Forum Discussion
One Lake Security implementation doubts
Hey,
So am trying to identify how to implement One Lake Security. The goal is to provided self-service for departments which will have each their own workspace, by allowing them access throught shortcuts to data centralized in another workspace. So based on this I started testing how all it works, but so far I'm finding it somewhat confusing. My first approach was to create a test workspace with a lakehouse with a few tables, then I would go test the shortcut to data in another workspace approach. The thing is I'm stuck in the first approach due to not being sure how things work.
Currently I have a workspace with two users: user A - admin and user B (da_test) with contributor or viewer.
- Deleted the DefaultReader role.
- Have a role named - SecurityDemo configured as below with my user B as a member.
- The SQL Analyitcs endpoint is set to User's Identity.
Based on this I assumed I had all the necessary configs.
So my questions are:
- If the user has contributor role does it really ignore all the one lake security configs?
- My user B sees only schema dbo if it has viewer role, else if it has contributor it sees more schemas. Is this intended?
- Is it possible to run spark notebooks and have RLS and One Lake Security taking effect on the SQL queries results? Or it just isn't a feature?
Microsoft talk about RLS in spark notebooks, but I don't seem to understand how to implment it. Even adding RLS in the permissions of the table it just doesn't work or it takes a long time to take effect. https://learn.microsoft.com/en-us/fabric/onelake/security/row-level-security#enforce-row-level-security
I was checking this blog and it seems to be so, but with viewer role I can't run notebooks? I don't understand how he does it..https://thatfabricguy.com/onelake-security-preview-in-microsoft-fabric/#onelakesecurity
Thank you for you help!
Best regards,
André
Hi afbraga66 ,
If you need RLS to function properly, ensure your queries are run through the SQL Endpoint.
When using a notebook, use %sql for queries that require RLS, as standard Spark reads (spark.read) do not enforce it yet.Thanks for your time.
9 Replies
Hi afbraga66 ,
Thank you for contacting the Microsoft Fabric Community. I understand that testing OneLake Security with workspace roles and shortcuts can be confusing due to some overlap.
1. Workspace roles take precedence over OneLake security.
To ensure OneLake security rules are followed, set the SQL Analytics Endpoint to use User’s identity. This makes queries respect OneLake role assignments rather than just workspace permissions.
2. Viewers only see the data permitted by OneLake security, while Contributors can access more because of their workspace permissions.
For strict data control, Microsoft recommends using the Viewer role along with OneLake roles.
3. RLS works in Spark notebooks if, OneLake security is enabled, The SQL Endpoint uses User’s identity & Queries go through the SQL Analytics Endpoint, not Spark APIs.4. Since this is in preview, enforcement may sometimes be delayed or inconsistent. Viewers cannot run notebooks by default. The blog you referred to probably used a Contributor role or a delegated identity (like warehouse owner).
Reference: OneLake security access control model (preview) - Microsoft Fabric | Microsoft Learn
I hope this helps clarify how OneLake security functions and what to expect during setup.
Hello,
Thanks for your response.
What missing configs might I have so that the RLS doesn't work or to run sparks notebooks with it? Based on my inputs in the original post I thought I had it all done, but it doesn't work. Do you know of any guide or tutorial on how to set this up? I've been searching multiple things but so far was not able to find anything crystal clear.Thanks you.
Best regards,
André
Hi afbraga66 ,
I understand why this might be confusing. OneLake Security is still in preview, and its interaction with workspace roles can seem inconsistent. Here are the main points to keep in mind.
1. Contributors can bypass most OneLake Security restrictions. For RLS to take effect, ensure the SQL Analytics Endpoint is set to use the user’s identity; otherwise, queries use the workspace identity and ignore RLS.
2. RLS should be defined at the table level, with users or groups assigned to those roles. Remember to include a base access role (like DefaultReader or a custom role), or users may not see any data. When testing RLS, use the Viewer role, as Contributors can override restrictions.
3. Spark notebooks do not enforce RLS when using Spark APIs like spark.read. RLS and OneLake Security only apply when queries go through the SQL Endpoint, including %sql in notebooks. This explains why some blog examples worked they probably used Contributor with the SQL Endpoint.
As this feature is still in preview, updates to RLS rules might take some time to take effect.
Helpful Reference : Row-level security - Microsoft Fabric | Microsoft Learn
Thank You.
Hi afbraga66 ,
Could you let me know if your issue has been resolved or if you still need any help? If you require further assistance, please let us know.
Thank you.Hi afbraga66 ,
May I know if your issue is resolved? If you need any further help, please let us know.Hey,
It is still not clear to me how is a user supposed to run spark notebooks and have the rls be applied, if a viewer user cannot run queries. Thank you.
Best regards,
Andre
Hi afbraga66 ,
If you need RLS to function properly, ensure your queries are run through the SQL Endpoint.
When using a notebook, use %sql for queries that require RLS, as standard Spark reads (spark.read) do not enforce it yet.Thanks for your time.
Hi afbraga66 ,
Everything seems clear now. Do you need any additional information or clarification?
Thanks.
Hi, thanks for your help. Things are more clearer now.
Best regards,
André
