Forum Discussion
Need to secure a table - thoughts on how?
Hey folks, I have a use case where we have some very secure data that only 3-4 users may have privilege to view (just Read). We cannot have anyone else in the organization/tenant view this table (all tables live in a Data Lakehouse).
My team and I had several ideas on how to do this (such as creating a separate workspace for the 3-4 privlieged users, creating a new lakehouse just for the sensitive data, etc).
Just wanted the broader communities thoughts on how they would implement this.
Thanks!
Hello Bshin
OneLake Data Access Roles provide folder-level access control within your lakehouse:
Create a custom role for your sensitive data
Assign this role to the specific folder containing your sensitive table
Add only your 3-4 privileged users to this role
Ensure these users aren't also assigned to the DefaultReader role (which grants access to all folders)
https://data-mozart.com/understanding-data-access-options-in-microsoft-fabric/Be aware that implementing RLS, OLS, or CLS on the SQL analytics endpoint will cause Power BI queries in Direct Lake mode to fall back to Direct Query mode
Users with write access (Admin, Member, Contributor roles) aren't restricted by OneLake data access roles - they retain full access to data in OneLake
For complete isolation, consider creating a separate workspace for this sensitive data, as OneLake data access roles currently only apply to users accessing OneLake directly
3 Replies
Hello Bshin
OneLake Data Access Roles provide folder-level access control within your lakehouse:
Create a custom role for your sensitive data
Assign this role to the specific folder containing your sensitive table
Add only your 3-4 privileged users to this role
Ensure these users aren't also assigned to the DefaultReader role (which grants access to all folders)
https://data-mozart.com/understanding-data-access-options-in-microsoft-fabric/Be aware that implementing RLS, OLS, or CLS on the SQL analytics endpoint will cause Power BI queries in Direct Lake mode to fall back to Direct Query mode
Users with write access (Admin, Member, Contributor roles) aren't restricted by OneLake data access roles - they retain full access to data in OneLake
For complete isolation, consider creating a separate workspace for this sensitive data, as OneLake data access roles currently only apply to users accessing OneLake directly
There is lots of documentation on this topic. Please read through that
https://learn.microsoft.com/en-us/fabric/data-engineering/lakehouse-sharing
https://learn.microsoft.com/en-us/fabric/data-warehouse/security
https://databear.com/control-access-microsoft-fabric-lakehouse/
make sure to understand the difference between Lakehouse tables and Lakehouse SQL Endpoint tables.
Hi Bshin,
As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for your issue worked? or let us know if you need any further assistance here?
lbendlin & nilendraFabric , Thanks for your promt response
Thanks,
Prashanth Are
MS Fabric community support
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query
