which includes RLS and CLS), meaning item-level and table-level access controls are not enforced at this layer. 

Consequently, OneLake Security RLS/CLS will not be effective if your configuration relies on private links.

Nonetheless, RLS at the model layer remains fully operational, as:

• RLS within Semantic Models (Direct Lake / Import / DirectQuery) is managed by the Power BI engine, rather than OneLake.
• This approach is recommended when OneLake Security is unavailable or not preferred, such as when workspace private links are in use.

This aligns with Microsoft’s guidance for implementing RLS in supported Fabric engines, including SQL Analytics Endpoint and semantic models.

Row-level security - Microsoft Fabric | Microsoft Learn

Hope this helps - please appreciate by leaving a Kudos or accepting as a Solution!