Forum Discussion

afbraga66's avatar
afbraga66
Icon for Helper III rankHelper III
9 months ago
Solved

One Lake Security implementation doubts

Hey,   So am trying to identify how to implement One Lake Security. The goal is to provided self-service for departments which will have each their own workspace, by allowing them access throught s...
governance
one lake
security
  • V-yubandi-msft's avatar
    V-yubandi-msft
    9 months ago

    Hi afbraga66 ,
    If you need RLS to function properly, ensure your queries are run through the SQL Endpoint.
    When using a notebook, use %sql for queries that require RLS, as standard Spark reads (spark.read) do not enforce it yet.

     

    Thanks for your time.

V-yubandi-msft's avatar
V-yubandi-msft
Icon for Community Support rankCommunity Support
9 months ago

Hi afbraga66 ,

Thank you for contacting the Microsoft Fabric Community. I understand that testing OneLake Security with workspace roles and shortcuts can be confusing due to some overlap. 

1. Workspace roles  take precedence over OneLake security.

To ensure OneLake security rules are followed, set the SQL Analytics Endpoint to use User’s identity. This          makes queries respect OneLake role assignments rather than just workspace permissions.

2. Viewers only see the data permitted by OneLake security, while Contributors can access more because of their workspace permissions.
For strict data control, Microsoft recommends using the Viewer role along with OneLake roles.
3. RLS works in Spark notebooks if, OneLake security is enabled, The SQL Endpoint uses User’s identity & Queries go through the SQL Analytics Endpoint, not Spark APIs.

4. Since this is in preview, enforcement may sometimes be delayed or inconsistent. Viewers cannot run notebooks by default. The blog you referred to probably used a Contributor role or a delegated identity (like warehouse owner).

 

Reference: OneLake security access control model (preview) - Microsoft Fabric | Microsoft Learn

 

I hope this helps clarify how OneLake security functions and what to expect during setup.