Forum Discussion

Srisakthi's avatar
Srisakthi
Super User
1 year ago

RLS using EntraId groups on Warehouse

Hi Everyone,

 

Could you please share your insights on how we can apply RLS using ADgroups(EntraId groups) on warehouse tables.

for ex., i have a table of sales data in my fabric warehouse and i want to restrict access to the for certain group(AD groups) of people.

 

I had come across article to restrict for specific users but want to restrict by using ADgroups. Below is the article similar to my question , however the problem with that approach is have to maintain groups in my warehouse table.

https://medium.com/@gcp.azure.aws/implementing-row-level-security-in-microsoft-fabric-sql-endpoint-warehouse-with-microsoft-entra-ce991e319055

I dont want maintain ADgroups in my warehouse table, any leads would be much appreciated!

 

 

 

 

Regards,

Srisakthi

data warehouse

9 Replies

  • v-sdhruv's avatar
    v-sdhruv
    Community Support
    1 year ago

    Hi Srisakthi  ,

    You can -
    1.Use Entra ID Group Membership in SQL Endpoint RLS Policies

    Define RLS policies at the SQL endpoint level using IS_Member('groupname') or similar functions.

    This allows you to check if the current user belongs to a specific Entra ID group without needing that group listed in the table.

    or use


    2.Centralized Role Management via OneLake RBAC

    OneLake RBAC (Role-Based Access Control) supports fine-grained access control at folder and file levels.

    You can assign read/write permissions to Entra ID groups directly at the workspace or folder level, which cascades to the warehouse.

    More about - One Lake Security

    Additinally, you might want to check out-
    Dynamic RLS with AD Security Groups 

    Hope this helps!
    If the response has addressed your query, please accept it as a solution  so that other members can easily find it.
    Thank You!

    • Shreya_Barhate's avatar
      Shreya_Barhate
      Resolver II
      1 year ago

      Hi  v-sdhruv 

      I've been trying to implement RLS using Entra ID groups on my Lakehouse table in SQL endpoint, but I'm running into issues.

      Here's what I tried:

       

      CREATE FUNCTION Security.fnRLSGroupFilter(@UserPrincipalName AS VARCHAR(100))

      RETURNS TABLE

      WITH SCHEMABINDING

      AS

      RETURN

          SELECT 1 AS AccessGranted

          WHERE IS_MEMBER('ReaderFabricDemoGroup') = 1;

      GO

       

      I have also tried using @UserName

       

      However, the policy doesn't seem to work as expected. 

       

      Can you share some sample scripts or working examples of RLS using Entra ID groups in Fabric lakehouse SQL Endpoint or Warehouse tables? It would be super helpful to see how others have approached this.

      Thanks!

       

      • Srisakthi's avatar
        Srisakthi
        Super User
        1 year ago

        Hi Shreya_Barhate ,

         

        Thanks for your detailed exploration.

        v-sdhruv   I have even tried earlier it was not working. Shreya also shared her observation. Could you please share some samples on it.

         

        Regards,

        Srisakthi

  • v-sdhruv's avatar
    v-sdhruv
    Community Support
    1 year ago

    HIi Srisakthi ,

    Just wanted to check if the response has addressed your query?
    If any of the responses has addressed your query, kindly accept it as a solution so that other members can also benefit from it.

    Thank You!