Forum Discussion
Impactful IndividualMinimum permissions needed to share a lakehouse schema
I've discovered the practical 'minimum permissions' to grant access to a table - this forms the practical solution as things currently stand.
If there is a more minimal permission set that works, I'd like to know - there appears to be no explicit 'Explore' permission. 😞
- Grant read access to the lakehouse object
- Using "Manage OneLake Data Access" create a new role (and delete the default role if needed)
- Allow this role read access to the schemas and tables it needs
- Add the USER to the role.
These first 4 steps grant access to the table for pyspark.
- In the SQL endpoint, GRANT SELECT ON <TABLE/SCHEMA> TO USER
This step grants access to preview the data
- Grant Read access on the Direct Lake semantic model to USER
- Grant Read access on / share any reports
The user is now able to see report data based on the Direct Lake model.
Hi spencer_sa ,
Thank you for your detailed summary and for taking the time to explore the current permission model in Microsoft Fabric.
You're correct, there is currently no explicit "Explore" permission in Microsoft Fabric. The combination you've identified Lakehouse-level Read access, schema/table access via OneLake Data Access roles, and GRANT SELECT on the SQL Endpoint forms the practical minimum permission set to enable PySpark querying, table preview in the UI, and Direct Lake semantic model access.
This hybrid approach is expected behavior under the current security model. We appreciate your findings, and your feedback is valuable as we work toward simplifying and unifying permission management in future updates.
If this post helps, then please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.
Thank you.
Hi spencer_sa ,
Thank you for posting in the Microsoft Fabric Community.
The issue is due to missing Explore permissions, which are required for table preview in the Fabric UI. Since the USER has no workspace role, implicit permissions are missing.
To fix this, grant Read + Explore on the Lakehouse and ensure Read access is assigned at both the schema and table levels. Verify that "Manage OneLake Data Access (Preview)" is fully applied and check for any Object-Level Security (OLS) restrictions.
If the issue persists, assign Storage Blob Data Reader in Azure to allow OneLake access. As an alternative, assigning the Viewer role in the workspace can resolve this, but you would need to separately restrict SQL Endpoint access if required.
For more details, refer to the official Microsoft documentation on Lakehouse sharing and permission management - Microsoft Fabric | Microsoft Learn which explains how to manage Lakehouse permissions effectively.
I hope my suggestions give you good idea, if you need any further assistance, feel free to reach out.
If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thank you.
Impactful IndividualNo Explore permissions regardless of removing and re-adding.
I played with a lot of things and ended up GRANTing SELECT on the schema in the SQL Endpoint which caused both the Preview to work *and* the semantic model/report to be able to see the data.
I'm also guessing over the next few months this whole security model is going to be revamped in light of Arun's announcement.
Helo spencer_sa ,
Thank you for the update! I completely understand your frustration with the Explore permissions not working as expected. It’s great that granting SELECT permissions on the SQL Endpoint helped solve the issue and allowed both the Preview and the semantic model/report to work properly.
As you mentioned, there may be some changes to the security model in the future based on Arun’s announcement. These changes might help improve how permissions are handled.
For now, if the SELECT permission on the SQL Endpoint is working well for you, it seems like a good solution.
If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thank you.
Hi spencer_sa ,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.- spencer_sa
I've discovered the practical 'minimum permissions' to grant access to a table - this forms the practical solution as things currently stand.
If there is a more minimal permission set that works, I'd like to know - there appears to be no explicit 'Explore' permission. 😞
- Grant read access to the lakehouse object
- Using "Manage OneLake Data Access" create a new role (and delete the default role if needed)
- Allow this role read access to the schemas and tables it needs
- Add the USER to the role.
These first 4 steps grant access to the table for pyspark.
- In the SQL endpoint, GRANT SELECT ON <TABLE/SCHEMA> TO USER
This step grants access to preview the data
- Grant Read access on the Direct Lake semantic model to USER
- Grant Read access on / share any reports
The user is now able to see report data based on the Direct Lake model.