Forum Discussion

Sanyukti_Jain's avatar
Sanyukti_Jain
Advocate II
2 months ago
Solved

Security (RLS & sensitivity labels)

Has anyone implemented row-level security alongside sensitivity labels in a Fabric workspace? Curious how these two work together in practice and any gotchas to watch out for
  • Parchitect's avatar
    2 months ago

    Hello!

    Yes, but I would treat them as two different security/governance layers. We do implement both this capabilities.

    RLS controls data access at the row level. For example, the same report can be used by multiple users, but each user only sees the rows they are allowed to see based on their role, region, department, customer, etc.
    Users should only see rows depending on their region as example.

    Sensitivity labels solve a different problem. They classify the sensitivity of the content, such as Internal, Confidential, or Highly Confidential, and can help protect the data when it is shared or exported. Depending on how the label is configured in Purview, exported files can inherit the label and protection, for example requiring organizational accounts to open the file and preventing access outside the organization. 

    So I would not see labels as a replacement for RLS.

    Mental model:

    Workspace/item permissions = who can access the asset
    RLS = which rows they can see
    Sensitivity labels = how sensitive the content is and how it should be protected, especially when it leaves Fabric/Power BI

    A few gotchas:
    - Test RLS with real users or “View as” before production.
    - Use Entra ID groups instead of assigning individual users.
    - Be careful with Build permission on semantic models.
    - Validate export scenarios like Excel, PowerPoint, PDF, and Analyze in Excel so that you can see that labels are inherited.
    - Make sure the label policy matches the actual business sensitivity of the data. An information classification is made of the data, and we match correct labels for it.

    In practice, they work well together: RLS limits what data the user sees, and sensitivity labels help classify and protect the content they are allowed to access. We enforced that labels must be applied, you can set the option togheter with Microsoft Purview. RLS is not enforced by default, its depending on the business requirements.

     

    Best regards,

    Parchitect - Solutions Architect

    💡Did my response help you? Clicking Kudos is a small gesture that goes a long way!

    ✔️Did I answer your question? Please mark my post as a Solution to help others find it faster.