Forum Discussion
Granular Permission on views
I have made views on top of lakehouse tables (tried building them within lakehouse as well and in a seperate warehouse as well)
-Views Within Lakehouse
I am able to grant granular persmissions via T-SQL where the user only sees those views which are granted on SQL-end point interface but under OneLake the user can still see the names of all the tables present in my lakehouse.
-Views in Warehouse
I also have tried making same views in seperate warehouse which are referring to tables in lakehouse, the issue here is when user queries those views it asks for permission of tables on which views are built.
again now if i provide only connect level access to user it can still see all my table names and columns in OneLake
Hi zas3112 ,
Thank you for reaching out to the Microsoft Fabric Community Forum.
I appreciate the detailed insights shared by nilendraFabric . I’d like to clarify the permission behavior in Microsoft Fabric based on its current security model.
Views within Lakehouse – Table Visibility in OneLake
- OneLake exposes metadata (table names and schemas) even if users don’t have access to the underlying data. Currently, there is no way to completely hide table names in OneLake.
- Removing Workspace Viewer permissions does not prevent metadata visibility in OneLake but can help restrict access to other workspace assets.
- OneLake Data Access Roles (Preview) allow defining folder-level security to restrict access to the actual data files. However, this does not hide table metadata from appearing in the Fabric UI.
Views in a Separate Warehouse – Permission Issues
- In Microsoft Fabric, when creating views in a Warehouse that reference Lakehouse tables, users still need permissions on the base tables in the Lakehouse.
- This is because Fabric enforces security at the source level, meaning a user must have explicit permissions on both the Warehouse view and the referenced Lakehouse tables.
For more information, refer to the official
Fabric Warehouse permissions documentation.
If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.
Thank you.
5 Replies
- nilendraFabric
Super User
Hello zas3112
You can Create custom schemas to group tables for better data discovery and access control. Store tables in these schemas to manage access
or try removing workspace viewer permissions and apply item-level permissions on the warehouse so a less privileged user can only view the warehouse data and not the lakehouse data
OneLake Data Access Roles (Preview)
Define roles with read permissions to specific folders in OneLake. OneLake folder security is inheritable for all subfolders
v-saisrao-msftCommunity Support
Hi zas3112 ,
Thank you for reaching out to the Microsoft Fabric Community Forum.
I appreciate the detailed insights shared by nilendraFabric . I’d like to clarify the permission behavior in Microsoft Fabric based on its current security model.
Views within Lakehouse – Table Visibility in OneLake
- OneLake exposes metadata (table names and schemas) even if users don’t have access to the underlying data. Currently, there is no way to completely hide table names in OneLake.
- Removing Workspace Viewer permissions does not prevent metadata visibility in OneLake but can help restrict access to other workspace assets.
- OneLake Data Access Roles (Preview) allow defining folder-level security to restrict access to the actual data files. However, this does not hide table metadata from appearing in the Fabric UI.
Views in a Separate Warehouse – Permission Issues
- In Microsoft Fabric, when creating views in a Warehouse that reference Lakehouse tables, users still need permissions on the base tables in the Lakehouse.
- This is because Fabric enforces security at the source level, meaning a user must have explicit permissions on both the Warehouse view and the referenced Lakehouse tables.
For more information, refer to the official
Fabric Warehouse permissions documentation.
If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.
Thank you.
- v-saisrao-msft
Hi zas3112,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you. - v-saisrao-msft
Hi zas3112,
May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.
Thank you.
- v-saisrao-msft
Hi zas3112,
We haven’t heard back from you regarding your issue. If it has been resolved, please mark the helpful response as the solution and give a ‘Kudos’ to assist others. If you still need support, let us know.
Thank you.
