Forum Discussion
Helper IIIssue with Onelake security RLS
This is the expected behavior once you remove the DefaultRole. With OneLake Security enforced, item-level Read + ReadAll on the lakehouse no longer grants access to the underlying table paths on its own; the user has to be a member of a data access role that actually includes those tables. Your test user is not in the ALLTables role, so OneLake correctly returns UnauthorizedToAccessTableFiles.
Two options to fix it: add the test user (or a security group they belong to) as a member of the ALLTables role, or if you want the pre-role behavior back, re-create the DefaultRole so ReadAll on the item once again maps to reading all tables.
After you update role membership, wait a few minutes for the change to propagate and have the user sign out of Fabric and back in before retrying.
If this helped, a thumbs up and marking it as the accepted solution would be appreciated.
Thanks,
Shai Karmani
Super UserNote: OneLake security = Workspace access + Data role. Missing either will fail with the same error.
Add the user (or a group) to the ALLTables role and assign at least Viewer role on the workspace. If you want legacy behaviour, recreate DefaultRole, which maps ReadAll to full table access.