Minimum permissions needed to share a lakehouse schema

I've discovered the practical 'minimum permissions' to grant access to a table - this forms the practical solution as things currently stand.

If there is a more minimal permission set that works, I'd like to know - there appears to be no explicit 'Explore' permission. 😞

• Grant read access to the lakehouse object
• Using "Manage OneLake Data Access" create a new role (and delete the default role if needed)
• Allow this role read access to the schemas and tables it needs
• Add the USER to the role.

These first 4 steps grant access to the table for pyspark.

• In the SQL endpoint, GRANT SELECT ON <TABLE/SCHEMA> TO USER

This step grants access to preview the data

• Grant Read access on the Direct Lake semantic model to USER
• Grant Read access on / share any reports

The user is now able to see report data based on the Direct Lake model.

Hi spencer_sa ,

Thank you for your detailed summary and for taking the time to explore the current permission model in Microsoft Fabric.

You're correct, there is currently no explicit "Explore" permission in Microsoft Fabric. The combination you've identified Lakehouse-level Read access, schema/table access via OneLake Data Access roles, and GRANT SELECT on the SQL Endpoint forms the practical minimum permission set to enable PySpark querying, table preview in the UI, and Direct Lake semantic model access.

This hybrid approach is expected behavior under the current security model. We appreciate your findings, and your feedback is valuable as we work toward simplifying and unifying permission management in future updates.

If this post helps, then please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.